PC infecté, les applications ne marchent plus [Résolu]

Réponse 1 / 36

Utilisateur anonyme

Salut,

▶ Télécharges FindyKill de Chiquitine29

▶ Fais un clique droit sur le lien et choisis "enregistrer la cible sous ...." , destination le bureau .

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

▶ Note importante : si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .

▶ Entre dans le dossier " FindyKill "

▶ Double clic sur " FindyKill.bat " (et pas sur autre chose!) pour lancer l'outil .

▶ Choisis l'option 1 . Puis laisses travailler ...

▶ Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

Les-risques-securitaires-du-peer-to-peer

Réponse 2 / 36

Utilisateur anonyme

----------------- FindyKill V4.709 ------------------

* User : Thomas - THOMAS
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 10/12/08 par Chiquitine29
* Recherche effectuée à 0:04:19 le 19/12/2008
* Windows XP - Internet Explorer 7.0.5730.11

((((((((((((((((( *** Recherche *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\windows\system32\icmuigq.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Thomas\Application Data\drivers\winupgro.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\Program Files\Mozilla Firefox\firefox.exe

--------------- [ Processus infectieux stoppés ] ----------------

"C:\Documents and Settings\Thomas\Application Data\drivers\winupgro.exe" (1888)

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Presence des fichiers dans C:

»»»» Presence des fichiers dans C:\WINDOWS

»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\Prefetch\PATCH.EXE-39A24F81.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Found ! [18/12/2008 20:10] - C:\WINDOWS\system32\mdelk.exe
Found ! [18/12/2008 20:10] - C:\WINDOWS\system32\wintems.exe
Found ! [18/12/2008 23:12] - C:\WINDOWS\system32\ban_list.txt

»»»» Presence des fichiers dans C:\WINDOWS\system32\config\systemprofile\AppData\Roaming

»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

»»»» Presence des fichiers dans C:\Documents and Settings\Thomas\Application Data

Found ! [18/12/2008 20:12] - "C:\Documents and Settings\Thomas\Application Data\m\flec006.exe"
Found ! [18/12/2008 20:12] - "C:\Documents and Settings\Thomas\Application Data\m\list.oct"
Found ! [18/12/2008 20:12] - "C:\Documents and Settings\Thomas\Application Data\m\data.oct"
Found ! [18/12/2008 20:12] - "C:\Documents and Settings\Thomas\Application Data\m\srvlist.oct"
Found ! [18/12/2008 20:14] - "C:\Documents and Settings\Thomas\Application Data\m\shared"
Found ! [18/12/2008 16:00] - "C:\Documents and Settings\Thomas\Application Data\m"
Found ! [18/12/2008 15:56] - "C:\Documents and Settings\Thomas\Application Data\drivers"
Found ! [18/12/2008 20:09] - "C:\Documents and Settings\Thomas\Application Data\drivers\srosa.sys"
Found ! [18/12/2008 20:09] - "C:\Documents and Settings\Thomas\Application Data\drivers\srosa2.sys"
Found ! [02/10/2004 03:07] - "C:\Documents and Settings\Thomas\Application Data\drivers\winupgro.exe"
Found ! [18/12/2008 20:19] - "C:\Documents and Settings\Thomas\Application Data\drivers\downld"
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\102703.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\104812.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\105296.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\109265.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\110953.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\111625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\120406.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\122640.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\124765.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\125078.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\125109.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\126656.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\128031.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\129281.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\129656.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\130265.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\130984.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\131312.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\131484.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\132531.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\133593.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\134046.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\145000.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\146296.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\146687.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\152406.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\155484.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\156359.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\156796.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\161125.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\161875.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\162796.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\163171.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\178562.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\182765.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\190156.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\190875.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\191140.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\191187.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\192046.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\192390.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\194625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\197031.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\197046.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\197093.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\197734.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\198046.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\210031.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\210734.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\210796.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\211265.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\211328.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\213437.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\213546.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\216500.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\217140.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\217281.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\219750.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\225328.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\226812.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\227375.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\228562.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\229390.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\229875.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\231375.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\232843.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\233546.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\234125.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\235609.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\236921.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\238421.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\238703.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\239812.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\240500.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\240593.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\240937.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\246656.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\247625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\247953.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\249593.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\251093.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\251875.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\252875.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\254015.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\254671.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\259234.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\259625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\260015.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\260062.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\260546.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\260578.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\265125.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\266546.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\266625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\266828.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\268359.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\268375.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\277828.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\278421.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\282671.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\284015.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\284140.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\284703.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\285562.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\285750.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\285796.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\286312.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\287203.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\291187.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\292500.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\293031.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\293562.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\294031.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\294312.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\294625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\294750.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\295187.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\310015.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\310781.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\311171.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\322593.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\323359.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\323781.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\340734.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\342171.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\342843.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\343546.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\344343.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\344875.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\353859.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\361406.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\362187.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\362640.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\370500.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\375734.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\381156.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\381234.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\381781.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\385546.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\386921.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\387406.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\392703.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\394562.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\395171.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\411687.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\417312.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\419062.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\419500.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\420234.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\421234.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\421828.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\424515.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\425546.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\427031.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\427187.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\427281.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\427906.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\428296.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\428375.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\428609.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\428937.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\431296.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\433031.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\433390.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\440812.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\443078.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\443656.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\454125.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\454843.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\455140.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\46750.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\48625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\49078.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\49468.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\49593.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\504218.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\505468.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\505734.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\51234.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\513953.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\51453.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\51515.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\515156.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\516734.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\517281.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\51890.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\521531.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\523343.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\523812.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\52890.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\52906.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\529265.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\530062.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\530484.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\54437.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\555203.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\557359.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\558031.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\56281.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\56453.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\56687.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\56750.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\587234.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\58734.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\589625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\590359.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\590500.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\594484.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\599796.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\610234.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\610687.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\636421.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\648921.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\649437.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\649546.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\65312.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\68234.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\70296.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\70781.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\71250.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\72625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\73046.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\73078.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\74453.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\74890.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\75312.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\77625.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\78187.exe
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Application Data\drivers\downld\94812.exe

