Dll32
Bonjour à tous,
J'ai un gros problème avec mon ordinateur, je n'arrive plus à me connecter à msn, ni à hotmail, ensuite, mes mises à jour ne se font plus (windows ne peut pas rechercher les mises à jour). Chaque fois que j'allume mon ordinateur, le message d'erreur indique qu'il ne trouve pas Run32Dll.
J'avais un virus Trojan, mon anti-virus (à savoir NOD32 là supprimé).
Je ne suis pas fort doué en informatique, je cherche depuis plusieurs jours et je n'ai rien trouvé. J'ai regardé sur ce site, j'ai essayé de télécharger le rundll32 en question, le problème reste inchangé.
J'ai aussi Ccleaner, j'ai fais le nettoyage comme il avait été recommandé dans d'autres forum venant de ce site, mais cela n'a rien changé.
Voilà, j'ai l'impression d'avoir tout essayé, alors je vous demande votre aide. Ce serait fort aimable si quelqu'un pouvait m'aider.
J'ai un gros problème avec mon ordinateur, je n'arrive plus à me connecter à msn, ni à hotmail, ensuite, mes mises à jour ne se font plus (windows ne peut pas rechercher les mises à jour). Chaque fois que j'allume mon ordinateur, le message d'erreur indique qu'il ne trouve pas Run32Dll.
J'avais un virus Trojan, mon anti-virus (à savoir NOD32 là supprimé).
Je ne suis pas fort doué en informatique, je cherche depuis plusieurs jours et je n'ai rien trouvé. J'ai regardé sur ce site, j'ai essayé de télécharger le rundll32 en question, le problème reste inchangé.
J'ai aussi Ccleaner, j'ai fais le nettoyage comme il avait été recommandé dans d'autres forum venant de ce site, mais cela n'a rien changé.
Voilà, j'ai l'impression d'avoir tout essayé, alors je vous demande votre aide. Ce serait fort aimable si quelqu'un pouvait m'aider.
Configuration: Windows Vista Internet Explorer 7.0
21 réponses
-
Logfile of random's system information tool 1.06 (written by random/random)
Run by User at 2009-06-25 12:33:50
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 54 GB (59%) free of 92 GB
Total RAM: 2046 MB (44% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:16, on 25/06/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Windows\ASScrPro.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Imaging\bin\hpqtra08.exe
C:\Users\User\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\User\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\User\Downloads\RSIT.exe
C:\Program Files\trend micro\User.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.asus.com/fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: is-K92E8.lnk = C:\Users\User\Virus Removal Tool\is-K92E8\startup.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\User\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-be.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
-
Contributeur sécuritéDésolé pour la retard, fais moi ceci :
Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
- Double-clique sur RSIT.exe afin de lancer le programme.
- Clique sur Continue à l'écran Disclaimer.
- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : Les rapports sont sauvegardés dans le dossier C:\rsit.
-
Que dois-je faire maintenant? les mises à jour ne se font tjrs pas, et je n'arrive tjrs pas à me connecter à msn
-
Désolé de la durée qu'il m'a fallu pour répondre, je suis en plein examen et donc voilà peu de temps.
J'ai cependant fait l'analyse ac le programme. Il n'a rien trouvé.
Quelle est la marche à suivre maintenant? -
Contributeur sécuritéok tu peux vider la quarantaine de SAS puis faire ceci afin de voir s'il reste des virus, a demain,
Télécharger AVPTool
La page qui vous accueille comporte en général les 12 dernières versions générées. Regardez attentivement l'heure et la date affichées dans le nom du logiciel pour déterminer celle qui est la plus récente. Téléchargez-la sans hésiter sur le bureau de votre PC. Double-cliquez dessus pour lancez l'installation.
Attention : AVPTool (tout comme d'autres outils du même acabit tels que Antivir, BitDefender Free, etc.) n'est pas une protection. C'est un détecteur et un nettoyeur d'infections déjà présentes sur le PC. Pour vous protéger efficacement contre les menaces modernes que sont les Drive-by Downloads, les Stage Downloads, les Banking Trojans, les Webstorms, il faut disposer d'authentiques suites de sécurité comme Kaspersky Antivirus 8.0 (KAV) ou Kaspersky Internet Security 8.0 (KIS).
AVPTool fonctionne sous Windows 2000, XP, Vista 32 bits. Il ne doit pas être utilisé sur des machines déjà équipées de KAV 8.0 ou KIS 8.0.
