jai besoin daide....svp qqun

Question

Bonjour, a tous jespere que qqun puisse maider. jai windows vista home premium. jai attrappe y a 2 sem. virtualmundo et superjuan ..jai cherhce jai fait des scan etc et ils me semblaient disparus mais voila quils reapparaissent de temps en temps et mon antivirus me demande de les effacer mais apres qqes jour une fenetre reapparais. jai limpression quils se cachent malgre tout les scans ds mon ordi et y restent... maintenant mon ordi ce met a des comportements bizarres...il ralentis...gele.. etc....svp qqun pourrait maider a me debarasser de ca et revenir comme avant ou devrai-je faire un reboot de mon disque dur et remettre tout a zero pour etre sur du resultat?
jai ete voir hijackthis et voici le rapport.

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exeg\h\gghgg'ggg\g
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Eset
od32krn.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\STacSV.exe
C:\Windows\System32\PAStiSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\ESET
od32kui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Leo\Downloads\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ASocksrv] SocksA.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32
vHotkey.dll,Start
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

pimprenelle27 · Answer

il manque le début du rapport avec la version du pc .....

crapoulou · Answer

Salut, il manque le début du rapport.
EDIT : oups désolé pimprenelle, j'te laisse.
Bonne continuation.

InfernO.vir · Answer

Slt,

je suis... au passage plusieurs infections visible au niveau des proccess en cours.

papi · Answer

bon dsl ....voici mon rapport au complet..jespere


oui excusez moi jallais jsutement le poster jviens de remarquer.....dsl..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:05:33 PM, on 11/14/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exeg\h\gghgg'ggg\g
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Eset
od32krn.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\STacSV.exe
C:\Windows\System32\PAStiSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\ESET
od32kui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Leo\Downloads\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ASocksrv] SocksA.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32
vHotkey.dll,Start
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

pimprenelle27 · Answer

Je vous laisse j'y vais. c'était juste pour faire avancer, je dois aller me coucher. désolé.

InfernO.vir · Answer

Qui prend le sujet ? moi je vous le laisse ce n'est pas moi le 1er a etre intervenu ici :)

InfernO.vir · Answer

Fait ceci stp :

-http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

-Suis bien les indications 

-Poste le rapport a la fin.

A +

Utilisateur anonyme · Answer

Hi à tous ,

On ne lance pas MBAM en début de désinfection..

Alut communauté de l'internet...............

Utilisateur anonyme · Answer

Hi,

Tu ferais quoi ?
Pour les processus lancés infectés ? 

Moi j'opterais pour Flashdésinfector ou USBFix de chiquitine29...........

Car c'est une infection  Il s'agit d'un program de démarrage et pas une tâche gestionnaire de processus point!

d'aprés castelcops.

crapoulou · Answer

En effet :
http://www.castlecops.com/s14385-ASocksrv.html

Je donne la procédure :

Télécharge UsbFix sur ton bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

--> Lance l’installation avec les paramètres par défaut

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectés sans les ouvrir

--> Double clic sur le raccourci UsbFix sur ton bureau

--> Le pc va redémarrer

-->Après redémarrage poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé a la racine du disque
Note : Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides

papi · Answer

bon javais deja lance le processus avec MBAM voici le rapport mais ..devrais-je essayer les autres procedures propose?

Malwarebytes' Anti-Malware 1.30
Database version: 1399
Windows 6.0.6001 Service Pack 1

11/14/2008 5:19:59 PM
mbam-log-2008-11-14 (17-19-59).txt

Scan type: Full Scan (C:\|)
Objects scanned: 124696
Time elapsed: 26 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 24

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\fugqrdrk.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Windows\System32\krdrqguf.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Windows\System32\vgjgvhik.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Windows\System32\kihvgjgv.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Users\Leo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\85G3SB3C\kb600179[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Users\Leo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IYEWN7NO\upd105320[2] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Users\Leo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XHHHOV96\7av2[1].dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\bblstp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\cutsslqp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\dxmtafdt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\ekhdqata.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\fmvbuq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\ghjedssm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\htrevmbr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\lpzomr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\lscccujr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\miibbehl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\muibiw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\ochfkmkj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\opjwyybj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\pjdrcr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\ubxyrceq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\uejmabao.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\wlrinahg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

crapoulou · Answer

Edit : Fais ce que dis le message suivant.

Utilisateur anonyme · Answer

Hi,

Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

Fais exactement ce qui suit :



Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : 

