A voir également:
- Probleme avec win32/heur..malwarebytes
- Télécharger malwarebytes - Télécharger - Antivirus & Antimalwares
- Malwarebytes adwcleaner - Télécharger - Antivirus & Antimalwares
- Win32:bogent - Forum Virus
- Trojan win32 - Forum Virus
- Puabundler win32 - Forum Virus
69 réponses
Utilisateur anonyme
19 août 2009 à 11:04
19 août 2009 à 11:04
sur ton bureau tu as un dossier qui s'appelle "crack" et bien change le nom de ce dossier tout simplement
Jai un mal fou a répondre, tout ce que j'écrit n'apparait jamais sur le forum, je ne sais pas si cest mon ordi ou le site du forum mais ca lague sérieusement depuis hier. J'ai mon rapport pret et les explication entourant mon dossier crack et mon impossibilité de le renommer mais je ne peux jamais te l'envoyer , ca bogue a chaque fois
ce que je vais essayer de faire cest tenvoyer le rapport en 2 partie car je sens que cest ce qui fait boguer le forum, premiere partie ce qui semble normal...le reste cest tout ce qui concerne mon dossier crack que je ne peux pas renommer du au fait que je ne peux pas cliquer sur quoi que ce soit dans mon bureau, je clique mais rien ne se passe. Bref je tenvoie ca
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
--------------------\\ Lop S&D 4.2.5-0 XP/Vista
Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz )
BIOS : BIOS Date: 07/03/07 10:01:10 Ver: 08.00.12
USER : Propriétaire ( Not Administrator ! )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.0 (Activated)
C:\ (Local Disk) - NTFS - Total:298 Go (Free:143 Go)
D:\ (CD or DVD) - UDF - Total:2 Go (Free:0 Go)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 2009-08-18|21:13 )
[ UAC => 1 ]
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\GalaPlayer.zip
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\nsdFF94.tmp
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\nsfAE72.tmp
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\nsi3FAF.tmp
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\nswE19F.tmp
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BitDownload\BitDownload Downloads.lnk
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BitDownload\BitDownload Uninstall.lnk
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BitDownload\BitDownload.lnk
Supprime! - C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies\propriétaire@partypoker[2].txt
Supprime! - C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies\propriétaire@888[2].txt
Supprime! - C:\ProgramData\More Fast Error.rld1k2m
Supprime! - C:\ProgramData\Move Mix Mix.47ldx94
Supprime! - C:\ProgramData\Move Mix Mix.va17z75
Supprime! - C:\ProgramData\Move Mix Mix.wahvmkl
Supprime! - C:\ProgramData\Drv Audio Dog About
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BitDownload
-
[ Fichier Hosts ] .. Restaure!
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans Local
[2008-12-21|10:44] C:\Users\PROPRI~1\AppData\Local\Adobe
[2007-08-28|15:31] C:\Users\PROPRI~1\AppData\Local\Ahead
[2007-08-27|11:15] C:\Users\PROPRI~1\AppData\Local\Application Data
[2008-08-09|19:42] C:\Users\PROPRI~1\AppData\Local\BitLord
[2008-09-04|10:30] C:\Users\PROPRI~1\AppData\Local\d3d9caps.dat
[2009-08-05|22:20] C:\Users\PROPRI~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-08-17|22:45] C:\Users\PROPRI~1\AppData\Local\Downloaded Installations