»»»» Presence des fichiers dans C:\DOCUME~1\Thomas\LOCALS~1\Temp

Found ! - C:\DOCUME~1\Thomas\LOCALS~1\Temp\R‚pertoire temporaire 1 pour PowerArchiver 2009 11.03.04.zip\patch.exe

»»»» Presence des fichiers dans C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5

Found ! [18/12/2008 19:16] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64[1].jpg
Found ! [18/12/2008 18:04] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_1[1].jpg
Found ! [18/12/2008 18:12] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_1[2].jpg
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_1[3].jpg
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_1[4].jpg
Found ! [18/12/2008 16:05] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_2[1].jpg
Found ! [18/12/2008 19:20] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_2[2].jpg
Found ! [18/12/2008 17:45] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_3[1].jpg
Found ! [18/12/2008 20:10] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_3[2].jpg
Found ! [18/12/2008 18:09] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\mxd[1].jpg
Found ! [18/12/2008 20:12] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\mxd[2].jpg
Found ! [18/12/2008 18:00] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64[1].jpg
Found ! [18/12/2008 18:08] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64[2].jpg
Found ! [18/12/2008 18:43] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64_1[1].jpg
Found ! [18/12/2008 17:51] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64_2[1].jpg
Found ! [18/12/2008 19:14] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64_3[1].jpg
Found ! [18/12/2008 19:17] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\mxd[1].jpg
Found ! [18/12/2008 15:59] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64[1].jpg
Found ! [18/12/2008 18:38] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64[2].jpg
Found ! [18/12/2008 19:19] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64_1[1].jpg
Found ! [18/12/2008 18:44] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64_2[1].jpg
Found ! [18/12/2008 18:07] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64_3[1].jpg
Found ! [18/12/2008 18:36] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64_3[2].jpg
Found ! [18/12/2008 17:47] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64[1].jpg
Found ! [18/12/2008 20:12] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64[2].jpg
Found ! [18/12/2008 17:51] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64_1[1].jpg
Found ! [18/12/2008 18:04] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64_2[1].jpg
Found ! [18/12/2008 20:19] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64_2[2].jpg
Found ! [18/12/2008 15:58] - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64_3[1].jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
LaunchApp=Alaunch
SoundMan=SOUNDMAN.EXE
ntiMUI=c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
<NO NAME>=
RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
MSPY2002=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
VTTimer=VTTimer.exe
VTTrayp=VTtrayp.exe
AspireService=C:\Program Files\Acer\Acer eMode Management\AspireService.exe
MediaSync=C:\Program Files\Acer\Acer eConsole\MediaSync.exe
eRecoveryService=C:\Acer\Empowering Technology\eRecovery\Monitor.exe
NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe
OpwareSE2="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
Picasa Media Detector=C:\Program Files\Picasa2\PicasaMediaDetector.exe
LVCOMSX=C:\WINDOWS\system32\LVCOMSX.EXE
UfSeAgnt.exe="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
LogitechVideoRepair=C:\Program Files\Logitech\Video\ISStart.exe
LogitechVideoTray=C:\Program Files\Logitech\Video\LogiTray.exe
icmuigq="c:\windows\system32\icmuigq.exe" icmuigq
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
NoChange=1
Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1