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

papi · Answer

bon c fait voici mon rapport de combofix..... ComboFix 08-11-12.02 - Leo 2008-11-14 18:24:06.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.2.1033.18.2955 [GMT -7:00] Lancé depuis: c:\users\Leo\Desktop\c-fix.exe * Un nouveau point de restauration a été créé * Resident AV is active . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\Microsoft\Network\Downloader\qmgr0.dat c:\programdata\Microsoft\Network\Downloader\qmgr1.dat c:\windows\System32\aedtqrwp.ini c:\windows\system32\bkixtltf.dll c:\windows\system32\cejqjbbc.ini c:\windows\system32\csowkm.dll c:\windows\system32\eamcturc.ini c:\windows\system32\emesdomg.ini c:\windows\system32\fmppndca.ini c:\windows\system32\gllwyhef.ini c:\windows\system32\msjbamej.ini c:\windows\system32 jpudprg.dll c:\windows\system32 hqyrugp.ini c:\windows\system32\Updater.exe c:\windows\system32\vroscw.dll c:\windows\System32\xHgQBcdd.ini c:\windows\System32\xHgQBcdd.ini2 c:\windows\system32\xrmhfghp.ini c:\windows\system32\ymmeuudo.dll c:\windows\system32\yvirlflc.ini ----- BITS: Il y a peut-être des sites infectés ----- hxxp://speedytorrents.net . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-15 au 2008-11-15 )))))))))))))))))))))))))))))))))))) . 2008-11-14 17:30 . 2008-11-14 18:10 d-------- c:\program files\UsbFix 2008-11-14 16:01 . 2008-11-14 16:01 d-------- c:\users\Leo\AppData\Roaming\Malwarebytes 2008-11-14 16:01 . 2008-11-14 16:01 d-------- c:\users\All Users\Malwarebytes 2008-11-14 16:01 . 2008-11-14 16:01 d-------- c:\programdata\Malwarebytes 2008-11-14 16:01 . 2008-11-14 16:01 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-14 16:01 . 2008-10-22 16:28 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2008-11-14 16:01 . 2008-10-22 16:28 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2008-11-14 15:54 . 2008-11-14 15:54 d-------- c:\users\All Users\WindowsSearch 2008-11-14 15:54 . 2008-11-14 15:54 d-------- c:\programdata\WindowsSearch 2008-11-14 14:04 . 2008-11-14 14:04 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-11-14 12:30 . 2008-11-14 12:30 d-------- c:\program files\Microsoft Games 2008-11-14 12:15 . 2008-11-14 11:59 152,576 --a------ c:\windows\System32\SPWizUI.dll 2008-11-14 12:15 . 2008-11-14 11:59 47,560 --a------ c:\windows\System32\SPReview.exe 2008-11-14 12:06 . 2008-01-18 23:33 193,024 --a------ c:\windows\System32 ecdisc.exe 2008-11-14 12:06 . 2008-01-18 23:36 6,656 --a------ c:\windows\System32\sdspres.dll 2008-11-14 12:04 . 2008-01-18 23:33 5,714,432 --a------ c:\windows\System32\logon.scr 2008-11-14 12:03 . 2008-01-18 23:34 6,103,040 --a------ c:\windows\System32\chtbrkr.dll 2008-11-14 12:00 . 2008-01-18 23:33 44,032 --a------ c:\windows\System32\cbsra.exe 2008-11-14 03:40 . 2008-11-14 03:40 d-------- c:\program files\Common Files\Native Instruments 2008-11-14 02:57 . 2008-11-14 12:16 327,680 --a------ c:\windows\SPInstall.etl 2008-11-14 00:11 . 2008-11-14 00:11 175,667,658 --a------ c:\windows\MEMORY.DMP 2008-11-13 22:59 . 2008-11-13 22:59 d-------- c:\program files\D-Tools 2008-11-11 23:01 . 2008-09-09 20:40 1,334,272 --a------ c:\windows\System32\msxml6.dll 2008-11-11 23:01 . 2008-09-04 22:14 1,191,936 --a------ c:\windows\System32\msxml3.dll 2008-11-11 23:01 . 2008-08-26 18:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys 2008-11-11 22:31 . 2008-08-11 20:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-11-11 22:31 . 2008-08-05 02:49 428,544 --a------ c:\windows\System32\EncDec.dll 2008-11-11 22:31 . 2008-08-05 02:49 293,376 --a------ c:\windows\System32\psisdecd.dll 2008-11-11 22:31 . 2008-08-05 02:48 217,088 --a------ c:\windows\System32\psisrndr.ax 2008-11-11 22:31 . 2008-08-05 02:48 177,664 --a------ c:\windows\System32\mpg2splt.ax 2008-11-11 22:31 . 2008-08-05 02:48 80,896 --a------ c:\windows\System32\MSNP.ax 2008-11-11 22:31 . 2008-01-19 00:36 37,888 --a------ c:\windows\System32\printcom.dll 2008-11-11 21:04 . 2008-11-11 21:04 d-------- c:\users\Leo\AppData\Roaming\PC Tools 2008-11-11 21:04 . 2008-11-14 01:10 d-------- c:\program files\Spyware Doctor 2008-11-11 21:04 . 2008-08-25 11:36 81,288 --a------ c:\windows\System32\drivers\iksyssec.sys 2008-11-11 21:04 . 2008-08-25 11:36 66,952 --a------ c:\windows\System32\drivers\iksysflt.sys 2008-11-11 21:04 . 2008-08-25 11:36 40,840 --a------ c:\windows\System32\drivers\ikfilesec.sys 2008-11-11 21:04 . 2008-06-02 15:19 29,576 --a------ c:\windows\System32\drivers\kcom.sys 2008-11-09 15:50 . 2008-11-14 12:39 dr------- c:\users\Public\Videos 2008-11-09 01:13 . 2008-11-09 01:13 dr------- c:\users\Leo\Videos 2008-11-08 12:05 . 2008-11-08 12:05 268 --ah----- C:\sqmdata02.sqm 2008-11-08 12:05 . 2008-11-08 12:05 244 --ah----- C:\sqmnoopt02.sqm 2008-11-06 18:54 . 2008-11-06 18:54 d-------- c:\program files\CCleaner 2008-11-06 18:39 . 2008-11-06 18:39 d-------- c:\program files\Trend Micro 2008-11-06 15:11 . 2008-11-07 00:05 0 --ah----- C: tuser.dat.LOG2 2008-11-06 15:11 . 2008-11-07 00:05 0 --ah----- C: tuser.dat.LOG1 2008-11-06 15:11 . 2008-11-06 15:11 0 --a------ C: tuser.dat 2008-11-03 20:00 . 2007-03-04 05:55 1,936,528 --a------ c:\windows\System32\ltmm15.dll 2008-11-03 20:00 . 2007-03-04 05:55 135,168 --a------ c:\windows\System32\DSKernel2.dll 2008-11-03 19:59 . 2008-11-03 19:59 d-------- c:\program files\Replay Converter 2008-11-03 01:54 . 2008-11-03 01:54 108,336 --a------ c:\windows\System32\mswinsck.ocx 2008-11-03 00:11 . 2008-11-03 00:11 d-------- c:\users\Leo\AppData\Roaming\YouSendIt 2008-11-02 23:33 . 2008-11-03 22:05 d-------- c:\program files\WinPcap 2008-11-02 23:32 . 