############################## [ UsbFix V3.030 | Cleaning ]
# User : Administrateur (Administrateurs) # STANDARD
# Update on 12/06/09 by Chiquitine29, C_XX & Chimay8
# WebSite :
http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 01:05:57 | 12/06/2009
# Intel(R) Pentium(R) 4 CPU 1700MHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Enabled
# AV : AntiVir Desktop 9.0.1.26 [ (!) Disabled | (!) Outdated ]
# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 14,33 Go (12,86 Go free) # NTFS
# D:\ # Disque fixe local # 12,38 Go (6,62 Go free) # NTFS
# E:\ # Disque fixe local # 11,63 Go (8,9 Go free) # NTFS
# F:\ # Disque CD-ROM
# G:\ # Disque CD-ROM
############################## [ Processus actifs ]
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## [ Fichiers # Dossiers infectieux ]
Deleted ! C:\WINDOWS\system32\win.exe
Deleted ! C:\WINDOWS\system32\winjpg.jpg
Deleted ! C:\winfile.jpg
Deleted ! C:\autorun.inf
Deleted ! D:\winfile.jpg
Deleted ! D:\autorun.inf
Deleted ! E:\winfile.jpg
Deleted ! E:\autorun.inf
################## [ Registre # Clés Run infectieuses ]
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "CTFMON"
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "regdiit"
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\dwwin.exe
# HKLM\software\microsoft\security center\\ "AntiVirusOverride" # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "UpdatesDisableNotify" # -> Reset sucessfully !
################## [ Registre # Mountpoints2 ]
Deleted ! HKCU\...\Explorer\MountPoints2\{9fade921-5697-11de-a2b8-806d6172696f}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{9fade922-5697-11de-a2b8-806d6172696f}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{9fade923-5697-11de-a2b8-806d6172696f}\Shell\AutoRun\Command
################## [ Listing des fichiers présent ]
[12/06/2009 00:28|--a------|2193] - C:\Ad-Report-CLEAN.log
[12/06/2009 00:19|--a------|723] - C:\Ad-Report-SCAN.log
[12/06/2009 00:34|--a------|2193] - C:\Ad-Report.log
[11/06/2009 15:19|--a------|0] - C:\AUTOEXEC.BAT
[11/06/2009 15:13|---hs----|212] - C:\boot.ini
[28/09/2001 15:00|-rahs----|4952] - C:\Bootfont.bin
[11/06/2009 15:19|--a------|0] - C:\CONFIG.SYS
[11/06/2009 15:19|-rahs----|0] - C:\IO.SYS
[11/06/2009 15:19|-rahs----|0] - C:\MSDOS.SYS
[03/08/2004 23:38|-rahs----|47564] - C:\NTDETECT.COM
[03/08/2004 23:59|-rahs----|251712] - C:\ntldr
[?|?|?] - C:\pagefile.sys
[12/06/2009 01:07|--a------|3892] - C:\UsbFix.txt
[08/05/2009 18:55|--a------|913102] - D:\Photo003.JPG
[17/06/2008 12:30|--a------|8710144] - E:\ںé لںç، ںéمںéï، éڑ«©، ںé©«يé ê¥ê§ éî ںééى مéïى ي«éê.doc
################## [ Vaccination ]
# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# D:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# E:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
################## [ ! Fin du rapport # UsbFix V3.030 ! ]
======= RAPPORT D'AD-REMOVER 1.1.4.5_H | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 11/06/2009 à 3:50 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 0:23:23, 12/06/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 2 v5.1.2600
Nom du PC: STANDARD | Utilisateur actuel: Administrateur
.
Administrateur: Administrateur
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité *Desactive*
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ةLةMENT(S) NEUTRALISة(S) ==============
.
.
.
(!) -- Fichiers temporaires supprimés.
.
============== Scan additionnel ==============
.
.
.
* Internet Explorer Version 6.0.2900.2180 *
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.freewebtown.com/blackooh/BlaCk-TiMeind3x.html.html
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
============== Suspect (Cracks, Serials ... ) ==============
.
+---------------------------------------------------------------------------+
1931 Octet(s) - C:\Ad-Report-CLEAN.log
723 Octet(s) - C:\Ad-Report-SCAN.log
17 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
Fin à: 0:28:36 | 12/06/2009
.
============== E.O.F ==============
.