[HKEY_CURRENT_USER\software\local appwizard-generated applications\crac]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\Launch Tool]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\msnmsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\patch]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

--------------- [ Registre / Clés infectieuses ] ----------------

Found ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\Local AppWizard-Generated Applications\msnmsgr
Found ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\Local AppWizard-Generated Applications\patch
Found ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\patch
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

- sans echec non fonctionnel !!

+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 3

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4

--------------- [ Recherche dans supports amovibles] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

+- presence des fichiers :

--------------- [ Registre / Mountpoint2 ] ----------------

-> Not found !

------------------- ! Fin du rapport ! --------------------

Réponse 3 / 36

Utilisateur anonyme

Re,

Findykill de chiquitine29 option 2:

▶ Branche tes disques amovibles à ton PC (clefs USB, disque dur externe, etc...) sans les ouvrir

▶ Double-clique sur le raccourci FindyKill sur ton bureau

▶ Au menu principal, choisis l'option 2 (Suppression)

/!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

𥭮nsuite, poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

Les-risques-securitaires-du-peer-to-peer

Réponse 4 / 36

Utilisateur anonyme

Bon apparement ça remarche donc voici le rapport :

----------------- FindyKill V4.709 ------------------

* User : Thomas - THOMAS
* executed from : C:\Program Files\FindyKill
* Update on 10/12/08 par Chiquitine29
* Start at 0:17:47 the 19/12/2008
* Windows XP - Internet Explorer 7.0.5730.11

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

»»»» Supression files in C:\WINDOWS

»»»» Supression files in C:\WINDOWS\Prefetch

Deleted ! - C:\WINDOWS\prefetch\PATCH.EXE-39A24F81.pf

»»»» Supression files in C:\WINDOWS\system32

Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt

»»»» Supression files in C:\WINDOWS\system32\config\systemprofile\AppData\Roaming

»»»» Supression files in C:\WINDOWS\system32\drivers

Deleted ! - C:\WINDOWS\system32\drivers\srosa.sys
Deleted ! - C:\WINDOWS\system32\drivers\srosa2.sys