2008-11-02 23:32 d-------- c:\windows\Replay Converter 3 2008-11-02 23:32 . 2008-11-03 22:04 737,280 --a------ c:\windows\iun6002.exe 2008-11-02 23:31 . 2008-11-08 22:28 d-------- c:\program files\Replay AV 8 2008-11-01 17:26 . 2008-11-01 17:26 230,432 --a------ C:\PA7311.DAT 2008-11-01 15:49 . 2005-01-14 08:32 53,248 --a------ c:\windows\System32\PAStiSvc.exe 2008-11-01 14:00 . 2008-11-01 14:00 d-------- c:\users\Leo\AppData\Roaming\Recordpad 2008-11-01 14:00 . 2008-11-01 14:00 d-------- c:\users\Leo\AppData\Roaming\NCH Swift Sound 2008-11-01 14:00 . 2008-11-01 14:00 d-------- c:\users\All Users\NCH Swift Sound 2008-11-01 14:00 . 2008-11-01 14:00 d-------- c:\programdata\NCH Swift Sound 2008-11-01 14:00 . 2008-11-01 14:00 d-------- c:\program files\NCH Swift Sound 2008-11-01 12:56 . 2008-11-01 12:56 188,416 --a------ C:\proxy.exe 2008-11-01 12:13 . 2008-11-01 12:13 81,942 --------- C:\luxe.exe 2008-10-31 21:04 . 2008-10-31 22:05 d-------- c:\users\Leo\AppData\Roaming\LimeWire 2008-10-31 21:03 . 2008-10-31 21:03 d-------- c:\program files\Java 2008-10-31 11:57 . 2008-10-31 11:57 d-------- c:\users\Leo\AppData\Roaming\Apple Computer 2008-10-31 11:57 . 2008-10-31 11:57 d-------- c:\program files\iTunes 2008-10-31 11:57 . 2008-11-01 10:47 d-------- c:\program files\iPod 2008-10-31 11:56 . 2008-10-31 11:57 d-------- c:\users\All Users\Apple Computer 2008-10-31 11:56 . 2008-10-31 11:57 d-------- c:\programdata\Apple Computer 2008-10-31 11:56 . 2008-10-31 11:56 d-------- c:\program files\QuickTime 2008-10-31 11:56 . 2008-10-31 11:56 d-------- c:\program files\Apple Software Update 2008-10-31 11:55 . 2008-10-31 11:56 d-------- c:\program files\Common Files\Apple 2008-10-31 11:36 . 2008-11-01 10:46 d-------- c:\users\Leo\{f5b34598-4ad4-469a-a48f-20bf174e57e0} 2008-10-31 11:31 . 2008-10-31 11:31 d-------- c:\windows\Pixart 2008-10-31 11:31 . 2008-10-31 11:31 d-------- c:\program files\PC VGA Camera 2008-10-30 11:28 . 2007-03-07 16:51 129,784 --------- c:\windows\System32\pxafs.dll 2008-10-24 21:31 . 2008-10-24 21:36 d-------- c:\users\All Users\Lavasoft 2008-10-24 21:31 . 2008-10-24 21:36 d-------- c:\programdata\Lavasoft 2008-10-24 21:31 . 2008-10-24 21:31 d-------- c:\program files\Lavasoft 2008-10-24 21:30 . 2008-10-24 21:30 d-------- c:\program files\Common Files\Wise Installation Wizard 2008-10-24 20:45 . 2008-10-24 20:45 304 --ah----- C:\sqmdata01.sqm 2008-10-24 20:45 . 2008-10-24 20:45 244 --ah----- C:\sqmnoopt01.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-15 01:16 --------- d---a-w c:\programdata\TEMP 2008-11-15 00:50 27,649 ----a-w c:\users\All Users vModes.dat 2008-11-15 00:50 27,649 ----a-w c:\programdata vModes.dat 2008-11-14 19:40 --------- d-----w c:\programdata\NVIDIA 2008-11-14 19:39 174 --sha-w c:\program files\desktop.ini 2008-11-14 19:32 --------- d-----w c:\program files\Windows Sidebar 2008-11-14 19:32 --------- d-----w c:\program files\Windows Photo Gallery 2008-11-14 19:32 --------- d-----w c:\program files\Windows Mail 2008-11-14 19:32 --------- d-----w c:\program files\Windows Journal 2008-11-14 19:32 --------- d-----w c:\program files\Windows Defender 2008-11-14 19:32 --------- d-----w c:\program files\Windows Collaboration 2008-11-14 19:32 --------- d-----w c:\program files\Windows Calendar 2008-11-14 19:20 82,432 ----a-w c:\windows\System32\axaltocm.dll 2008-11-14 19:20 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-11-14 10:40 --------- d-----w c:\program files\Native Instruments 2008-11-14 05:50 --------- d-----w c:\users\Leo\AppData\Roaming\uTorrent 2008-11-07 06:20 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-04 00:23 --------- d-----w c:\program files\Common Files\Real 2008-11-02 06:29 --------- d-----w c:\program files\Common Files\Adobe 2008-11-02 06:18 --------- d-----w c:\program files\Bonjour 2008-11-01 21:18 --------- d-----w c:\program files\Winamp 2008-11-01 21:18 --------- d-----w c:\program files\SigmaTel 2008-11-01 04:09 --------- d-----w c:\program files\ESET 2008-10-31 20:32 --------- d-----w c:\program files\BitComet 2008-10-31 18:30 --------- d-----w c:\program files\Common Files\InstallShield 2008-10-29 01:12 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-27 18:31 --------- d-----w c:\program files\Canon 2008-10-08 06:49 --------- d-----w c:\users\Leo\AppData\Roaming\dvdcss 2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll 2008-09-30 23:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll 2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32 tkrnlpa.exe 2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32 toskrnl.exe 2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys 2008-08-05 23:38 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-08-05 23:38 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-08-05 23:38 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2007-03-09 08:12 27,648 --sha-w c:\windows\System32\AVSredirect.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="c:\program files\Eset od32kui.exe" [2008-05-31 949376] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-04-17 159744] "SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-07 405504] "NvSvc"="c:\windows\system32 vsvc.dll" [2008-02-22 166432] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-22 13515296] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-22 92704] "NVHotkey"="c:\windows\system32 vHotkey.dll" [2008-02-22 92704] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi2"= ma_cmidn.dll "midi3"= ma_cmidn.dll "msacm.iac2"= c:\progra~1\REPLAY~1\iac25_32.ax [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 19:16 39792 c:\program files\Adobe\Reader 8.0\Reader eader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-08-03 09:51 202024 c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI] --a------ 2007-12-08 11:34 3444736 c:\windows\System32\WLTRAY.