application"n'est pas une application win32&q Résolu/Fermé

Question

Bonjour,
voila j'ai un probleme que je n'arrive pas à resoudre. J'ai telechargé un jeu sur emule. J'ai lancé l'installation du jeu quand soudain l'ecran de mon ordinateur est devenu bleu avec des ecritures banches. En gros, ça disais que l'ori effacait certains programmes. Je me suis alors precipité d'eteindre mon ordi. 
Au redemarrage, il a demarré normalement. La petite musique de bienvenue windows s'est lancée. Cependant, en essayant de regarder un film, le son avais disparu (la petite icone qui se trouve en bas à droite dans la barre widows apparait à chaques demarages, puis disparait 5 seconde apres doncil 'y a plus de son).
J'ai alors voulu voir si un irus avait infecté mon ordi, suite au telechargement, et la surprise: le fameux message "avast n'est pas une application win 32 valide" appparait, idem pour spybot. Pour le moment c'est les seuls programmes que j'ai essayé qui ne fonctionnent, pas il en  a peu etre d'autre.
Quelqu'un siait il ce que je dois faire pour remettre mon ordinateur en route correctement (avec le son et les programmes fonctionnant)?
MErci 'avance pour votre aide.

Utilisateur anonyme · Answer

Hi,

Un beagle => bien fait il fallait l'acheter.

Fait ceci maintenant.

Télécharges- FindyKill de Chiquitine29 :

FindyKill de Chiquitine29

->-Enregistres le sur ton bureau et pas ailleurs !

-!! Déconnectes toi et fermes toute applications en cours !!

( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)

-> Cliques sur "-FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.


-Notes importantes :
* si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .

--> Double cliques sur le raccourci " FindyKill " qui est sur ton bureau .

-->choisis l'option 1 ( recherche ) . Puis laisses travailler l'outil sans rien toucher ...

Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus

aoshi · Answer

----------------- FindyKill V4.706 ------------------ * User : Propri‚taire - HADDAOUI-30D53A * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 27/11/08 par Chiquitine29 * Recherche effectuée à 20:23:17 le 01/12/2008 * Windows XP - Internet Explorer 7.0.5730.13 ((((((((((((((((( *** Recherche *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\documents and settings\propriétaire\local settings\application data\oayym.exe C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\drivers\downld\437328.exe --------------- [ Processus infectieux stoppés ] ---------------- "C:\WINDOWS\system32\drivers\downld\437328.exe" (2956) --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Presence des fichiers dans C: Found ! [01/12/2008 20:23] - C:\sdlflzoip »»»» Presence des fichiers dans C:\WINDOWS »»»» Presence des fichiers dans C:\WINDOWS\Prefetch Found ! - C:\WINDOWS\prefetch\103609.EXE-2A3B6689.pf Found ! - C:\WINDOWS\prefetch\112890.EXE-21C08E72.pf Found ! - C:\WINDOWS\prefetch\115546.EXE-16511377.pf Found ! - C:\WINDOWS\prefetch\116406.EXE-08E47A4F.pf Found ! - C:\WINDOWS\prefetch\117921.EXE-297B1D90.pf Found ! - C:\WINDOWS\prefetch\118062.EXE-3A47A4CA.pf Found ! - C:\WINDOWS\prefetch\119718.EXE-202E97A9.pf Found ! - C:\WINDOWS\prefetch\126703.EXE-2F6D0FC1.pf Found ! - C:\WINDOWS\prefetch\129406.EXE-345D96AB.pf Found ! - C:\WINDOWS\prefetch\133796.EXE-0CEB0EE7.pf Found ! - C:\WINDOWS\prefetch\141578.EXE-3AEDC752.pf Found ! - C:\WINDOWS\prefetch\146921.EXE-38A1CAF3.pf Found ! - C:\WINDOWS\prefetch\148718.EXE-065386D3.pf Found ! - C:\WINDOWS\prefetch\154656.EXE-39F84BDA.pf Found ! - C:\WINDOWS\prefetch\158406.EXE-0DB0133C.pf Found ! - C:\WINDOWS\prefetch\159546.EXE-030147E3.pf Found ! - C:\WINDOWS\prefetch\161593.EXE-34C7D7DE.pf Found ! - C:\WINDOWS\prefetch\165203.EXE-26655C95.pf Found ! - C:\WINDOWS\prefetch\182703.EXE-09106ACA.pf Found ! - C:\WINDOWS\prefetch\188250.EXE-2363AB05.pf Found ! - C:\WINDOWS\prefetch\198359.EXE-350D9CC2.pf Found ! - C:\WINDOWS\prefetch\229937.EXE-0FAE1A55.pf Found ! - C:\WINDOWS\prefetch\243343.EXE-1FBDFD7A.pf Found ! - C:\WINDOWS\prefetch\313687.EXE-3121E288.pf Found ! - C:\WINDOWS\prefetch\331015.EXE-1392D160.pf Found ! - C:\WINDOWS\prefetch\339546.EXE-303A051A.pf Found ! - C:\WINDOWS\prefetch\407781.EXE-077DEBF7.pf Found ! - C:\WINDOWS\prefetch\437328.EXE-03D0B239.pf Found ! - C:\WINDOWS\prefetch\459578.EXE-131A8BDB.pf Found ! - C:\WINDOWS\prefetch\93812.EXE-1B7ED06B.pf Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-0625BCF7.pf Found ! - C:\WINDOWS\prefetch\MDELK.EXE-0EF461CE.pf Found ! - C:\WINDOWS\prefetch\WINFILSE.EXE-0C5BAB91.pf Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-377E42D4.pf »»»» Presence des fichiers dans C:\WINDOWS\system32 Found ! [01/12/2008 17:56] - C:\WINDOWS\system32\mdelk.exe Found ! [01/12/2008 11:21] - C:\WINDOWS\system32\wintems.exe Found ! [01/12/2008 19:24] - C:\WINDOWS\system32\ban_list.txt »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers Found ! [01/12/2008 19:24] - C:\WINDOWS\system32\drivers\srosa.sys Found ! [01/12/2008 19:24] - C:\WINDOWS\system32\drivers\srosa2.sys Found ! [10/01/2006 01:04] - C:\WINDOWS\system32\drivers\winfilse.exe Found ! [01/12/2008 19:28] - "C:\WINDOWS\system32\drivers\downld" Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\100187.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\103609.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\103796.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\105218.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\105343.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\106796.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\108265.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\109515.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\109921.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\110218.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\112890.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\115546.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\115625.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\116406.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\117687.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\117921.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\118062.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\119718.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\126703.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\129406.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\131718.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\133796.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\135203.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\136546.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\139000.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\141578.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\146921.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\148718.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\154656.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\155625.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\158406.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\159546.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\160781.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\161593.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\165203.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\168562.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\182703.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\188250.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\196171.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\198359.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\199234.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\201265.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\202187.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\202500.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\209390.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\215375.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\215750.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\217171.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\217218.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\225218.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\229078.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\229937.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\243343.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\244781.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\245515.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\246500.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\246734.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\247843.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\249953.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\251859.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\251906.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\260562.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\266359.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\271625.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\271812.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\274984.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\281750.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\299109.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\301031.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\303828.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\304203.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\309031.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\313687.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\331015.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\339546.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\351062.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\352500.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\354031.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\385078.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\391109.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\400812.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\407781.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\413312.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\437328.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\438734.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\439921.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\459578.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\462562.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\468453.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\505671.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\509421.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\542343.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\566750.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\81859.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\82390.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\83765.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\87250.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\87828.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\90734.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\93812.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\96921.exe Found ! [01/12/2008 19:28] - C:\WINDOWS\system32\drivers\downld\97515.exe »»»» Presence des fichiers dans C:\Documents and Settings\Propri‚taire\Application Data Found ! [01/12/2008 19:27] - "C:\Documents and Settings\Propri‚taire\Application Data\m\flec006.exe" Found ! [01/12/2008 19:27] - "C:\Documents and Settings\Propri‚taire\Application Data\m\list.oct" Found ! [01/12/2008 19:27] - "C:\Documents and Settings\Propri‚taire\Application Data\m\data.oct" Found ! [01/12/2008 19:27] - "C:\Documents and Settings\Propri‚taire\Application Data\m\srvlist.oct" Found ! [01/12/2008 19:28] - "C:\Documents and Settings\Propri‚taire\Application Data\m\shared" Found ! [30/11/2008 19:55] - "C:\Documents and Settings\Propri‚taire\Application Data\m" »»»» Presence des fichiers dans C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp Found ! - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\PatchByFile.tmp »»»» Presence des fichiers dans C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5 Found ! [30/11/2008 19:57] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64[1].jpg Found ! [30/11/2008 21:26] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64[2].jpg Found ! [30/11/2008 21:48] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64[3].jpg Found ! [01/12/2008 11:21] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64[4].jpg Found ! [30/11/2008 20:36] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64_1[1].jpg Found ! [30/11/2008 21:26] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64_2[1].jpg Found ! [01/12/2008 17:58] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\mxd[1].jpg Found ! [30/11/2008 22:00] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64[1].jpg Found ! [30/11/2008 21:23] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_1[1].jpg Found ! [01/12/2008 11:20] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_1[2].jpg Found ! [01/12/2008 17:56] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_1[3].jpg Found ! [30/11/2008 19:54] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_3[1].jpg Found ! [01/12/2008 11:21] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_3[2].jpg Found ! [01/12/2008 19:26] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\mxd[2].jpg Found ! [30/11/2008 21:47] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64[1].jpg Found ! [01/12/2008 11:22] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64[2].jpg Found ! [01/12/2008 17:56] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64[3].jpg Found ! [30/11/2008 21:47] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_2[1].jpg Found ! [01/12/2008 19:26] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_2[2].jpg Found ! [30/11/2008 21:26] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_3[1].jpg Found ! [30/11/2008 22:00] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_3[2].jpg Found ! [30/11/2008 22:00] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_3[3].jpg Found ! [30/11/2008 21:49] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\mxd[1].jpg Found ! [30/11/2008 19:55] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64[1].jpg Found ! [30/11/2008 22:01] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64[2].jpg Found ! [01/12/2008 17:57] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64[3].jpg Found ! [01/12/2008 19:26] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64[4].jpg Found ! [30/11/2008 19:53] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_1[1].jpg Found ! [01/12/2008 19:24] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_1[2].jpg Found ! [30/11/2008 20:37] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_3[1].jpg Found ! [30/11/2008 21:26] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_3[2].jpg Found ! [30/11/2008 21:47] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_3[3].jpg Found ! [01/12/2008 17:56] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_3[4].jpg Found ! [30/11/2008 19:55] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\mxd[1].jpg Found ! [30/11/2008 22:02] - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\mxd[2].jpg --------------- [ Registre / Startup ] ---------------- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run] ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe msnmsgr="C:\Program Files\MSN Messenger\msnmsgr.exe" /background oayym="c:\documents and settings\propriétaire\local settings\application data\oayym.exe" oayym ksamies="c:\documents and settings\propriétaire\local settings\application data\ksamies.exe" ksamies osoww="c:\documents and settings\propriétaire\local settings\application data\osoww.exe" osoww SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run] ugbsxsolbq=C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\sosrybsddrc.dll" avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI= NoChange=1 Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS= Installed=1 = [HKEY_CURRENT_USER\software\local appwizard-generated applications\DestComp] [HKEY_CURRENT_USER\software\local appwizard-generated applications\hpqptc08] [HKEY_CURRENT_USER\software\local appwizard-generated applications\hprbui] [HKEY_CURRENT_USER\software\local appwizard-generated applications\msnmsgr] [HKEY_CURRENT_USER\software\local appwizard-generated applications\RtlRack] [HKEY_CURRENT_USER\software\local appwizard-generated applications\run] [HKEY_CURRENT_USER\software\local appwizard-generated applications\winfilse] --------------- [ Registre / Clés infectieuses ] ---------------- Found ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\Local AppWizard-Generated Applications\msnmsgr Found ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\Local AppWizard-Generated Applications\winfilse Found ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\bisoft Found ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\DateTime4 Found ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\FFC Found ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\FirtR Found ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\MuleAppData Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winfilse Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA Found ! - HKEY_CURRENT_USER\Software\bisoft Found ! - HKEY_CURRENT_USER\Software\DateTime4 Found ! - HKEY_CURRENT_USER\Software\FirtR Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s --------------- [ Etat / Services ] ---------------- Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot - sans echec non fonctionnel !! Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal - sans echec non fonctionnel !! Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network - sans echec non fonctionnel !! +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] /!\ Ndisuio - Type de démarrage = 4 EapHost - Type de démarrage = 3 /!\ Ip6Fw - Type de démarrage = 4 /!\ SharedAccess - Type de démarrage = 4 /!\ wuauserv - Type de démarrage = 4 /!\ wscsvc - Type de démarrage = 4 --------------- [ Recherche dans supports amovibles] ---------------- +- Informations : C: - Lecteur fixe D: - Lecteur fixe +- presence des fichiers : Found ! [01/12/2008 20:23][--a------] - C:\sdlflzoip --------------- [ Registre / Mountpoint2 ] ---------------- -> Not found ! ------------------- ! Fin du rapport ! --------------------