»»»» Supression files in C:\Documents and Settings\Thomas\Application Data

Deleted ! - "C:\Documents and Settings\Thomas\Application Data\m\flec006.exe"
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\m\list.oct"
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\m\data.oct"
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\m\srvlist.oct"
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\'Mystic Forest' Screensaver 1.01.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\(Programma.Ita).Nod32.2.51.26.Crack.Per.Aggiornamenti.-.Windows.Xp.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\1Click DVD to Mpeg Mpg 1.13.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\ABC Video Converter Pro 2.10.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Acrobat Speeder 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Activation.Mcafee.Internet.Security.Cracks.&.Super.News.2007.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\AdiPhone 1.60.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Afree DVD Ripper 1.10.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\AGILAN Perpetual 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\America (USA) Screensaver 3.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Amplify 1.0.28.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Antares Voice Thing! 1.16.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Archimedes Grapher Professional 2.2.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Artemis 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Aspose.Metafiles for Java 1.3.0.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Audio Converter 8.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Avast!.Antivirus.Pro.v4.5.Portugues.+.Keygen.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Avast.Pro.v4.7.892.PT-Br.Incl.Keymaker-CORE.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Avast.Professional.v4.7.844.Incl.Keymaker-Ita.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Bible Print Shop 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Blue Font View 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Bucket Explorer 2007.12.01.00.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\BusinessCards MX 3.94.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Carrier 1.0.0.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Cartoon Cats Screensaver 1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\ChangeMAC 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Chemistry Development Kit 1.0.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Chimera Virtual Desktop 1.3.7.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Chromatia Tuner 3.4.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Clock XP 2003 20.3.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Clock.NET 2.0.0.2.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Color Selector 2.01.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Communication Applications
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\CornerSpace Mobile Marketer 1.0.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Country Music's Sugarland Firefox Theme 1.1.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Currency Converter Gadget 1.0.0.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Dark Room 0.8.0.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Dealsucker Toolbar For IE 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Deep Freeze Enterprise 6.30.221.1917.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Desktop Team Snapshots 1.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\DigiPaint 2.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\drweb_432b_key.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\DynamicMagic 4.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\EA Mobile - Bejeweled v1.5.45 - 240x320 - N73.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\EasyRegScan 1.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Excel 2 mySQL 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\FileExtractor 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\FishBase Client 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Gentle MAC Pro 4.0.0.1729.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Glycemic Impact Diet 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Google Adsense Websites 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Great Artist - Nudes 1.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\GulfCoastDoppler! 1.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\HandyHTML Editor 1.52.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Homeboy AAC Plugin v1.09 for Winamp 2.x.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\hooeey 2.6b.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\HTML Album 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Internet Country Codes 1.4.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\JFrameBuilder 3.3.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\JPG image files viewer 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\JunkMail Spittoon 3.11.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Kaspersky.Antivirus.Personal.Pro.5.0.149.4.Key.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Kaspersky.Security.for.PDA.v5.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Lap Interval Converter b.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\LingvoSoft Learning PhraseBook 2008 English - Estonian 2.3.90.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Lord of the Rings
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Macro Keyboard Mouse Recorder Wizard 4.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Macrobject Word-2-CHM Standard 2008.0.1202.2055.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Malware Destroyer 4.1.5.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\MicroFTP 2000 2.3.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Microsoft Zune 3.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\MindManager IFilter 1.2.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Mini Map Sideba5 0.3.5.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Mocha 3.992.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\MPL3D Solar System 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\MS Word File Size Reduce Software 7.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\msn live per windows mobile 5 crack.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\MultiAVI Player 0.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\MyFireFox & Vista-aero Modifier 2.0.0.46.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\New Year Wallpaper 5.07.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\NOD32_All_Versions_Fixed_.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\NVmax 4.02.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Official eBay Search Gadget 1.0.0.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\OpenOffice.org2GoogleDocs 1.1.2.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\PicturePlus for ACT! 8.5.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\PixPrint 3.8.2.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\PMView Pro 3.51.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Read BACK! Pro.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Reference for Teachers 6.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\RyanVM's Windows XP Post-SP3 Update Pack 1.0.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\ScreenFlash 1.7 build 0021.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Share the Memories 1.05.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Shorts 1.02.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Skeleton Crew XML Modeler Edition 2.07.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\SkyEye-wx USB Tracker 8.38.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Slide Show Movie Maker 3.7.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\SmartIMF Manager 1.4.8.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\SoftmicaCalc 2.13.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\SpamAssassin for Win32 3.2.3.5.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\SpamRoute For Microsoft Outlook 4.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Speech Engine DLL SDK 5.05.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Splitter for Microsoft Access 4.2.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Sunsets and Sunscapes Screensaver 1.0.6.2634.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\SurfNoLimit 2.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\TakeYourBreak 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Task Coach 0.71.3.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\The DHL widget 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\The Magic 8-Ball 2.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Tiffany Thiessen 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Toolbar Chest for OE 1.01.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Toolbar Doubler for Word 6.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Trellian SubmitWolf 8.01.001.6881.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\TSW phpCoder 2008 1.00.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Tutto Su Nokia.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Tyba 1.0a.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Ultimate Shutdown 1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\unlock_mobile_imei_samsung_motorola_nokia.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Urban Dictionary Gadget 1.0.0.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\VMN Toolbar 1.6.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\W32.Bofra@mm free removal tool 1.0.1.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\WDISKINFO 0.99.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Web UI Credit Card Validator 1.3.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Weight Tracker 1.1.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Wondershare PPT to iPhone 4.7.0.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Xpdf 3.02pl2.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\Ypsilon 0.9.6.zip
Deleted ! - C:\Documents and Settings\Thomas\Application Data\m\shared\ZC Video Converter 1.9.1.zip
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\m\shared"
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\m"
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\drivers\srosa.sys"
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\drivers\srosa2.sys"
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\drivers\winupgro.exe"
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\102703.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\104812.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\105296.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\109265.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\110953.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\111625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\120406.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\122640.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\124765.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\125078.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\125109.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\126656.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\128031.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\129281.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\129656.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\130265.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\130984.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\131312.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\131484.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\132531.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\133593.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\134046.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\145000.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\146296.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\146687.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\152406.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\155484.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\156359.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\156796.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\161125.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\161875.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\162796.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\163171.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\178562.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\182765.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\190156.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\190875.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\191140.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\191187.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\192046.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\192390.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\194625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\197031.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\197046.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\197093.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\197734.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\198046.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\210031.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\210734.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\210796.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\211265.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\211328.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\213437.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\213546.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\216500.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\217140.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\217281.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\219750.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\225328.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\226812.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\227375.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\228562.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\229390.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\229875.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\231375.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\232843.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\233546.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\234125.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\235609.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\236921.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\238421.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\238703.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\239812.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\240500.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\240593.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\240937.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\246656.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\247625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\247953.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\249593.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\251093.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\251875.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\252875.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\254015.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\254671.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\259234.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\259625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\260015.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\260062.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\260546.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\260578.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\265125.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\266546.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\266625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\266828.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\268359.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\268375.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\277828.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\278421.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\282671.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\284015.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\284140.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\284703.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\285562.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\285750.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\285796.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\286312.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\287203.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\291187.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\292500.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\293031.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\293562.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\294031.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\294312.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\294625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\294750.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\295187.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\310015.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\310781.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\311171.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\322593.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\323359.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\323781.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\340734.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\342171.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\342843.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\343546.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\344343.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\344875.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\353859.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\361406.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\362187.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\362640.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\370500.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\375734.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\381156.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\381234.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\381781.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\385546.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\386921.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\387406.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\392703.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\394562.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\395171.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\411687.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\417312.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\419062.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\419500.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\420234.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\421234.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\421828.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\424515.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\425546.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\427031.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\427187.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\427281.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\427906.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\428296.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\428375.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\428609.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\428937.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\431296.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\433031.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\433390.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\440812.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\443078.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\443656.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\454125.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\454843.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\455140.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\46750.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\48625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\49078.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\49468.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\49593.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\504218.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\505468.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\505734.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\51234.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\513953.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\51453.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\51515.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\515156.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\516734.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\517281.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\51890.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\521531.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\523343.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\523812.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\52890.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\52906.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\529265.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\530062.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\530484.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\54437.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\555203.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\557359.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\558031.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\56281.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\56453.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\56687.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\56750.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\587234.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\58734.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\589625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\590359.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\590500.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\594484.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\599796.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\610234.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\610687.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\636421.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\648921.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\649437.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\649546.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\65312.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\68234.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\70296.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\70781.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\71250.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\72625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\73046.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\73078.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\74453.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\74890.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\75312.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\77625.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\78187.exe
Deleted ! - C:\Documents and Settings\Thomas\Application Data\drivers\downld\94812.exe
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\Thomas\Application Data\drivers"