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] --a------ 2008-01-18 23:33 125952 c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] --a------ 2007-04-25 09:18 174872 c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2007-08-08 06:25 1828136 c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 12:57 153136 c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2008-02-22 02:46 13515296 c:\windows\System32 vcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey] --a------ 2008-02-22 02:46 92704 c:\windows\System32 vhotkey.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2008-02-22 02:46 92704 c:\windows\System32 vmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc] --a------ 2008-02-22 02:46 166432 c:\windows\System32 vsvc.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2007-04-09 05:23 200704 c:\program files\PowerISO\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar] --a------ 2008-01-18 23:33 1233920 c:\program files\Windows Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] --a------ 2007-09-07 07:23 405504 c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2008-01-18 23:38 1008184 c:\program files\Windows Defender\MSASCui.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{2791DBAC-E2C7-4EBF-AA6B-88AE54E92E8F}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{D740F0C6-AB82-4C98-A5C1-9357C08BC807}c:\program files\bitcomet\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{4BF28887-A474-41A8-8B51-D9B3BF8C4C75}c:\program files\bitcomet\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "TCP Query User{5C20EBE3-B7BD-4A3C-A58D-E1F3B4982091}c:\program files\utorrent\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{FABD4E32-8DA2-432F-A5BD-D85FF9DA022B}c:\program files\utorrent\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent "TCP Query User{DD703BF3-C3AE-4232-9229-F30AA7098C44}c:\users\leo\desktop\new folder\ghost recon advanced warfighter 2\graw2.exe"= UDP:c:\users\leo\desktop ew folder\ghost recon advanced warfighter 2\graw2.exe:graw2.exe "UDP Query User{3135BCA7-213B-4847-8435-ED571EBDD061}c:\users\leo\desktop\new folder\ghost recon advanced warfighter 2\graw2.exe"= TCP:c:\users\leo\desktop ew folder\ghost recon advanced warfighter 2\graw2.exe:graw2.exe "TCP Query User{0A31AABC-E86B-43D9-BDC8-615CCAD549AD}c:\users\leo\desktop\new folder\ghost recon advanced warfighter 2\graw2_dedicated.exe"= UDP:c:\users\leo\desktop ew folder\ghost recon advanced warfighter 2\graw2_dedicated.exe:graw2_dedicated.exe "UDP Query User{D4F687C4-5DFA-4717-9FCD-CF8F243D7E5D}c:\users\leo\desktop\new folder\ghost recon advanced warfighter 2\graw2_dedicated.exe"= TCP:c:\users\leo\desktop ew folder\ghost recon advanced warfighter 2\graw2_dedicated.exe:graw2_dedicated.exe "{6EB68A1A-6A5E-4167-A72C-D4720FB8745D}"= UDP:18580:BitComet 18580 TCP "{B209CC09-D780-41BF-8439-AA79D2B969D5}"= TCP:18580:BitComet 18580 UDP "{0448BFCD-8F2E-43AF-8571-D7D8DD828BD9}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{771F9AFE-DD17-40EE-8862-64212373D354}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{6427E611-ADB7-4881-B023-3C85B4C5FE02}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-08-29 73728] S3 APLMp50;APLMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\APLMp50.sys [2006-11-28 28224] S3 MA_CMIDI;M-Audio USB Driver;c:\windows\system32\drivers\ma_cmidi.sys [2006-08-16 21888] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers pf.sys [2007-01-25 42000] S3 PAC7311;Trust Webcam 14839;c:\windows\system32\DRIVERS\PA707UCM.SYS [2005-10-18 154752] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contenu du dossier 'Tâches planifiées' 2008-11-14 c:\windows\Tasks\User_Feed_Synchronization-{D4C0D1E8-8D1A-4810-9070-878FF35EC6CF}.job - c:\windows\system32\msfeedssync.exe [2008-01-18 23:33] 2008-05-31 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 08:20] . - - - - ORPHELINS SUPPRIMES - - - - MSConfigStartUp-MSServer - c:\windows\system32\khfDssQH.dll . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\users\Leo\AppData\Roaming\Mozilla\Firefox\Profiles\zap330mx.default\ FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.1.0.30716.0.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-14 18:27:22 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . c:\windows\System32\audiodg.exe c:\windows\System32\WLTRYSVC.EXE c:\windows\System32\wlanext.exe c:\windows\System32\BCMWLTRY.EXE c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\windows\System32\conime.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\windows\System32 undll32.exe c:\windows\System32 undll32.exe c:\program files\DellTPad\ApMsgFwd.exe c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe c:\windows\System32 undll32.exe c:\program files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe c:\program files\DellTPad\hidfind.exe c:\program files\ESET od32krn.exe c:\program files\DellTPad\ApntEx.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\System32\stacsv.exe c:\windows\System32\PAStiSvc.exe c:\windows\System32\drivers\XAudio.exe c:\windows\System32\wbem\unsecapp.exe c:\windows\System32\wbem\WMIADAP.exe . ************************************************************************** . Heure de fin: 2008-11-14 18:32:01 - La machine a redémarré ComboFix-quarantined-files.txt 2008-11-15 01:31:43 Avant-CF: 188,050,071,552 bytes free Après-CF: 187,999,866,880 bytes free 296 --- E O F --- 2008-11-14 08:41:39