Utilisateur anonyme · Answer

Hi,

Ce rapport de FindyKill est complet. L'infection Bagle s'attrape dans les cracks et keygens donc si tu en as, il faut les supprimer sinon l'infection se relancera.

--> Branche tes disques amovibles à ton PC (clefs USB, disque dur externe, etc...) sans les ouvrir

--> Double-clique sur le raccourci FindyKill sur ton bureau

--> Au menu principal, choisis l'option 2 (Suppression)

/!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

--> Ensuite, poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

aoshi · Answer

ok merci mais je suis obliger de mettres clefs usb ou pas ?

Utilisateur anonyme · Answer

Hi,

Ben oui .OUVRENT LES PAS.

Alut.

aoshi · Answer

ok bah voila le rapport


----------------- FindyKill V4.706 ------------------

* User : Propri‚taire - HADDAOUI-30D53A
* executed from : C:\Program Files\FindyKill
* Update on 27/11/08 par Chiquitine29
* Start at 21:03:26 the 01/12/2008
* Windows XP - Internet Explorer 7.0.5730.13
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\logonui.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
 
»»»» Supression files in C:\WINDOWS 
 
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
Deleted ! - C:\WINDOWS\prefetch\103609.EXE-2A3B6689.pf 
Deleted ! - C:\WINDOWS\prefetch\112890.EXE-21C08E72.pf 
Deleted ! - C:\WINDOWS\prefetch\115546.EXE-16511377.pf 
Deleted ! - C:\WINDOWS\prefetch\116406.EXE-08E47A4F.pf 
Deleted ! - C:\WINDOWS\prefetch\117921.EXE-297B1D90.pf 
Deleted ! - C:\WINDOWS\prefetch\118062.EXE-3A47A4CA.pf 
Deleted ! - C:\WINDOWS\prefetch\119718.EXE-202E97A9.pf 
Deleted ! - C:\WINDOWS\prefetch\126703.EXE-2F6D0FC1.pf 
Deleted ! - C:\WINDOWS\prefetch\129406.EXE-345D96AB.pf 
Deleted ! - C:\WINDOWS\prefetch\133796.EXE-0CEB0EE7.pf 
Deleted ! - C:\WINDOWS\prefetch\141578.EXE-3AEDC752.pf 
Deleted ! - C:\WINDOWS\prefetch\146921.EXE-38A1CAF3.pf 
Deleted ! - C:\WINDOWS\prefetch\148718.EXE-065386D3.pf 
Deleted ! - C:\WINDOWS\prefetch\154656.EXE-39F84BDA.pf 
Deleted ! - C:\WINDOWS\prefetch\158406.EXE-0DB0133C.pf 
Deleted ! - C:\WINDOWS\prefetch\159546.EXE-030147E3.pf 
Deleted ! - C:\WINDOWS\prefetch\161593.EXE-34C7D7DE.pf 
Deleted ! - C:\WINDOWS\prefetch\165203.EXE-26655C95.pf 
Deleted ! - C:\WINDOWS\prefetch\182703.EXE-09106ACA.pf 
Deleted ! - C:\WINDOWS\prefetch\188250.EXE-2363AB05.pf 
Deleted ! - C:\WINDOWS\prefetch\198359.EXE-350D9CC2.pf 
Deleted ! - C:\WINDOWS\prefetch\229937.EXE-0FAE1A55.pf 
Deleted ! - C:\WINDOWS\prefetch\243343.EXE-1FBDFD7A.pf 
Deleted ! - C:\WINDOWS\prefetch\313687.EXE-3121E288.pf 
Deleted ! - C:\WINDOWS\prefetch\331015.EXE-1392D160.pf 
Deleted ! - C:\WINDOWS\prefetch\339546.EXE-303A051A.pf 
Deleted ! - C:\WINDOWS\prefetch\407781.EXE-077DEBF7.pf 
Deleted ! - C:\WINDOWS\prefetch\437328.EXE-03D0B239.pf 
Deleted ! - C:\WINDOWS\prefetch\459578.EXE-131A8BDB.pf 
Deleted ! - C:\WINDOWS\prefetch\93812.EXE-1B7ED06B.pf 
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-0625BCF7.pf 
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-0EF461CE.pf 
Deleted ! - C:\WINDOWS\prefetch\WINFILSE.EXE-0C5BAB91.pf 
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-377E42D4.pf 
 