»»»» Supression files in C:\DOCUME~1\Thomas\LOCALS~1\Temp

Deleted ! - C:\DOCUME~1\Thomas\LOCALS~1\Temp\R‚pertoire temporaire 1 pour PowerArchiver 2009 11.03.04.zip\patch.exe

»»»» Supression files in C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_1[3].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_1[4].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\mxd[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\4YMTY7YE\mxd[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\KD0QLPFB\mxd[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\S5STEN4E\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Content.IE5\UWT4E8RA\b64_3[1].jpg

--------------- [ Other deleting ] ----------------

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\Local AppWizard-Generated Applications\msnmsgr
Deleted ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\Local AppWizard-Generated Applications\patch
Deleted ! - HKEY_USERS\S-1-5-21-58335425-1314919033-11704206-1006\Software\Local AppWizard-Generated Applications\winupgro

--------------- [ States / Restarting of services ] ----------------

+- Safe boot mode restored !

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

+- deleting files :

--------------- [ Registry / Mountpoint2 ] ----------------

-> Not found !

--------------- [ Searching Cracks / Keygen ] ----------------

---------------- ! End of report ! ------------------

Réponse 5 / 36

Utilisateur anonyme

Re,

OK pour le rapport en MP.

Fait ceci maintenant:

==>Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

==>Double clique sur RSIT.exe pour lancer l'outil.

==>Clique sur ' continue ' à l'écran Disclaimer.

==>Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

==>Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Réponse 6 / 36

noctambule28 Messages postés 33382 Date d'inscription Statut Webmaster Dernière intervention 2 857

Bonjour

À Ajouter dans les canned :

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

(^_^)

Réponse 7 / 36

Utilisateur anonyme

Re,

OK.

ce sera inscrit..............