-
SUPERAntiSpyware Scan Log
https://www.superantispyware.com/
Generated 05/26/2009 at 07:52 PM
Application Version : 4.26.1002
Core Rules Database Version : 3909
Trace Rules Database Version: 1853
Scan type : Complete Scan
Total Scan Time : 01:04:46
Memory items scanned : 446
Memory threats detected : 2
Registry items scanned : 7710
Registry threats detected : 0
File items scanned : 91241
File threats detected : 22
Adware.Vundo/Variant-MSFake
C:\USERS\USER\APPDATA\ROAMING\MICROSOFT\LIVE SEARCH\NOTIFICATION-LIVESEARCH.EXE
C:\USERS\USER\APPDATA\ROAMING\MICROSOFT\LIVE SEARCH\NOTIFICATION-LIVESEARCH.EXE
C:\USERS\USER\APPDATA\ROAMING\MICROSOFT\LIVE SEARCH\MISE-A-JOUR-LIVESEARCH.EXE
C:\USERS\USER\APPDATA\ROAMING\MICROSOFT\LIVE SEARCH\MISE-A-JOUR-LIVESEARCH.EXE
C:\USERS\USER\APPDATA\ROAMING\MICROSOFT\LIVE SEARCH\SUPPRESSION-LIVE-SEARCH.EXE
Adware.Tracking Cookie
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ad.yieldmanager[1].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.rtl[2].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@adserver.sevenload[2].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@adtech[1].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@atdmt[2].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@bluestreak[1].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@content.yieldmanager.edgesuite[1].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@content.yieldmanager[2].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@content.yieldmanager[3].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@doubleclick[1].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@doubleclick[3].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@gettyimages.122.2o7[1].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@partypoker[2].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@sales.liveperson[1].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@sales.liveperson[3].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@smartadserver[2].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@tradedoubler[2].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@weborama[1].txt
C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@xiti[1].txt -
Contributeur sécuritéparfait c'est bien. Maintenant on va vérifier spyware, adware, trojans, vers, keylogger, hijacker, dialer et toutes autres menaces destinées au vol d'informations confidentielles avec ceci :
Télécharge Superantispyware (SAS)
Choisis "enregistrer" et enregistre-le sur ton bureau.
Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.
Créé une icône sur le bureau.
Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.
- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
- Sous Configuration and Préférences, clique sur le bouton "Préférences"
- Clique sur l'onglet "Scanning Control "
- Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :
Close browsers before scanning (Fermer Navigateur avant le scan)
Scan for tracking cookies (Scan pour dépister les cookies)
Terminate memory threats before quarantining (Terminez les menaces de mémoire avant de mettre en quarantaine)
- Laisse les autres lignes décochées.
- Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.
- Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".
Dans la colonne de gauche, coche C:\Fixed Drive.
Dans la colonne de droite, sous "Complète scan", clique sur "Perform Complète Scan"
Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.
A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.
Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".
Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.
Pour recopier les informations sur le forum, fais ceci :
- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Préférences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SuperAntiSpyware Scan Log.
- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.
- Copie son contenu dans ta réponse.
Regarde bien le tuto SuperAntiSpyware il est très bien expliqué.
-
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2166
Windows 6.0.6001 Service Pack 1
24/05/2009 19:39:53
mbam-log-2009-05-24 (19-39-53).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 172790
Temps écoulé: 7 hour(s), 59 minute(s), 20 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\RegTool (Rogue.RegTool) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté) -
Contributeur sécuritétu peux me refaire un scan malware, car celui je ne sais pas s'il à vraiment été supprimé : HKEY_CURRENT_USER\SOFTWARE\RegTool (Rogue.RegTool) -> Not selected for removal.