»»»» Supression files in C:\WINDOWS\system32 
 
Deleted ! - C:\WINDOWS\system32\mdelk.exe  
Deleted ! - C:\WINDOWS\system32\wintems.exe  
Deleted ! - C:\WINDOWS\system32\ban_list.txt  
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
Deleted ! - C:\WINDOWS\system32\drivers\srosa.sys  
Deleted ! - C:\WINDOWS\system32\drivers\srosa2.sys  
Deleted ! - C:\WINDOWS\system32\drivers\winfilse.exe  
Deleted ! - C:\WINDOWS\system32\drivers\downld\100187.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\103609.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\103796.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\105218.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\105343.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\106796.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\108265.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\109515.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\109921.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\110218.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\112890.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\115546.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\115625.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\116406.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\117687.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\117921.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\118062.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\119718.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\126703.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\129406.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\131718.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\133796.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\135203.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\136546.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\139000.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\141578.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\146921.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\148718.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\154656.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\155625.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\158406.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\159546.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\160781.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\161593.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\165203.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\168562.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\182703.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\188250.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\196171.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\198359.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\199234.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\201265.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\202187.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\202500.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\209390.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\215375.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\215750.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\217171.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\217218.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\225218.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\229078.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\229937.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\243343.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\244781.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\245515.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\246500.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\246734.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\247843.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\249953.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\251859.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\251906.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\260562.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\266359.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\271625.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\271812.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\274984.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\281750.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\299109.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\301031.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\303828.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\304203.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\309031.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\313687.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\331015.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\339546.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\351062.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\352500.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\354031.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\385078.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\391109.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\400812.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\407781.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\413312.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\437328.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\438734.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\439921.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\459578.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\462562.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\468453.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\505671.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\509421.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\542343.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\566750.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\81859.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\82390.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\83765.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\87250.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\87828.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\90734.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\93812.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\96921.exe 
Deleted ! - C:\WINDOWS\system32\drivers\downld\97515.exe 
Deleted ! - "C:\WINDOWS\system32\drivers\downld"  
 
»»»» Supression files in C:\Documents and Settings\Propri‚taire\Application Data 
 
Deleted ! - "C:\Documents and Settings\Propri‚taire\Application Data\m\flec006.exe"  
Deleted ! - "C:\Documents and Settings\Propri‚taire\Application Data\m\list.oct"  
Deleted ! - "C:\Documents and Settings\Propri‚taire\Application Data\m\data.oct"  
Deleted ! - "C:\Documents and Settings\Propri‚taire\Application Data\m\srvlist.oct"  
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\!3D_Development_Studio_for_Microsoft_Visual_Basic_.Net_6.07.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\100K Zipper 1.25.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\123Stay_Pop-up_Blocker_&_History_Eraser_2.1.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Actual Booster 3.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Advanced_FTP_Password_Recovery_1.0.180.2006_(With_Crack).zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Advanced_HTTP_Packet_Sniffer_1.2.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Alice_DVD_any_Video_to_MP3_Converter_5.0_Patch.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Another 3D Christmas Screensaver 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\ANPOP POP3 COMPONENT BUILD 7.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Ant_Hill_3D_1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Archimedean_Dynasty_demo.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\ASWSystems_Toolbars_Pack_-_Africa_Flags_1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Aurelia Reporter 2.6.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\AutoWallpaper 2.5.844.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\BlogMyCode VS2005 PlugIn for Windows Live Writer 1.0.2520.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Buyer's Hub 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\BuzMe_Service_3.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Calcmenu Chef 2006 6.1.4.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\CD-300_Printer_Driver_1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\ClicheCleaner 1.07 (Key+Serial).zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Computer OS Map 2008.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Curvemeister_2.1.16_Cracked.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\DeskNET_Command_Center_1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Differential Stability Analyzer 1.00.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\EarBoost_2.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Egypt_Tomb_Scenes_-_Papyrus_Art_1.0_[KeyGen].zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Epoch DHTML JavaScript Calendar 1.0.6.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Estate Planing Software 5.34.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\EWDraw_3D_ActiveX_3.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\eZee_FrontDesk_Hotel_Software_5.2.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\F-Prot.3.13a.espaÇñol.por.PEDMARAVI.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\FaceList 1.0.8.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\FlashMP3-MP3 to Flash 1.21.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Flash_ScreenSaver_Builder_4.8.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Flow 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Football_Rankulator_2.1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\FPAPal_1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Free Feed Icons.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Free MSN Emoticons Pack 3 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Game Speed Adjuster 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Giant Disk Cleaner 1.9.8.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Groowe_Search_Toolbar_2_build_14.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Hanzi Explorer 9.5 (Crack).zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Hexagrab_1.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\HomeHelp 1.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Hot DVD to iPod Converter 2.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\HTML_Block_1.83.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\ImageSwitch 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Indyo_1.6.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Internet Resource Assistant 1.0.4.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Internet_Anywhere_Toolkit_3.2.1_KeyGen.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Intrexx_Xtreme_2.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\JTier_Internet_News_Server_1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Julia Roberts Screensaver1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Kaspersky.Kav.5.0.227.Personal.(Licencia.Hasta.25-01-2007).zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\KJ_File_Manager_2.4.12_(Key).zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\LogLady 1.5.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\MadLogic Encryptor 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Malware_Scan_1.0.0.4.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Mapsoft_TOCBuilder_1.5.1.0_[Key+Serial].zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Marketing_Manager_2.15.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\McPaw Card Designer 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Mihov Index Maker 1.50.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\MobiMB_Mobile_Media_Browser_3.1.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\MovieSpot_0.6.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Music2PSP_1.00.102.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\My_BootDisk_2.71_build_412.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Neat Notes 2005 2.61.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\OfficeClip_Premium_Suite_6.9.9.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\PageXchanger_2.0.6.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\PanoModules_Lite_1.0_KeyGen.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Paradox to Sybase ASE Conversion Software 7.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Password Policy Enforcer 5.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\PayPal_Shopping_Cart_3.94.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Perfect Admin 1.0b [KeyGen].zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Personal Archiver 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Personal_Guitarist_1.2_[KeyGen].zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\PhotoGIF 4.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Photovido_1.40.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Playsnd_1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Power_E-Mailer_1.0.0.13.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Presentation_for_ACT!_8.0.2.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Publish_Table_to_HTML_for_MS_SQL_Server_Professional_1.00.00.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Puma Video To iPod Converter 2.369.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Robert's Coder 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\RSVP_Reader_0.0.8.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Scan2Text 2.0.15.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\SerialNull_1.7.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Small WMA MP3 Converter 3.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\SmartCUT Pro 2.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\SMTP_Module_for_VB6_with_SMTP_AUTH_1.0_[Serial].zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\SoccerSaver_3.6a.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Sokoban++ 1.6.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\SpyWareNuker 4.8.85.1815.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Symantec.-.Norton.Ghost.2004.Enterprise.Edition.&.Crack.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Symantec.Norton.Internet.Segurity.v.2005+Keygen.en.espaÇñol.-.(ARPASERCOM).zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\SystemScrub_1.10.0_(Patch).zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Taglinator 4.0 Crack.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\The Fish Guy 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\The_MagicBook_5.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Tic-Tac-Toe 1.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\ToolbarStudio 3.5.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\TrendyFlash Site Builder 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Turbo MP3 Recorder 1.0.3.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\ULTIMATE_80's_Net_Radio_1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\UniquePVPers Temperature Converter 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Unreal_Tournament_2004_Allied_CTF_mod.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Unreal_Tournament_2004_ONS_Jungle_Hill_2_Map.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\UserMonitor_1.7.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\VeriFinger_Fingerprint_Identification_SDK_5.0.0.1_Cracked.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\VideoVista Standard Edition 2.3.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Visual Desktop Search 1.0.2703.25256.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Visual_Basic_for_Kids_2.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Voodoo Downloader 1.1.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\VUKeyfinder_0.99d.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Water Lily Screensaver v2 5.07.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\WebStyle 4.01.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Whizlabs_PMP_Preparation_Kit_6.0.1_[Key].zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Wincmd Directory Menu Customizer 1.2.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Windows XP autorun repair wizard 5.2.3790.67.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\WinTabs_2.7.4_[With_Crack].zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\WinTools.net_Extra_Edition_8.3.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Wise_DVD_To_WMV_Converter_4.0.1_Key.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Word Finder Pro 1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\WTool_1.0.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\X-Shrink_1.5_Cracked.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\XSecurePro_8.0_[With_Crack].zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\Yahoo!_Search_1.0.5.zip 
Deleted ! - C:\Documents and Settings\Propri‚taire\Application Data\m\shared\ZERO Binary 1.7.zip 
Deleted ! - "C:\Documents and Settings\Propri‚taire\Application Data\m\shared"  
Deleted ! - "C:\Documents and Settings\Propri‚taire\Application Data\m"  
 