A++

Réponse 8 / 36

Utilisateur anonyme

log.txt :

Logfile of random's system information tool 1.05 (written by random/random)
Run by Thomas at 2008-12-19 18:32:21
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 62 GB (83%) free of 74 GB
Total RAM: 447 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:32:33, on 19/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Thomas\Bureau\RSIT.exe
C:\Program Files\trend micro\Thomas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.acer.com/worldwide/selection.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [icmuigq] "c:\windows\system32\icmuigq.exe" icmuigq
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E49A9FCB-FAA9-4C1F-A1C1-54920DA2CCA4} - http://scripts.dlv4.com/binaries/egauth4/egauth4_1052_FR_XP.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3E6970C-03D3-47AA-8B85-379843E29764}: NameServer = 80.253.149.1,80.10.246.3
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

Réponse 9 / 36

Utilisateur anonyme

Re,

▶ Installe NAVILOG1

Remarque concernant la détection de Navilog1 par certains programmes de sécurités :

▶ Certains fichiers de Navilog1.exe peuvent être considérés comme dangereux et donc supprimés ou neutralisés par certains programmes de sécurités. Ce sont des faux positifs et dans certains cas, vous serez amener à désactiver votre protection le temps du téléchargement/utilisation de Navilog1.
/ !\ Déconnecte toi du net et désactive ton antivirus et antispyware résident pour que Navilog1 puisse s'exécuter normalement. / !\

▶ Utilisateurs de Windows Vista :

* Afin que Navilog1 puisse fonctionner correctement, il est recommandé de désactiver l'UAC pendant l'utilisation de Navilog1 (Installation, Utilisation). N'oubliez pas dès l'utilisation de Navilog1 terminé à réactiver l'UAC sur votre Ordinateur.
comment faire pour désactiver l'UAC

* A chaque fois que vous êtes amené à exécuter Navilog1.bat ou Navilog1.exe pour l'installation, ne double-cliquez pas sur le fichier ou raccourci mais faites un clic droit dessus et dans le menu contextuel choisssez "Exécuter en tant qu'administrateur".

Le lancement de l'installation de Navilog1 se fait en exécutant Navilog1.exe

(Si vous avez téléchargé navilog1.zip, Veuillez auparavant décompresser ce fichier)

Une fois l'installation terminé, pour lancer le fix :

- en utilisant le raccourci crée sur le bureau : Navilog1

- Via le poste de travail, en exécutant le fichier Navilog1.bat se trouvant dans %program files%Navilog1

Après le choix de la langue et les messages d'avertissement, le menu s'affiche.

Faite le choix 1

Effectue la vérification du système à la recherche de l'adware. Un scan avec catchme de GMER est également éffectué pour Windows XP. Cette analyse peut durer une dizaine de minutes. Patientez alors jusqu'au message «Analyse terminée le ....». Appuyez sur une touche comme demandé et le bloc note va souvrir , Enregistrez-le sur votre disque. Puis Ouvrez-le et Copiez-Collez l'intégralité de ce rapport sur le forum qui vous l'auras demandé.

(si le bloc-note ne s'ouvre pas : Rendez-vous dans votre poste de travail, à la racine du disque C vous trouverez le rapport sous le nom de fixnavi.txt)

Attention : Ne lancez-pas la partie désinfection (choix 2, 3 ou 4) sans l'avis/accord express de l'Helper qui vous as pris en charge sur le forum d'aide ou vous aurez exposer votre problème.

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

Réponse 10 / 36

Utilisateur anonyme

Search Navipromo version 3.7.0 commencé le 19/12/2008 à 19:20:15,50

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor 3100+ )
BIOS : Award Modular BIOS v6.00PG
USER : Thomas ( Administrator )
BOOT : Normal boot

Antivirus : Trend Micro Internet Security 16.10.1183 (Activated)
Firewall : Pare-feu personnel de Trend Micro 5.2 (Activated)

C:\ (Local Disk) - NTFS - Total:72 Go (Free:59 Go)
D:\ (Local Disk) - FAT32 - Total:72 Go (Free:28 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit

*** Recherche dossiers dans "C:\WINDOWS" ***

*** Recherche dossiers dans "C:\Program Files" ***

...\HotTVPlayer trouvé !
...\Montorgueil trouvé !