-
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2166
Windows 6.0.6001 Service Pack 1
23/05/2009 13:57:27
mbam-log-2009-05-23 (13-57-27).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 172153
Temps écoulé: 2 hour(s), 1 minute(s), 56 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 208
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\RegTool (Rogue.RegTool) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\RegTool (Rogue.RegTool) -> Not selected for removal.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dll (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\Logs (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050 (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\Results (Rogue.RegTool) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Users\User\AppData\Roaming\RegTool\spy_ignore.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\Logs\2009-05-17 21-42-380.log (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\Logs\2009-05-17 22-02-260.log (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\filelist.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-0.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-1.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-10.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-100.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-101.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-102.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-103.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-104.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-105.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-106.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-107.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-108.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-109.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-11.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-110.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-111.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-112.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-113.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-114.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-115.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-116.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-117.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-118.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-119.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-12.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-120.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-121.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-122.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-123.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-124.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-125.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-126.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-127.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-128.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-129.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-13.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-130.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-131.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-132.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-133.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-134.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-135.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-136.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-137.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-138.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-139.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-14.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-140.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-141.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-142.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-143.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-144.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-145.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-146.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-147.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-148.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-149.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-15.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-150.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-151.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-152.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-153.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-154.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-155.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-156.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-157.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-158.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-159.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-16.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-160.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-161.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-162.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-163.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-164.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-165.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-166.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-167.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-168.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-169.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-17.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-170.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-171.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-172.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-173.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-174.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-175.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-176.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-177.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-178.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-179.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-18.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-180.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-181.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-182.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-183.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-184.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-185.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-186.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-187.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-188.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-189.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-19.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-190.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-191.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-192.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-193.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-194.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-195.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-196.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-197.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-198.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-2.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-20.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-21.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-22.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-23.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-24.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-25.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-26.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-27.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-28.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-29.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-3.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-30.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-31.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-32.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-33.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-34.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-35.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-36.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-37.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-38.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-39.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-4.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-40.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-41.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-42.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-43.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-44.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-45.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-46.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-47.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-48.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-49.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-5.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-50.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-51.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-52.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-53.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-54.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-55.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-56.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-57.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-58.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-59.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-6.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-60.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-61.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-62.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-63.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-64.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-65.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-66.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-67.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-68.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-69.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-7.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-70.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-71.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-72.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-73.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-74.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-75.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-76.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-77.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-78.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-79.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-8.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-80.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-81.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-82.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-83.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-84.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-85.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-86.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-87.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-88.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-89.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-9.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-90.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-91.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-92.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-93.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-94.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-95.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-96.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-97.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-98.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\QuarantineW\2009-05-17 21-52-050\regb-99.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\Results\Evidence.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\Results\Junk.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\Results\Registry.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Roaming\RegTool\Results\Update.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Windows\Tasks\RegTool Scan.job (Rogue.RegTool) -> Quarantined and deleted successfully. -
Contributeur sécuritéok rien non plus, donc tu vas me faire ceci :
▶ Télécharge malwarebyte's anti-malware
▶ Un tutoriel sera à ta disposition pour l'installer et l'utiliser correctement.
▶ Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
▶ Lance une analyse complète en cliquant sur "Exécuter un examen complet"
▶ Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
▶ L'analyse peut durer un bon moment.....
▶ Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
▶ Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
▶ Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum
* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée
-
que dois-je faire mtn?
-
Rapport GenProc 2.566 [2]
@ mer. 20/05/2009 à 10:51:12
@ Windows Vista Service Pack 1
GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :
Poste un rapport NanoScan https://www.micro-astuce.com/securite/NanoScan-Panda.php
----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
---------------------------------------------------------------------- -
Contributeur sécuritérien non plus c'est déjà bon signe. Ensuite tu va me faire ceci :
Télécharge GenProc sur ton bureau
Double-clique sur GenProc.exe
et poste le contenu du rapport qui s'ouvre à la suite de la question êtes vous aider par quelqu'un, répondre oui. Merci.
Si pas de rapport .txt, regarder sur le bureau, il doit y avoir une icône Genproc qui renvoie sur internet avec la procédure.
Voir comment utiliser GenProc
Pour ceux qui ont Vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs
IMPORTANT : Poste la procédure Genproc et ne fais rien d'autre pour l'instant ( souvent il faut ajouter des consignes à la manipe indiquée pour que cela fonctionne parfaitement )
-
############################## [ UsbFix V3.022 # Scan ]
# User : User (Administrateurs) # PC-DE-USER
# Update on 19/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 20:43:16 | 19/05/2009
# Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz
# Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 64-bit) # Service Pack 1
# Internet Explorer 7.0.6001.18000
# Windows Firewall Status : Disabled
# C:\ # Disque fixe local # 89,43 Go (53,47 Go free) [VistaOS] # NTFS
# D:\ # Disque fixe local # 52,78 Go (24,48 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM
############################## [ Processus actifs ]
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\ASScrPro.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Windows\System32\ACEngSvr.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Windows\System32\rundll32.exe
C:\Users\User\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\User\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\wbem\wmiprvse.exe
################## [ Registre # Startup ]
HKLM_logon: "Userinit"="C:\\Windows\\system32\\userinit.exe,"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: Windows Defender=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
HKLM_Run: NeroFilterCheck=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
HKLM_Run: InCD=C:\Program Files\Nero\Nero 7\InCD\InCD.exe
HKLM_Run: RtHDVCpl=RtHDVCpl.exe
HKLM_Run: Skytel=Skytel.exe
HKLM_Run: ATKMEDIA=C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
HKLM_Run: CognizanceTS=rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
HKLM_Run: ASUS Screen Saver Protector=C:\Windows\ASScrPro.exe
HKLM_Run: RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
HKLM_Run: HP Software Update=C:\Program Files\HP Software Update\HPWuSchd2.exe
HKLM_Run: NvSvc=RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
HKLM_Run: NvCplDaemon=RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM_Run: NvMediaCenter=RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM_Run: egui="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
HKLM_Run: IAAnotif="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: Sidebar=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKCU_Run: MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
HKCU_Run: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
HKCU_Run: ehTray.exe=C:\Windows\ehome\ehTray.exe
HKCU_Run: Orb="C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
HKCU_Run: dll=rundll32 dll32,sm
HKCU_Run: Uniblue RegistryBooster 2009=c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
HKLM_Explo: "NoDriveTypeAutoRun"=dword:0000001c
################## [ Fichiers # Dossiers infectieux ]
################## [ Registre # Clés Run infectieuses ]
################## [ Registre # Mountpoints2 ]
HKCU\...\Explorer\MountPoints2\{9b6b1eeb-3dc8-11dd-9c8e-001d60c6f388}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{9b6b1ef4-3dc8-11dd-9c8e-001d60c6f388}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{9b6b1f30-3dc8-11dd-9c8e-001d60c6f388}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{9b6b1f3e-3dc8-11dd-9c8e-001d60c6f388}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{bed30f50-e7af-11dc-bdae-001d60c6f388}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{c211a890-21c0-11de-8c1a-001d60c6f388}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{c211a890-21c0-11de-8c1a-001d60c6f388}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{fc8b2dd8-3cbb-11de-ba88-001d60c6f388}\Shell\AutoRun\Command
################## [ ! Fin du rapport # UsbFix V3.022 ! ] -
Contributeur sécuritéil n'a rien trouvé, ensuite fais ceci :
désactiver L'UAC avant utilisation de UsbFix.