»»»» Supression files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp 
 
Deleted ! - C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\PatchByFile.tmp     
 
»»»» Supression files in C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5 
 
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64[3].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64[4].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\1O0242HA\mxd[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_1[3].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\3192TJDU\mxd[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64[3].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\b64_3[3].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\DDN688T7\mxd[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64[3].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64[4].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_3[3].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\b64_3[4].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\mxd[1].jpg    
Deleted ! - C:\Documents and Settings\Propri‚taire\Local Settings\Temporary Internet Files\Content.IE5\XMG2WHAJ\mxd[2].jpg    
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\Local AppWizard-Generated Applications\msnmsgr   
Deleted ! - HKEY_USERS\S-1-5-21-823518204-573735546-839522115-1003\Software\Local AppWizard-Generated Applications\winfilse   
 
--------------- [ States / Restarting of services ] ---------------- 
 
+- Safe boot mode restored ! 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

 Ndisuio - Type of startup  = 3 
 
 EapHost - Type of startup  = 2 
 
 Ip6Fw - Type of startup  = 2 
 
 SharedAccess - Type of startup  = 2 
 
 wuauserv - Type of startup  = 2 
 
 wscsvc - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

D: - Lecteur fixe

 
+- deleting files : 
 
Deleted ! - C:\sdlflzoip  
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Documents and Settings\Propri‚taire\Application Data\Macromedia\Flash Player\#SharedObjects\YAMY9HKE\crackle.com
C:\Documents and Settings\Propri‚taire\Application Data\Macromedia\Flash Player\#SharedObjects\YAMY9HKE\crackle.com\crackleSettings.sol
C:\Documents and Settings\Propri‚taire\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#crackle.com
C:\Documents and Settings\Propri‚taire\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#crackle.com\settings.sol
C:\Documents and Settings\Propri‚taire\Mes documents
ero\Keygen
C:\Documents and Settings\Propri‚taire\Mes documents
ero\Keygen\Keygen.exe
C:\Documents and Settings\Propri‚taire\Mes documents
ero\Keygen\orion.nfo
C:\Documents and Settings\Propri‚taire\Recent\Ahead.Nero.Burning.ROM.v7.0.1.2.Premium.Edition.Incl.Keygen-ORiON.lnk
 
 
---------------- ! End of report ! ------------------

Utilisateur anonyme · Answer

Hi,

Maintenant vire tes cracks et fait ceci:

télécharge hijackthis
->  enregistre la cible sous .... "le bureau" 

-> Fais un double-clic sur "HJTInstall.exe" afin de lancer l'installation

-> Clique sur Install ensuite sur "I Accept"

-> Clique sur" Do a scan system and save log file"

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse 

->Tuto hijackthis(Merci à Balltrap34)

aoshi · Answer

ok voila
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:28:30, on 01/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ugbsxsolbq] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\sosrybsddrc.dll"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [oayym] "c:\documents and settings\propriétaire\local settings\application data\oayym.exe" oayym
O4 - HKCU\..\Run: [ksamies] "c:\documents and settings\propriétaire\local settings\application data\ksamies.exe" ksamies
O4 - HKCU\..\Run: [osoww] "c:\documents and settings\propriétaire\local settings\application data\osoww.exe" osoww
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Utilisateur anonyme · Answer

Hi,

-Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

- Mets le à jour

---
- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

- Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

aoshi · Answer

ok merci je metterai le rapport quand sa sera fini en tous cas merci de m'aider

aoshi · Answer

désoler pour le double post mais la recherche est fini et il m'ont afficher une liste avec plein de virus cocher 
je peux supprimer la selection ou pas ?