Utilisateur anonyme · Answer

Hi,

Passe un rapport hijackthis tout neuf.

Ensuite refait un scan de Malwarebyte en mode sans échec.

Alut.

papi · Answer

merci a toi drhouse....bon voici mon rapport de hijack le plus recent:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:48:42 PM, on 11/14/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\ESET
od32kui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Leo\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32
vHotkey.dll,Start
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Utilisateur anonyme · Answer

Hi, Relance hijackthis et et clique sur "Do a system scan only" Ensuite recherche ces lignes et coches les cases O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll Ensuite clique sur "Fix checked" =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= > Fais un scan en ligne avec Kaspersky : Kaspersky N.B. : Le scan ne marche que sous Internet Explorer. - Commence par connecter tout ton matériel de stockage à ton PC (clés USB, DD amovible...). Allume les si necessaire. - Sous Démonstration en ligne, on t'explique la marche à suivre, et pour lancer le scan il faut sélectionner < Exécuter l'analyse en ligne >. - On va te demander de télécharger un contrôle active x, accepte . - Dans le menu < Choisissez la cible de l'analyse >, sélectionne < Poste de travail >. Le scan va commencer. - Poste le rapport qui sera généré stp. (clique sur puis sauvegarde-le sur ton bureau en choisissant "fichier texte (*.txt)" pour l'extension). S'il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme décrit sur ce lien : clic ici Rappel : le scan est à faire sous Internet Explorer Tuto ici si problème NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne. Pour le rapport Kaspersky il faut que tu choisisses "Afficher le rapport" puis que tu l'enregistres sur ton bureau sous forme de fichier texte (type de fichier "tous les fichiers"). Alut.

InfernO.vir · Answer

Slt,

Drhouse1998,c'est un seul helper par sujet !!!  mais puisque tu es si malin je te laisse le sujet on verra !

papi · Answer

bon jai fais lanalyse avec kaspersky et tout ..le seul probl c qu'il machife les objets infecte et nbr de virus trouve , mais aucun rapport detaille et aucune option pour aller chercher un rapport .....

Utilisateur anonyme · Answer

Hi,

refait un petit hijackthis.

Alut.

papi · Answer

ok finalement jai regle mon probleme et reussi a avoir un rapport de scan de kapersky......