Voici un tuto : http://pagesperso-orange.fr/FindyKill.Ad.Remover/uac_vista.html
Telecharge et install UsbFix de C_XX & Chiquitine29
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
# Fais un clic droit sur le raccourci UsbFix présent sur ton bureau et choisi éxécuter en tant qu'administrateur .
# Choisi l option 1 ( Recherche )
# Laisse travailler l outil.
# Ensuite post le rapport UsbFix.txt qui apparaitra.
# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
# Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
-
############################## [ FindyKill V4.729 ]
# User : User (Administrateurs) # PC-DE-USER
# Update on 19/05/09 by Chiquitine29
# Start at: 20:21:42 | 19/05/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html
# Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz
# Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 64-bit) # Service Pack 1
# Internet Explorer 7.0.6001.18000
# Windows Firewall Status : Enabled
# C:\ # Disque fixe local # 89,43 Go (53,48 Go free) [VistaOS] # NTFS
# D:\ # Disque fixe local # 52,78 Go (24,48 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM
############################## [ Processus actifs ]
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\ASScrPro.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Windows\System32\ACEngSvr.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Windows\System32\rundll32.exe
C:\Users\User\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\User\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wuauclt.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
################## [ Fichiers / Dossiers infectieux ]
################## [ Infected Temp Files ]
################## [ Registre / Clés infectieuses ]
################## [ Recherche dans supports amovibles]
################## [ Registre / Mountpoints2 ]
# -> Not found !
################## [ ! Fin du rapport # FindyKill V4.729 ! ] -
Contributeur sécuritéDésactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
▶ Vas dans "Démarrer" puis Panneau de configuration.
▶ Double Clique sur l'icône Comptes d'utilisateurs et sur Activer ou désactiver le contrôle des comptes d'utilisateurs.
▶ Clique sur Continuer.
▶ Décoche la case Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur.
▶ Valide par OK et redémarre le PC.
▶ Telecharge maintenant FindyKill sur ton bureau :
▶ tutoriel installation
▶ tutoriel recherche
/!\ Ne fait pas le nettoyage tout dessuite /!\
▶ Lance l installation avec les parametres par default
▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
▶ Fais un clic droit sur le raccourci FindyKill sur ton bureau
▶ Choisi "Executer en tant qu administrateur"
▶ Au menu principal,choisi l option 1 (Recherche)
▶ Post le rapport FindyKill.txt
* Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
-
Description
run32.dll est un fichier de bibliothèque qui fournit la fonction pour exécuter un fichier dll comme application.
Recommandation
run32.dll si soyez handicapé, requis pour des applications essentielles pour travailler correctement.. On lui recommande fortement à Courez un balayage libre d'exécution pour optimiser automatiquement la mémoire, arrangements d'unité centrale de traitement et d'Internet.
ICI pour scané ton " run32.dll" :
http://www.liutilities.com/products/campaigns/affiliate/cb/offer/dllfiles/rb/
Ici pour téléchargé le fichier RUN32.DLL non infecté :
https://www.dll-files.com/run32.dll.html -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:48:47, on 19/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\ASScrPro.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Digital Imaging\bin\hpqtra08.exe
C:\Users\User\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\User\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\wuauclt.exe
D:\FirefoxPortable\App\firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [dll] rundll32 dll32,sm
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\User\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-be.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
- 1
- 2
Suivant