Utilisateur anonyme · Answer

Hi,

Oui tu supprime la quarantaine.Puis tu poste le rapport sur le forum à la suite.

Alut.

aoshi · Answer

voila le rapport
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1442
Windows 5.1.2600 Service Pack 3

01/12/2008 22:22:01
mbam-log-2008-12-01 (22-21-55).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|G:\|H:\|I:\|J:\|)
Eléments examinés: 122109
Temps écoulé: 38 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 34
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 80

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a} (Fake.Dropped.Malware) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e596df5f-4239-4d40-8367-ebadf0165917} (Rogue.Installer) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{85589b5d-d53d-4237-a677-46b82ea275f3} (Unknown.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Somefox (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ksamies (Adware.Navipromo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oayym (Adware.Navipromo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\osoww (Adware.Navipromo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ugbsxsolbq (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOTegfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken.

Dossier(s) infecté(s):
C:\Program Files\akl (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> No action taken.

Fichier(s) infecté(s):
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\ksamies_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\ksamies_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\ksamies.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\ksamies.exe (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\oayym_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\oayym_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\oayym.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\oayym.exe (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\osoww_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\osoww_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\osoww.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\osoww.exe (Adware.Navipromo.H) -> No action taken.
C:\System Volume Information\_restore{0D700615-6047-4DD7-A003-3E4E63BA657B}\RP435\A0252594.dll (Rogue.MessengerSkinner) -> No action taken.
C:\Program Files\akl\akl.dll (Fake.Dropped.Malware) -> No action taken.
C:\Program Files\akl\akl.exe (Fake.Dropped.Malware) -> No action taken.
C:\Program Files\akl\uninstall.exe (Fake.Dropped.Malware) -> No action taken.
C:\Program Files\akl\unsetup.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\system32egsvr32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\a.bat (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\base64.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\FVProtect.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\userconfig9x.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\winsystem.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\zip1.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\zip2.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\zip3.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\zipped.tmp (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\bdn.com (Trojan.Agent) -> No action taken.
C:\WINDOWS\iTunesMusic.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\mssecu.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\emesx.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\medup012.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32
etode.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32
ewsd32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32egc64.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32egm64.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	aack.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	aack.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	emp#01.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	hun.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32	hun32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> No action taken.
C:\WINDOWS\mywallpaper.bmp (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\xhbxcnv.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\xfjzrby.dll (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\xewuaqj.exe (Fake.Dropped.Malware) -> No action taken.
C:\WINDOWS\xcbhwuq.exe (Fake.Dropped.Malware) -> No action taken.
C:\Documents and Settings\Propriétaire\KGT2nd_EDITOR.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Propriétaire\KGT2nd_GAME.exe (Trojan.FakeAlert) -> No action taken.

Utilisateur anonyme · Answer

Hi,

Relance malwarebyte et ensuite tu va dans l'onglet quarantaine et tu supprime tout .

Ensuite tu redémarre ton pc normalement et tu refait un hijackthis.

Alut.

aoshi · Answer

je fait quoi dans hijackthis ?

Utilisateur anonyme · Answer

Hi,

No action taken =>> tu n'as rien supprimer.

Relance malwarebyte et ensuite tu va dans l'onglet quarantaine et tu supprime tout .

Ensuite tu redémarre ton pc normalement et tu refait un hijackthis.

Alut.

aoshi · Answer

ok 
mais pourquoi ta dit sa alors ?
"Ensuite tu redémarre ton pc normalement et tu refait un hijackthis. "

Utilisateur anonyme · Answer

Hi,

Après avoir supprimer la quarantaine de malwarebyte pour valider le processus ,si tu préfère tu redémarre ton pc normalement et ensuite tu refait un hijackthis.

Alut.

aoshi · Answer

ok bah merci beaucoup si sa ne marche toujours pas je vous recontacterai merci beaucoup ^^

Utilisateur anonyme · Answer

Hi,

Et fait moi le rapport hijackthis après avoir fait ce que je t'ai demander avant et c pas fini tu as encore des truc a faire .

Alut.

aoshi · Answer

lol c'est quoi ?
Il faut envoyer le rapport sur le site spécial ? si c'est sa c'est deja fait aussi je sait pas

Utilisateur anonyme · Answer

Hi,

Et tu comprend pas toi !!!!!!!!

Tu relance malwarebyte et tu vas dans l'onglet quarantaine tu supprime tout ce qu'il a trouver.

Ensuite tu redemarre ton pc normalement.

Tu refait un rapport hijackthis et tu le poste en réponse a la suite.

C'est bon la ta comprit ou pas ?

Alut.

aoshi · Answer

désoler j'avais mal relue c'est de ma faute 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:48:56, on 01/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Utilisateur anonyme · Answer

Hi,

Maintenant tu fait un scan en mode sans échec de malwarebyte.

Et tu poste le rapport et après on passe a la fin de ta désinfection.

Alut.

aoshi · Answer

quand tu dit sans echec c'est quand viens de demarer son ordi ?

Utilisateur anonyme · Answer

Hi,

Tu redemlarre ton pc et ensuite tu appuie sur la touche F8 et tu choisit le mode sans échec.

Alut.

aoshi · Answer

je ne peux pas le faire la car il me faut un code tu peux me dire directement pourque je puisse le faire demain stp ?