-------------------------------------------------------------------------------
 KASPERSKY ON-LINE SCANNER REPORT
 Saturday, November 15, 2008 8:58:27 PM
 Système d'exploitation :  Home Edition, Service Pack 1 (Build 6001)
 Kaspersky On-line Scanner version : 5.0.84.2
 Dernière mise à jour de la base antivirus Kaspersky : 15/11/2008
 Enregistrements dans la base antivirus Kaspersky : 1243684
-------------------------------------------------------------------------------

Paramètres d'analyse:
	Analyser avec la base antivirus suivante: standard
	Analyser les archives: vrai
	Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
	C:\
	D:\
	E:\
	F:\
	G:\
	H:\
	I:\

Statistiques de l'analyse:
	Total d'objets analysés: 354440
	Nombre de virus trouvés: 6
	Nombre d'objets infectés: 10 / 0
	Nombre d'objets suspects: 0
	Durée de l'analyse: 02:21:04

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Boot\BCD	L'objet est verrouillé	ignoré
C:\Boot\BCD.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99AF.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99B0.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99AF.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99B0.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPLog-11022006-050241.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.Crwl	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy79.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99AF.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99B0.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPLog-11022006-050241.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\b71712fed66d2f788654502f65a71de3_b92e623d-85a1-4ba3-a64b-93e3d6eb7d1d	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.Crwl	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wsb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000A.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000D.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010015.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010017.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010018.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010022.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010024.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010025.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010026.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010029.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy79.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99AF.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99B0.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPLog-11022006-050241.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\b71712fed66d2f788654502f65a71de3_b92e623d-85a1-4ba3-a64b-93e3d6eb7d1d	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.Crwl	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wsb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000A.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000D.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010015.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010017.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010018.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010022.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010024.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010025.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010026.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010029.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy79.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99AF.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99B0.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPLog-11022006-050241.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\b71712fed66d2f788654502f65a71de3_b92e623d-85a1-4ba3-a64b-93e3d6eb7d1d	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.Crwl	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wsb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000A.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000D.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010015.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010017.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010018.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010022.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010024.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010025.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010026.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010029.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy79.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99AF.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99B0.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPLog-11022006-050241.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\b71712fed66d2f788654502f65a71de3_b92e623d-85a1-4ba3-a64b-93e3d6eb7d1d	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.Crwl	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wsb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000A.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000D.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010015.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010017.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010018.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010022.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010024.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010025.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010026.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010029.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy79.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99AF.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf99B0.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPLog-11022006-050241.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\b71712fed66d2f788654502f65a71de3_b92e623d-85a1-4ba3-a64b-93e3d6eb7d1d	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.Crwl	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.147.gthr	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wsb	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000A.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000D.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010015.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010017.wid	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Microsoft\Search\Dat

Utilisateur anonyme · Answer

Hi,

Refait moi un hijackthis.

Alut.

papi · Answer

voici le  nouveau rapport de hijack this......


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:00:51 PM, on 11/16/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Eset
od32krn.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\STacSV.exe
C:\Windows\System32\PAStiSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET
od32kui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Leo\Downloads\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32
vHotkey.dll,Start
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Utilisateur anonyme · Answer

Hi,

Je ne voit plus rien.

Télécharge toolscleaner sur ton Bureau : 

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 
* Clique sur Recherche et laisse le scan se terminer. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives. 
* Clique sur Quitter, pour que le rapport puisse se créer. 
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse
Ensuite tu créer un point de restauration:

démarrer => Tous les Programmes => Accessoires => Outils système => Restauration du système.

Ensuite cliquez sur « Ouvrir protection Système => Créer »

Alut.

bebert4400 · Answer

format c:/ c est plus simple 
               vous vous cassez la tete pour peu de chose ! ! !

Regis59 · Answer

Salut

Je me demandais ce qu'étais:

2008-11-01 12:56 . 2008-11-01 12:56 188,416 --a------ C:\proxy.exe
2008-11-01 12:13 . 2008-11-01 12:13 81,942 --------- C:\luxe.exe 

A+

Utilisateur anonyme · Answer

Hi,

oui bagle.

Télécharges- FindyKill de Chiquitine29 :

FindyKill de Chiquitine29

->-Enregistres le sur ton bureau et pas ailleurs !

-!! Déconnectes toi et fermes toute applications en cours !!

( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)

-> Cliques sur "-FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.


-Notes importantes :
* si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .

--> Double cliques sur le raccourci " FindyKill " qui est sur ton bureau .

-->choisis l'option 1 ( recherche ) . Puis laisses travailler l'outil sans rien toucher ...

Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )


Alut.

papi · Answer

voici mon rapport de tools cleaner...

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Qoobox: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UsbFix: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\UsbFix: trouvé !
C:\Users\Leo\Desktop\powerfull cleanser prog\UsbFix.exe: trouvé !
C:\Users\Leo\Downloads\hijackthis.log: trouvé !

---------------------------------
-->- Suppression: 

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Users\Leo\Desktop\powerfull cleanser prog\UsbFix.exe: supprimé !
C:\Users\Leo\Downloads\hijackthis.log: supprimé !
C:\Qoobox: supprimé !
C:\Program Files\UsbFix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UsbFix: supprimé !