[2009-04-21|07:54] C:\Users\PROPRI~1\AppData\Local\GDIPFONTCACHEV1.DAT
[2007-08-30|21:13] C:\Users\PROPRI~1\AppData\Local\Google
[2007-08-27|11:15] C:\Users\PROPRI~1\AppData\Local\Historique
[2009-08-18|11:14] C:\Users\PROPRI~1\AppData\Local\IconCache.db
[2008-09-02|12:00] C:\Users\PROPRI~1\AppData\Local\Microsoft
[2009-04-26|20:11] C:\Users\PROPRI~1\AppData\Local\Microsoft Games
[2007-08-30|09:13] C:\Users\PROPRI~1\AppData\Local\Microsoft Help
[2008-11-09|14:28] C:\Users\PROPRI~1\AppData\Local\Mozilla
[2009-01-03|21:49] C:\Users\PROPRI~1\AppData\Local\PokerStars.NET
[2008-07-13|19:49] C:\Users\PROPRI~1\AppData\Local\Real
[2008-01-20|23:19] C:\Users\PROPRI~1\AppData\Local\Scansoft
[2009-08-18|21:13] C:\Users\PROPRI~1\AppData\Local\Temp
[2007-08-27|11:15] C:\Users\PROPRI~1\AppData\Local\Temporary Internet Files
[2008-08-16|20:08] C:\Users\PROPRI~1\AppData\Local\TorrentMan
[2007-09-17|19:13] C:\Users\PROPRI~1\AppData\Local\VirtualStore
--------------------\\ Tâches planifiées dans C:\Windows\tasks
[2009-08-18 10:05][--a------] C:\Windows\tasks\ParetoLogic Registration.job
[2009-08-18 10:05][--a------] C:\Windows\tasks\ParetoLogic Anti-Virus PLUS_dbsummary.job
[2009-08-18 10:05][--a------] C:\Windows\tasks\ParetoLogic Update Version2.job
[2009-08-17 22:50][--a------] C:\Windows\tasks\ParetoLogic Anti-Virus PLUS.job
[2009-08-18 20:38][--ah-----] C:\Windows\tasks\SA.DAT
[2009-08-18 15:03][--a------] C:\Windows\tasks\SCHEDLGU.TXT
--------------------\\ Listing des dossiers dans C:\ProgramData
[2008-10-06|18:45] C:\ProgramData\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
[2009-04-05|11:55] C:\ProgramData\Adobe
[2009-05-07|13:50] C:\ProgramData\Ahead
[2006-11-02|09:02] C:\ProgramData\Application Data
[2009-08-13|09:10] C:\ProgramData\avg8
[2008-01-13|10:08] C:\ProgramData\Brother
[2007-08-27|11:13] C:\ProgramData\Bureau
[2007-08-28|15:32] C:\ProgramData\CyberLink
[2006-11-02|09:02] C:\ProgramData\Desktop
[2006-11-02|09:02] C:\ProgramData\Documents
[2008-09-28|12:18] C:\ProgramData\DVD Shrink
[2008-08-17|18:48] C:\ProgramData\ezsidmv.dat
[2007-08-27|11:13] C:\ProgramData\Favoris
[2006-11-02|09:02] C:\ProgramData\Favorites
[2007-08-30|21:13] C:\ProgramData\Google
[2008-01-13|10:10] C:\ProgramData\InstallShield
[2007-09-17|19:11] C:\ProgramData\Laconic Software
[2008-08-02|12:42] C:\ProgramData\Logishrd
[2007-09-05|20:20] C:\ProgramData\Logitech
[2009-08-13|09:49] C:\ProgramData\Malwarebytes
[2007-08-27|11:13] C:\ProgramData\Menu D‚marrer
[2009-03-18|19:35] C:\ProgramData\Microsoft
[2009-08-12|23:57] C:\ProgramData\Microsoft Help
[2007-08-27|11:13] C:\ProgramData\ModŠles
[2009-05-07|13:46] C:\ProgramData\Nero
[2008-12-21|19:03] C:\ProgramData\NOS
[2009-05-12|12:26] C:\ProgramData\Noun itch rule
[2008-09-04|10:32] C:\ProgramData\NVIDIA
[2009-08-17|22:45] C:\ProgramData\ParetoLogic
[2009-08-17|22:45] C:\ProgramData\ParetoLogic Anti-Virus PLUS
[2008-07-13|19:49] C:\ProgramData\Real
[2009-06-28|12:09] C:\ProgramData\ScanSoft
[2008-08-17|18:47] C:\ProgramData\Skype
[2006-11-02|09:02] C:\ProgramData\Start Menu
[2008-09-28|12:02] C:\ProgramData\TEMP
[2006-11-02|09:02] C:\ProgramData\Templates
[2009-08-13|21:32] C:\ProgramData\WindowsSearch
[2008-04-04|14:23] C:\ProgramData\WinZip
[2008-03-05|15:10] C:\ProgramData\WLInstaller
[2007-10-02|16:07] C:\ProgramData\Xerox