*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Thomas\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Thomas\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Thomas\menudm~1\progra~1" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Thomas\locals~1\applic~1" *

*** Recherche fichiers ***

C:\WINDOWS\dialerexe.ini trouvé !
C:\WINDOWS\pack.epk trouvé !
C:\WINDOWS\tmlpcert2007 trouvé !
C:\WINDOWS\system32\nvs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"icmuigq"="\"c:\\windows\\system32\\icmuigq.exe\" icmuigq"

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

gqgwa_navfx.dat trouvé !
icmuigq.exe trouvé !
icmuigq.dat trouvé !
icmuigq_nav.dat trouvé !
icmuigq_navps.dat trouvé !
itaccess.exe trouvé !

* Dans "C:\Documents and Settings\Thomas\locals~1\applic~1" :

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :

*** Analyse terminée le 19/12/2008 à 19:24:08,50 ***

Réponse 11 / 36

Utilisateur anonyme

Re,

▶ Navilog1 option2

▶ Déconnecte toi du net et désactive ton antivirus et antispyware résident pour que Navilog1 puisse s'exécuter normalement.

▶ Double-clique sur le raccourci Navilog1 présent sur ton Bureau.

▶ Au menu principal, Fais le choix 2
Laisse toi guider et patiente.
Le fix va t'informer qu'il va alors redémarrer ton PC
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts.
Appuie sur une touche comme demandé.
(Si ton PC ne redémarre pas automatiquement, fais le toi même)
Au redémarrage de ton PC, choisis ta session habituelle si nécessaire.

▶ Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le Bloc-notes va s'ouvrir.
Sauvegarde le rapport sur ton Bureau de manière à le retrouver.
Referme le Bloc-notes. Ton Bureau va réapparaître

PS : Si ton Bureau ne réapparaît pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Cliques en haut à gauche sur fichiers et choisis "exécuter"
Tapes explorer et valides. Cela te fera apparaître ton Bureau

▶ Poste le rapport de Navilog1 (contenu du fichier navi2.txt) en réponse et dis moi si tu constates des améliorations.

/!\Pense à ré-activer ton antivirus et antispyware résident avant de te reconnecter sur "la toile"./!\

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

Réponse 12 / 36

Utilisateur anonyme

Clean Navipromo version 3.7.0 commencé le 19/12/2008 à 19:35:17,73

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor 3100+ )
BIOS : Award Modular BIOS v6.00PG
USER : Thomas ( Administrator )
BOOT : Normal boot

Antivirus : Trend Micro Internet Security 16.10.1183 (Activated)
Firewall : Pare-feu personnel de Trend Micro 5.2 (Activated)

C:\ (Local Disk) - NTFS - Total:72 Go (Free:59 Go)
D:\ (Local Disk) - FAT32 - Total:72 Go (Free:28 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

Mode suppression automatique
avec prise en charge résultats Catchme et GNS

Nettoyage exécuté au redémarrage de l'ordinateur

*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *

* Suppression dans "C:\Documents and Settings\Thomas\locals~1\applic~1" *

*** Suppression dossiers dans "C:\WINDOWS" ***

*** Suppression dossiers dans "C:\Program Files" ***

...\HotTVPlayer ...suppression...
...\HotTVPlayer supprimé !

...\Montorgueil ...suppression...
...\Montorgueil supprimé !

*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Thomas\applic~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Thomas\locals~1\applic~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Thomas\menudm~1\progra~1" ***

*** Suppression fichiers ***

C:\WINDOWS\dialerexe.ini supprimé !
C:\WINDOWS\pack.epk supprimé !
C:\WINDOWS\tmlpcert2007 supprimé !
C:\WINDOWS\system32\nvs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Thomas\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :

* Dans "C:\WINDOWS\system32" *

gqgwa_navfx.dat trouvé !
Copie gqgwa_navfx.dat réalisée avec succès !
gqgwa_navfx.dat supprimé !

icmuigq.exe trouvé !
Copie icmuigq.exe réalisée avec succès !
icmuigq.exe supprimé !

icmuigq.dat trouvé !
Copie icmuigq.dat réalisée avec succès !
icmuigq.dat supprimé !

icmuigq_nav.dat trouvé !
Copie icmuigq_nav.dat réalisée avec succès !
icmuigq_nav.dat supprimé !

icmuigq_navps.dat trouvé !
Copie icmuigq_navps.dat réalisée avec succès !
icmuigq_navps.dat supprimé !