Utilisateur anonyme · Answer

Hi,

par acquis de conscience passe "findykill".

Alut.

papi · Answer

bon mon rapport de findykill...


----------------- FindyKill V4.700 ------------------

* User : Leo - LEO-PC
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 13/11/08 par Chiquitine29
* Recherche effectuée à 14:32:10 le Sun 11/16/2008
* Windows Vista - Internet Explorer 7.0.6001.18000
 
((((((((((((((((( *** Recherche *** ))))))))))))))))))  
 
 
--------------- [ Processus actifs ] ----------------  
 

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Eset
od32krn.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\STacSV.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\System32\PAStiSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\ESET
od32kui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32	askeng.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
 
--------------- [ Fichiers/Dossiers infectieux ] ----------------  
 
 
»»»» Presence des fichiers dans C: 
 
 
»»»» Presence des fichiers dans C:\Windows 
 
 
»»»» Presence des fichiers dans C:\Windows\Prefetch 
 
Found ! - C:\Windows\Prefetch\PATCH T3 NORMAL.EXE-4A81DE76.pf 
 
»»»» Presence des fichiers dans C:\Windows\system32 
 
 
»»»» Presence des fichiers dans C:\Windows\system32\drivers 
 
 
»»»» Presence des fichiers dans C:\Users\Leo\AppData\Roaming 
 
 
»»»» Presence des fichiers dans C:\Users\Leo\AppData\Local\Temp 
 
 
»»»» Presence des fichiers dans C:\Users\Leo\Local Settings\Temporary Internet Files\Content.IE5 
 
 
--------------- [ Registre / Startup ] ----------------  
 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    nod32kui    REG_SZ    "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
    Apoint    REG_SZ    C:\Program Files\DellTPad\Apoint.exe
    SigmatelSysTrayApp    REG_EXPAND_SZ    %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
    NvSvc    REG_SZ    RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
    NvCplDaemon    REG_SZ    RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    NvMediaCenter    REG_SZ    RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    NVHotkey    REG_SZ    rundll32.exe C:\Windows\system32
vHotkey.dll,Start
    ISTray    REG_SZ    "C:\Program Files\Spyware Doctor\pctsTray.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

 
--------------- [ Registre / Clés infectieuses ] ----------------  
 
 
 
--------------- [ Etat / Services ] ---------------- 
 


+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] 

 Ndisuio - Type de démarrage = 3 
 
 EapHost - Type de démarrage = 3 
 
 Wlansvc - Type de démarrage = 2 
 
 SharedAccess - Type de démarrage = 2 
 
 wuauserv - Type de démarrage = 2 
 
 wscsvc - Type de démarrage = 2 
 
 WinDefend - Type de démarrage = 2 
 
 
 
--------------- [ Recherche dans supports amovibles] ----------------  
 
 
+- Informations : 

C: - Fixed Drive
 
+- presence des fichiers :  

 
 
--------------- [ Registre / Mountpoint2 ] ----------------  
 
 
-> Not found ! 
 
 
------------------- ! Fin du rapport ! --------------------

Utilisateur anonyme · Answer

Hi,

--> Branche tes disques amovibles à ton PC (clefs USB, disque dur externe, etc...) sans les ouvrir

--> Double-clique sur le raccourci FindyKill sur ton bureau

--> Au menu principal, choisis l'option 2 (Suppression)

/!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

--> Ensuite, poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

Ensuite fait USBfix.

Alut.

papi · Answer

bon c fait.....en premier le scan et rapport findykill...et ensuite le scan usbfix et rapport.....



----------------- FindyKill V4.700 ------------------

* User : Leo - LEO-PC
* executed from : C:\Program Files\FindyKill
* Update on 13/11/08 par Chiquitine29
* Start at 17:02:02 the Sun 11/16/2008
* Windows Vista - Internet Explorer 7.0.6001.18000
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Eset
od32krn.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\STacSV.exe
C:\Windows\System32\PAStiSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\servicing\vsp1ceip.exe
C:\Windows\system32unonce.exe
C:\Windows\system32\conime.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
 
»»»» Supression files in C:\Windows 
 
 
»»»» Supression files in C:\Windows\Prefetch 
 
Deleted ! - C:\Windows\prefetch\PATCH T3 NORMAL.EXE-4A81DE76.pf 
 
»»»» Supression files in C:\Windows\system32 
 
 
»»»» Supression files in C:\Windows\system32\drivers 
 
 
»»»» Supression files in C:\Users\Leo\AppData\Roaming 
 
 
»»»» Supression files in C:\Users\Leo\AppData\Local\Temp 
 
 
»»»» Supression files in C:\Users\Leo\Local Settings\Temporary Internet Files\Content.IE5 
 
 
--------------- [  Registry / Infected keys ] ---------------- 
 
 
--------------- [ States / Restarting of services ] ---------------- 
 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

 Ndisuio - Type of startup  = 3 
 
 EapHost - Type of startup  = 2 
 
 Wlansvc - Type of startup  = 2 
 
 SharedAccess - Type of startup  = 2 
 
 wuauserv - Type of startup  = 2 
 
 wscsvc - Type of startup  = 2 
 
 WinDefend - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Fixed Drive
F: - Fixed Drive
H: - Fixed Drive
I: - Removable Drive
 