--------------------\\ Listing des dossiers dans C:\Program Files
[2008-12-18|10:06] C:\Program Files\Adobe
[2007-08-27|11:46] C:\Program Files\Attansic
[2008-07-21|11:08] C:\Program Files\AVG
[2008-11-09|09:31] C:\Program Files\BitComet
[2008-08-09|20:07] C:\Program Files\BitLord2
[2008-01-13|10:13] C:\Program Files\Brother
[2009-08-17|22:45] C:\Program Files\Common Files
[2008-08-09|19:32] C:\Program Files\Conduit
[2009-04-15|07:56] C:\Program Files\Cryptload
[2007-08-27|12:09] C:\Program Files\CyberLink
[2008-04-24|22:14] C:\Program Files\Druide
[2008-09-28|12:16] C:\Program Files\DVD Shrink
[2008-11-19|17:15] C:\Program Files\EA Sports
[2008-09-28|12:02] C:\Program Files\EasyDVDShrink
[2007-09-17|19:13] C:\Program Files\Fantastic Flame Screensaver
[2007-08-27|11:13] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[2007-08-30|21:13] C:\Program Files\Google
[2007-08-27|11:54] C:\Program Files\Grisoft
[2008-09-14|16:03] C:\Program Files\InstallShield Installation Information
[2007-08-27|11:36] C:\Program Files\Intel
[2009-08-17|17:21] C:\Program Files\Internet Explorer
[2008-07-21|11:20] C:\Program Files\Java
[2008-03-24|19:51] C:\Program Files\K-Lite Codec Pack
[2007-08-27|23:29] C:\Program Files\LimeWire
[2009-04-15|17:54] C:\Program Files\Logitech
[2009-08-13|09:49] C:\Program Files\Malwarebytes' Anti-Malware
[2009-03-18|19:37] C:\Program Files\Microsoft
[2008-02-26|17:17] C:\Program Files\Microsoft ActiveSync
[2007-08-30|20:59] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2006-11-02|08:37] C:\Program Files\Microsoft Games
[2008-02-04|21:25] C:\Program Files\Microsoft Office
[2009-07-31|02:15] C:\Program Files\Microsoft Silverlight
[2009-03-18|19:32] C:\Program Files\Microsoft SQL Server Compact Edition
[2009-03-18|19:35] C:\Program Files\Microsoft Sync Framework
[2007-08-27|12:00] C:\Program Files\Microsoft Visual Studio
[2007-08-27|12:00] C:\Program Files\Microsoft Works
[2007-08-27|12:00] C:\Program Files\Microsoft.NET
[2008-07-02|21:43] C:\Program Files\Movie Maker
[2009-06-28|17:16] C:\Program Files\Mozilla Firefox
[2006-11-02|08:37] C:\Program Files\MSBuild
[2008-01-21|11:25] C:\Program Files\MSXML 4.0
[2007-08-27|12:07] C:\Program Files\Nero
[2008-12-21|19:03] C:\Program Files\NOS
[2008-10-20|13:48] C:\Program Files\Novixys Software
[2008-01-13|10:11] C:\Program Files\Nuance
[2007-09-19|12:42] C:\Program Files\OpenOffice.org 2.2
[2009-08-17|22:45] C:\Program Files\ParetoLogic
[2008-09-28|11:55] C:\Program Files\PCFriendly
[2009-05-07|13:22] C:\Program Files\PokerStars.NET
[2008-02-18|22:29] C:\Program Files\Project64 1.6
[2008-07-13|10:43] C:\Program Files\Real
[2008-07-13|19:49] C:\Program Files\Real Alternative
[2007-08-27|11:53] C:\Program Files\Realtek
[2006-11-02|08:37] C:\Program Files\Reference Assemblies
[2008-09-14|16:03] C:\Program Files\Rockstar Games
[2008-01-13|10:09] C:\Program Files\ScanSoft
[2007-09-17|19:10] C:\Program Files\Screensavers.com
[2008-08-17|18:47] C:\Program Files\Skype
[2008-05-08|01:20] C:\Program Files\SurfingEnhancer
[2008-08-09|19:32] C:\Program Files\TorrentMan
[2009-08-18|10:38] C:\Program Files\Trend Micro
[2006-11-02|09:01] C:\Program Files\Uninstall Information
[2009-05-07|14:06] C:\Program Files\VSO
[2008-07-02|21:43] C:\Program Files\Windows Calendar
[2008-07-02|21:43] C:\Program Files\Windows Collaboration