C:\WINDOWS\prefetch\icmuigq*.pf trouvé !
Copie C:\WINDOWS\prefetch\icmuigq*.pf réalisée avec succès !
C:\WINDOWS\prefetch\icmuigq*.pf supprimé !

itaccess.exe trouvé !
Copie itaccess.exe réalisée avec succès !
itaccess.exe supprimé !

* Dans "C:\Documents and Settings\Thomas\locals~1\applic~1" *

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***

*** Nettoyage terminé le 19/12/2008 à 19:39:42,64 ***

Réponse 13 / 36

Utilisateur anonyme

Re,

Peu tu refaire un log RSIT.

==>Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

Réponse 14 / 36

Utilisateur anonyme

Logfile of random's system information tool 1.05 (written by random/random)
Run by Thomas at 2008-12-20 09:57:20
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 61 GB (83%) free of 74 GB
Total RAM: 447 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:57:21, on 20/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Thomas\Bureau\RSIT.exe
C:\Program Files\trend micro\Thomas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.acer.com/worldwide/selection.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3E6970C-03D3-47AA-8B85-379843E29764}: NameServer = 80.253.149.1,80.10.246.3
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

Réponse 15 / 36

Utilisateur anonyme

Re,

▶ Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

▶ Mets le à jour

▶ Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.

▶ Sélectionne Exécuter un examen complet si ce n'est pas déjà fait

▶ clique sur Rechercher

▶ Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

▶ Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

▶ Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

▶ Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

Réponse 16 / 36

Utilisateur anonyme

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1528
Windows 5.1.2600 Service Pack 3

21/12/2008 21:39:01
mbam-log-2008-12-21 (21-39-00).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 101264
Temps écoulé: 1 hour(s), 4 minute(s), 44 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Typelib\{95012afd-f4f1-4a96-bf3b-4f5d6c54d593} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{6C3CAB59-F87E-46DF-A7BC-F3653627E50C}\RP795\A0112083.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6C3CAB59-F87E-46DF-A7BC-F3653627E50C}\RP795\A0112125.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6C3CAB59-F87E-46DF-A7BC-F3653627E50C}\RP795\A0112156.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6C3CAB59-F87E-46DF-A7BC-F3653627E50C}\RP795\A0112189.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6C3CAB59-F87E-46DF-A7BC-F3653627E50C}\RP795\A0112219.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6C3CAB59-F87E-46DF-A7BC-F3653627E50C}\RP795\A0112256.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6C3CAB59-F87E-46DF-A7BC-F3653627E50C}\RP795\A0112367.sys (Worm.Bagel) -> Quarantined and deleted successfully.

Réponse 17 / 36

Utilisateur anonyme

Re,

Redémarre ton pc normalement et refait sa:

==>Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

==>Double clique sur RSIT.exe pour lancer l'outil.

==>Clique sur ' continue ' à l'écran Disclaimer.

==>Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

==>Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

Réponse 18 / 36

Utilisateur anonyme

J'ai le premier rapport mais pas le deuxieme, j'ai l'impression que HiJackThis ne se lance pas , dois je faire un scan moi meme ? (maintenant il fonctionne)

Logfile of random's system information tool 1.05 (written by random/random)
Run by Thomas at 2008-12-22 14:26:03
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 63 GB (85%) free of 74 GB
Total RAM: 447 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:26:03, on 22/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Thomas\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Thomas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.acer.com/worldwide/selection.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3E6970C-03D3-47AA-8B85-379843E29764}: NameServer = 80.253.149.1,80.10.246.3
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

Réponse 19 / 36

Utilisateur anonyme

Le rapport de HiJackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:36:31, on 22/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.acer.com/worldwide/selection.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.acer.com/worldwide/selection.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3E6970C-03D3-47AA-8B85-379843E29764}: NameServer = 80.253.149.1,80.10.246.3
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

Réponse 20 / 36

Utilisateur anonyme

Re,

Télécharge toolscleaner sur ton Bureau :

toolscleaner

▶ Double-clique sur ToolsCleaner2.exe et laisse le travailler

▶ Clique sur Recherche et laisse le scan se terminer.

▶ Clique sur Suppression pour finaliser.

T▶ u peux, si tu le souhaites, te servir des Options facultatives.

▶ Clique sur Quitter, pour que le rapport puisse se créer.

▶ Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
▶ Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

▶ Double clique sur RSIT.exe pour lancer l'outil.

▶ Clique sur ' continue ' à l'écran Disclaimer.

▶ Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

▶ Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

PC infecté, les applications ne marchent plus

36 réponses

Votre réponse