+- deleting files : 
 
 
--------------- [ Registry / Moutpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Users\Leo\AppData\Roaming\uTorrent\Sony Vegas Pro PreCracked.rar.torrent
C:\Users\Leo\AppData\Roaming\uTorrent\WinRar v3.80 latest cracked by b3uti.1.torrent
C:\Users\Leo\AppData\Roaming\uTorrent\WinRar v3.80 latest cracked by b3uti.torrent
C:\Users\Leo\AppData\Roaming\uTorrent\WinZip Pro (FULL+Keygen).rar.torrent
 
 
---------------- ! End of report ! ------------------  






-------------- UsbFix V2.408 ---------------

* User : Leo - LEO-PC
* Outils mis a jours le 16/11/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 17:23:46 le Sun 11/16/2008
* Windows Vista - Internet Explorer 7.0.6001.18000 
  
  
--------------- [ Processus actifs ] ----------------   
  
 
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Eset
od32krn.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\STacSV.exe
C:\Windows\System32\PAStiSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Leo\AppData\Local\Temp\3EC4.tmp\b2e.exe
  
--------------- [ Informations lecteurs ] ----------------   
  
C: - Fixed Drive
F: - Fixed Drive
H: - Fixed Drive
I: - Removable Drive

--------------- [ Lecteur C ] ---------------- 

C: - Fixed Drive

+- Listing des fichiers présents :

[09/18/2006 02:43 PM][--a------] C:\autoexec.bat   
[11/01/2008 12:13 PM][---------] C:\luxe.exe   
[11/01/2008 12:13 PM][---------] C:\proxy.exe   
[06/04/2008 11:45 PM][--a------] C:\AILog.txt   
[06/04/2008 11:45 PM][--a------] C:\UsbFix.txt   
[09/18/2006 02:43 PM][--a------] C:\config.sys   
[09/18/2006 02:43 PM][--a------] C:\hiberfil.sys   
[09/18/2006 02:43 PM][--a------] C:\IO.SYS   
[09/18/2006 02:43 PM][--a------] C:\MSDOS.SYS   
[09/18/2006 02:43 PM][--a------] C:\pagefile.sys   

--------------- [ Lecteur F ] ---------------- 

F: - Fixed Drive

+- Listing des fichiers présents :


--------------- [ Lecteur H ] ---------------- 

H: - Fixed Drive

+- Listing des fichiers présents :


--------------- [ Lecteur I ] ---------------- 

I: - Removable Drive

+- Listing des fichiers présents :

[01/01/1980 12:00 AM][--a------] I:\MTABLE.SYS   
[01/01/1980 12:00 AM][--a------] I:\SYS_CONF.SYS   
[01/01/1980 12:00 AM][--a------] I:\RES_INFO.SYS   
  
--------------- [ Registre / Startup ] ----------------   
 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    nod32kui    REG_SZ    "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
    Apoint    REG_SZ    C:\Program Files\DellTPad\Apoint.exe
    SigmatelSysTrayApp    REG_EXPAND_SZ    %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
    NvSvc    REG_SZ    RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
    NvCplDaemon    REG_SZ    RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    NvMediaCenter    REG_SZ    RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    NVHotkey    REG_SZ    rundll32.exe C:\Windows\system32
vHotkey.dll,Start
    ISTray    REG_SZ    "C:\Program Files\Spyware Doctor\pctsTray.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

  
--------------- [ Registre / Mountpoint2 ] ----------------   
  
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a07682ba-2eb2-11dd-a548-001d09d53cc1}\Shell\AutoRun\command  
  
--------------- [ Nettoyage des disques ] ----------------   
   
  
--------------- [ Resumé ] ----------------   
  
 -> /!\ Le resultat doit etre interprété par un spécialiste  /!\   
  
[09/18/2006 02:43 PM][--a------] C:\autoexec.bat   
[11/01/2008 12:13 PM][---------] C:\luxe.exe   
[11/01/2008 12:13 PM][---------] C:\proxy.exe   
 
--------------- ! Fin du rapport ! ----------------

Utilisateur anonyme · Answer

Hi,

Fait toolscleaner et c'est tout bon pour moi et je pense pour les autres aussi.

Alut.

papi · Answer

bon voici mon rapport de toolscleaner.........


[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\UsbFix.txt: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\UsbFix\UsbFix.exe: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UsbFix: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UsbFix\UsbFix.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\UsbFix: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\UsbFix\UsbFix.lnk: trouvé !
C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UsbFix: trouvé !
C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\Users\Leo\Desktop\FindyKill.txt: trouvé !
C:\Users\Leo\Desktop\UsbFix.exe: trouvé !
C:\Users\Leo\Desktop\UsbFix.lnk: trouvé !

Utilisateur anonyme · Answer

Hi,

Tu peut tout supprimer.

Alut.

papi · Answer

que veux tu dire tout supprimer? quoi exactement tout ce qui apparait ds le dernier rapport de tool cleaner?...si tu peux me detailler un peu plus svp....merci a lavance pour tout ton aide drhouse....

Jai besoin daide....svp qqun

36 réponses

Votre réponse

Discussions similaires

Newsletters