[2008-07-02|21:43] C:\Program Files\Windows Defender
[2008-07-02|21:43] C:\Program Files\Windows Journal
[2009-03-18|19:37] C:\Program Files\Windows Live
[2009-03-18|19:29] C:\Program Files\Windows Live SkyDrive
[2009-07-16|10:41] C:\Program Files\Windows Mail
[2009-03-12|09:57] C:\Program Files\Windows Media Player
[2007-08-27|11:13] C:\Program Files\Windows NT
[2008-07-02|21:43] C:\Program Files\Windows Photo Gallery
[2008-07-02|21:43] C:\Program Files\Windows Sidebar
[2008-10-06|18:50] C:\Program Files\WinRAR
[2008-04-04|14:25] C:\Program Files\WinZip
--------------------\\ Listing des dossiers dans C:\Program Files\Common Files
[2009-04-05|11:55] C:\Program Files\Common Files\Adobe
[2009-05-07|13:49] C:\Program Files\Common Files\Ahead
[2008-02-26|17:17] C:\Program Files\Common Files\Designer
[2008-01-13|10:09] C:\Program Files\Common Files\InstallShield
[2007-08-27|23:12] C:\Program Files\Common Files\Java
[2008-08-02|12:43] C:\Program Files\Common Files\LogiShrd
[2009-03-06|08:22] C:\Program Files\Common Files\microsoft shared
[2009-08-17|22:45] C:\Program Files\Common Files\ParetoLogic
[2008-07-13|19:47] C:\Program Files\Common Files\Real
[2008-01-13|10:09] C:\Program Files\Common Files\ScanSoft Shared
[2006-11-02|07:18] C:\Program Files\Common Files\Services
[2008-08-17|18:47] C:\Program Files\Common Files\Skype
[2006-11-02|07:18] C:\Program Files\Common Files\SpeechEngines
[2008-07-02|21:43] C:\Program Files\Common Files\System
[2009-03-18|18:58] C:\Program Files\Common Files\Windows Live
[2008-03-05|15:12] C:\Program Files\Common Files\WindowsLiveInstaller
--------------------\\ Process
( 67 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-18 21:13:26
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 216
Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz )
BIOS : BIOS Date: 07/03/07 10:01:10 Ver: 08.00.12
USER : Propriétaire ( Not Administrator ! )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.0 (Activated)
C:\ (Local Disk) - NTFS - Total:298 Go (Free:143 Go)
D:\ (CD or DVD) - UDF - Total:2 Go (Free:0 Go)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB)
"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 2009-08-18|21:13 )
[ UAC => 1 ]
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\GalaPlayer.zip
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\nsdFF94.tmp
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\nsfAE72.tmp
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\nsi3FAF.tmp
Supprime! - C:\Users\PROPRI~1\AppData\Local\Temp\nswE19F.tmp
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BitDownload\BitDownload Downloads.lnk
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BitDownload\BitDownload Uninstall.lnk
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BitDownload\BitDownload.lnk
Supprime! - C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies\propriétaire@partypoker[2].txt
Supprime! - C:\Users\PROPRI~1\AppData\Roaming\MICROS~1\Windows\Cookies\propriétaire@888[2].txt
Supprime! - C:\ProgramData\More Fast Error.rld1k2m
Supprime! - C:\ProgramData\Move Mix Mix.47ldx94
Supprime! - C:\ProgramData\Move Mix Mix.va17z75
Supprime! - C:\ProgramData\Move Mix Mix.wahvmkl
Supprime! - C:\ProgramData\Drv Audio Dog About
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\BitDownload
-
[ Fichier Hosts ] .. Restaure!