Utilisateur anonyme · Answer

Hi,

Comment sa un code?

Alut.

aoshi · Answer

nan c'est bon 
voila le rapport
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1442
Windows 5.1.2600 Service Pack 3

02/12/2008 13:55:54
mbam-log-2008-12-02 (13-55-45).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|G:\|H:\|I:\|J:\|)
Eléments examinés: 125836
Temps écoulé: 1 hour(s), 46 minute(s), 8 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\WINDOWS\system32\drivers\downld (Trojan.Agent) -> No action taken.

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Utilisateur anonyme · Answer

Hi,

Relance malwarebyte et va dans la quarantaine et vide la et ensuite tu refait un hijackthis .

Alut.

aoshi · Answer

ok voila le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:54:08, on 02/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Utilisateur anonyme · Answer

Hi,

Comment vas ton pc?

Alut.

aoshi · Answer

bah sa va mieux deja j'avoue que tu as était trés sympa merci beaucoup de ton aide je doit juste réinstaller mes antivirus

Utilisateur anonyme · Answer

Hi,

Peut tu faire ceci STP:Renomme hijackthis.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

aoshi · Answer

Ok encore merci du conseil je ne te remercirai jamais assez

Utilisateur anonyme · Answer

Hi,



Et fait un hijackthis ensuite et poste le moi.Remet ton antivirus.(un seul)

Alut.

aoshi · Answer

voila le rapport en éspérant que sa soit bon
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:59:27, on 02/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Utilisateur anonyme · Answer

Hi,

tu la pas renommer ton hijackthis:

Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

aoshi · Answer

il est ou le fichier exe ?

Utilisateur anonyme · Answer

Hi,

fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

aoshi · Answer

j'ai totalement changer le nom du fichier mais je ne sait pas si c'est bon 
(mais je ne sait pas ou il faut cherhcer le ficher exe)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:10:33, on 02/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Utilisateur anonyme · Answer

Hi,


Fait un clic droit sur hijackthis qui et sur ton bureau.

aoshi · Answer

bah voila c'est deja fait je l'ai fait sur le fichier, le raccourcis

Utilisateur anonyme · Answer

Hi,

fait ceci alors:

==>Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

==>Double clique sur RSIT.exe pour lancer l'outil.

==>Clique sur ' continue ' à l'écran Disclaimer.

==>Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

==>Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

aoshi · Answer

mais il sert a quoi ce logiciel ?

Utilisateur anonyme · Answer

Hi,

On va vérifier plus en profondeur ton pc carton hijackthis me semble petit.

Alut.

aoshi · Answer

voila les rapports
le premier
info.txt logfile of random's system information tool 1.04 2008-12-02 19:55:02

======Uninstall list======

-->C:\Program Files\Nero\Nero 7
ero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E06E4F4E-72D6-4497-BFFD-BCB43077C2F4}\setup.exe" -l0x40c  -uninst 
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop CS-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0xa 
Adobe Reader 8.1.3 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
CA VMN Anti-Spyware (remove only)-->"C:\Program Files\CA VMN Anti-Spyware\uninstall.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Favorit-->"c:\documents and settings\propriétaire\local settings\application data\ksamies.exe" -uninstall
Favorit-->"c:\documents and settings\propriétaire\local settings\application data\oayym.exe" -uninstall
Favorit-->"c:\documents and settings\propriétaire\local settings\application data\osoww.exe" -uninstall
FFWorld Triple Triad-->C:\Program Files\FFWorld Triple Triad\uninstall.exe
FindyKill-->C:\Program Files\FindyKill\Uninstal.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Document Viewer 5.3-->C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP Extended Capabilities 5.3-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Image Zone 5.3-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP Imaging Device Functions 5.3-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP PSC & OfficeJet 5.3.A-->"C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
HP Software Update-->MsiExec.exe /X{15EE79F4-4ED1-4267-9B0F-351009325D7D}
HP Solution Center & Imaging Support Tools 5.3-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
IBoot-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{61ACEE8D-4E0D-49BE-962E-9CA26EC0F921}\Setup.exe" -l0x9 
IL Download Manager-->C:\Program Files\Image-Line\Downloader\uninstall.exe
J2SE Runtime Environment 5.0 Update 11-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Logiciel WebCam de Labtec-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x40c 
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{3F7924B9-D148-3141-87B1-68F36043A940}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{511DF669-2930-30C0-8EB6-552887E29EC8}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5 Language Pack - fra-->MsiExec.exe /I{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}
Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 Premium-->MsiExec.exe /I{0000040C-78E1-11D2-B60F-006097C998E7}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe"
Microsoft Works 2000-->MsiExec.exe /I{A3088CD2-612B-11D3-AF43-00C04F443448}
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Module linguistique Microsoft .NET Framework 3.5 - fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - fra\setup.exe
Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Navilog1 3.5.0-->"C:\Program Files\Navilog1\unins000.exe"
NDSROM Player-->D:\mugen HR\Uninstal.exe
Nero 7 Demo-->MsiExec.exe /I{C67B64FA-E69E-E061-6516-F8E911671036}
Neuf - Kit de connexion-->C:\Program Files\Neuf\Kit\uninstall.exe
Nokia Connectivity Cable Driver-->MsiExec.exe /X{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48}
Package de pilotes Windows - Nokia Modem  (05/22/2008 3.8)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE
okia_blue_6F90B0F4A73A2F780A1010B5D6CB5DDFB098181E
okia_bluetooth.inf
Package de pilotes Windows - Nokia pccsmcfd  (10/12/2007 6.85.4.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.inf
PC Connectivity Solution-->MsiExec.exe /I{1A524CFE-DF85-4555-8BC2-0C89DBD8BC2C}
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
RGSS de RMXP version 1.0.1-->"D:\mugen HR\RGP\RGSS\unins000.exe"
RMXP version 1.0.0.1-->"D:\mugen HR\RGP\unins000.exe"
RON Tool Offersfortoday-->C:\WINDOWS\system32\lhhdksybeqrfkes.exe
SAMSUNG CDMA Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
SAMSUNG Mobile Composite Device Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\6\SSBCUninstall.exe
Samsung Mobile phone USB driver Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem ^^-->C:\WINDOWS\system32\Samsung_USB_Drivers\4\SSVDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x040c -removeonly
SiS VGA Utilities-->Rundll32 SiSInst.dll,Uninstall VGA,R,oem1.inf
SiSAGP driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC226AC9-0314-496C-BE6A-B6A132628466}\setup.exe" -l0x40c 
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Sunbelt Personal Firewall-->MsiExec.exe /X{BFD080F6-3BF0-40E1-9507-9CA969C35870}
VMN Toolbar-->C:\Program Files\vmntoolbar\uninstall.exe
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WinZip 11.1-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B2}
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