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
--------------------\\ Listing des dossiers dans Local
[2008-12-21|10:44] C:\Users\PROPRI~1\AppData\Local\Adobe
[2007-08-28|15:31] C:\Users\PROPRI~1\AppData\Local\Ahead
[2007-08-27|11:15] C:\Users\PROPRI~1\AppData\Local\Application Data
[2008-08-09|19:42] C:\Users\PROPRI~1\AppData\Local\BitLord
[2008-09-04|10:30] C:\Users\PROPRI~1\AppData\Local\d3d9caps.dat
[2009-08-05|22:20] C:\Users\PROPRI~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-08-17|22:45] C:\Users\PROPRI~1\AppData\Local\Downloaded Installations
[2009-04-21|07:54] C:\Users\PROPRI~1\AppData\Local\GDIPFONTCACHEV1.DAT
[2007-08-30|21:13] C:\Users\PROPRI~1\AppData\Local\Google
[2007-08-27|11:15] C:\Users\PROPRI~1\AppData\Local\Historique
[2009-08-18|11:14] C:\Users\PROPRI~1\AppData\Local\IconCache.db
[2008-09-02|12:00] C:\Users\PROPRI~1\AppData\Local\Microsoft
[2009-04-26|20:11] C:\Users\PROPRI~1\AppData\Local\Microsoft Games
[2007-08-30|09:13] C:\Users\PROPRI~1\AppData\Local\Microsoft Help
[2008-11-09|14:28] C:\Users\PROPRI~1\AppData\Local\Mozilla
[2009-01-03|21:49] C:\Users\PROPRI~1\AppData\Local\PokerStars.NET
[2008-07-13|19:49] C:\Users\PROPRI~1\AppData\Local\Real
[2008-01-20|23:19] C:\Users\PROPRI~1\AppData\Local\Scansoft
[2009-08-18|21:13] C:\Users\PROPRI~1\AppData\Local\Temp
[2007-08-27|11:15] C:\Users\PROPRI~1\AppData\Local\Temporary Internet Files
[2008-08-16|20:08] C:\Users\PROPRI~1\AppData\Local\TorrentMan
[2007-09-17|19:13] C:\Users\PROPRI~1\AppData\Local\VirtualStore
--------------------\\ Tâches planifiées dans C:\Windows\tasks
[2009-08-18 10:05][--a------] C:\Windows\tasks\ParetoLogic Registration.job
[2009-08-18 10:05][--a------] C:\Windows\tasks\ParetoLogic Anti-Virus PLUS_dbsummary.job
[2009-08-18 10:05][--a------] C:\Windows\tasks\ParetoLogic Update Version2.job
[2009-08-17 22:50][--a------] C:\Windows\tasks\ParetoLogic Anti-Virus PLUS.job
[2009-08-18 20:38][--ah-----] C:\Windows\tasks\SA.DAT
[2009-08-18 15:03][--a------] C:\Windows\tasks\SCHEDLGU.TXT
--------------------\\ Listing des dossiers dans C:\ProgramData
[2008-10-06|18:45] C:\ProgramData\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
[2009-04-05|11:55] C:\ProgramData\Adobe
[2009-05-07|13:50] C:\ProgramData\Ahead
[2006-11-02|09:02] C:\ProgramData\Application Data
[2009-08-13|09:10] C:\ProgramData\avg8
[2008-01-13|10:08] C:\ProgramData\Brother
[2007-08-27|11:13] C:\ProgramData\Bureau
[2007-08-28|15:32] C:\ProgramData\CyberLink
[2006-11-02|09:02] C:\ProgramData\Desktop
[2006-11-02|09:02] C:\ProgramData\Documents