=====HijackThis Backups=====

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
O2 - BHO: (no name) - {4872213b-931d-49dd-9fc4-217cd3d1aa08} - C:\WINDOWS\system32\dgrnfg.dll (file missing)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKLM\..\Run: [{9754B85A-3B34-4969-BE1F-CD03227E9470}] "C:\WINDOWS\syszweuas.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [{B081DB1F-4EE6-4021-9DD4-8B300F0D636D}] "C:\WINDOWS\syssngbeh.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - HKLM\..\Run: [{05CD0D77-4947-4a56-94FA-0DF0DC644D7B}] "C:\WINDOWS\sysqyzwud.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKLM\..\Run: [{DD651081-A909-45ad-BD71-2335B0ADE043}] "C:\WINDOWS\sysutrnez.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - AppInit_DLLs: c:\windows\system32\mljgedd.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O20 - Winlogon Notify: dgrnfg - dgrnfg.dll (file missing)
O2 - BHO: VMN Toolbar - {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: VMN Toolbar - {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: offersfortoday browser enhancer - {2BDD9C2B-6E11-34A3-F18D-E17A4DDD0DDF} - C:\WINDOWS\system32\sosrybsddrc.dll
O4 - HKCU\..\Run: [Somefox] C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\xxx7510.exe
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKLM\..\Policies\Explorer\Run: [0S857XXsCh] C:\Documents and Settings\All Users\Application Data
ylstcxg\xgfevevq.exe
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKCU\..\Run: [admcmden] C:\WINDOWS\system32\ahozavyj.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

======Hosts File======

127.0.0.1	007guard.com
127.0.0.1	www.007guard.com
127.0.0.1	008i.com
127.0.0.1	008k.com
127.0.0.1	www.008k.com
127.0.0.1	00hq.com
127.0.0.1	www.00hq.com
127.0.0.1	010402.com
127.0.0.1	032439.com
127.0.0.1	www.032439.com

======Security center information======

AV: avast! antivirus 4.8.1229 [VPS 081202-0]
FW: Sunbelt Personal Firewall

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\PC Connectivity Solution\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Fichiers communs\Teleca Shared;C:\Program Files\Samsung\Samsung PC Studio 3\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

et le 2eme
Logfile of random's system information tool 1.04 (written by random/random)
Run by Propriétaire at 2008-12-02 19:54:23
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 17 GB (47%) free of 36 GB
Total RAM: 223 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:54:54, on 02/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Propriétaire\Bureau\Raccourcis Bureau non utilisés\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Propriétaire.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1787C5A3-79D5-46CE-A2A1-F6766F5B3B50}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Utilisateur anonyme · Answer

Hi,

Non pas du tout.

Ensuite fait ceci:

Télécharges OTMoveIt3 (de Old_Timer) sur ton Bureau.

http://oldtimer.geekstogo.com/OTMoveIt3.exe

! Déconnectes toi et fermes toute tes applications en cours !

Double cliques sur "OTMoveIt3.exe" pour ouvrir le prg .
Puis copies ce qui se trouve en citation ci-dessous,


:Files
c:\documents and settings\propriétaire\application data	mp29b.tmp.exe

:Commands
[emptytemp]



et colles le dans le cadre de gauche de OTMoveIt3 :
Paste Instructions for items to be moved.
(ne touche à rien d'autre !)

-> cliques sur MoveIt! pour lancer la suppression.
-> laisses travailler l'outil ...

( Note : ton bureau va disparaitre puis réapparaitre, c'est normal .)

-->Postes le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"
( " xxxx2008_xxxxxx.log " où les "x" correspondent au jour et à l'heure de l'utilisation ). 

Refait un rsit de contrôle.

aoshi · Answer

voila le rapport
========== FILES ==========
File/Folder c:\documents and settings\propriétaire\application data	mp29b.tmp.exe not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_498.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 12022008_201950

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot.
File C:\WINDOWS	emp\_avast4_\Webshlock.txt not found!
C:\WINDOWS	emp\Perflib_Perfdata_498.dat moved successfully.

c'est quoi un rsitde controle ?

Utilisateur anonyme · Answer

Hi,

tu redemarre ton pc et ensuite tu refait un rapport rsit

aoshi · Answer

c'est quoi un rapport rsit ?

Utilisateur anonyme · Answer

==>Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

==>Double clique sur RSIT.exe pour lancer l'outil.

==>Clique sur ' continue ' à l'écran Disclaimer.

==>Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

==>Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

aoshi · Answer

ok je vais le faire mais sa sert a quoi au juste ?

aoshi · Answer

ok je vais le faire mais sa sert a quoi au juste ?

Utilisateur anonyme · Answer

Hiu,

a verifier si le fichier et bien virer et avant redemarre ton pc.

Alut.

aoshi · Answer

heu j'ai pas bien compris mais c'est pas grave mon ordi est réparer je te remercie beaucoup de ton aide et encore désoler du dérangement aller salut et bonne continuiter dans le futur ^^

Application"n'est pas une application win32&q

56 réponses

Discussions similaires