[2008-09-28|12:18] C:\ProgramData\DVD Shrink
[2008-08-17|18:48] C:\ProgramData\ezsidmv.dat
[2007-08-27|11:13] C:\ProgramData\Favoris
[2006-11-02|09:02] C:\ProgramData\Favorites
[2007-08-30|21:13] C:\ProgramData\Google
[2008-01-13|10:10] C:\ProgramData\InstallShield
[2007-09-17|19:11] C:\ProgramData\Laconic Software
[2008-08-02|12:42] C:\ProgramData\Logishrd
[2007-09-05|20:20] C:\ProgramData\Logitech
[2009-08-13|09:49] C:\ProgramData\Malwarebytes
[2007-08-27|11:13] C:\ProgramData\Menu D‚marrer
[2009-03-18|19:35] C:\ProgramData\Microsoft
[2009-08-12|23:57] C:\ProgramData\Microsoft Help
[2007-08-27|11:13] C:\ProgramData\ModŠles
[2009-05-07|13:46] C:\ProgramData\Nero
[2008-12-21|19:03] C:\ProgramData\NOS
[2009-05-12|12:26] C:\ProgramData\Noun itch rule
[2008-09-04|10:32] C:\ProgramData\NVIDIA
[2009-08-17|22:45] C:\ProgramData\ParetoLogic
[2009-08-17|22:45] C:\ProgramData\ParetoLogic Anti-Virus PLUS
[2008-07-13|19:49] C:\ProgramData\Real
[2009-06-28|12:09] C:\ProgramData\ScanSoft
[2008-08-17|18:47] C:\ProgramData\Skype
[2006-11-02|09:02] C:\ProgramData\Start Menu
[2008-09-28|12:02] C:\ProgramData\TEMP
[2006-11-02|09:02] C:\ProgramData\Templates
[2009-08-13|21:32] C:\ProgramData\WindowsSearch
[2008-04-04|14:23] C:\ProgramData\WinZip
[2008-03-05|15:10] C:\ProgramData\WLInstaller
[2007-10-02|16:07] C:\ProgramData\Xerox
--------------------\\ Listing des dossiers dans C:\Program Files
[2008-12-18|10:06] C:\Program Files\Adobe
[2007-08-27|11:46] C:\Program Files\Attansic
[2008-07-21|11:08] C:\Program Files\AVG
[2008-11-09|09:31] C:\Program Files\BitComet
[2008-08-09|20:07] C:\Program Files\BitLord2
[2008-01-13|10:13] C:\Program Files\Brother
[2009-08-17|22:45] C:\Program Files\Common Files
[2008-08-09|19:32] C:\Program Files\Conduit
[2009-04-15|07:56] C:\Program Files\Cryptload
[2007-08-27|12:09] C:\Program Files\CyberLink
[2008-04-24|22:14] C:\Program Files\Druide
[2008-09-28|12:16] C:\Program Files\DVD Shrink
[2008-11-19|17:15] C:\Program Files\EA Sports
[2008-09-28|12:02] C:\Program Files\EasyDVDShrink
[2007-09-17|19:13] C:\Program Files\Fantastic Flame Screensaver
[2007-08-27|11:13] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[2007-08-30|21:13] C:\Program Files\Google
[2007-08-27|11:54] C:\Program Files\Grisoft
[2008-09-14|16:03] C:\Program Files\InstallShield Installation Information
[2007-08-27|11:36] C:\Program Files\Intel
[2009-08-17|17:21] C:\Program Files\Internet Explorer
[2008-07-21|11:20] C:\Program Files\Java
[2008-03-24|19:51] C:\Program Files\K-Lite Codec Pack
[2007-08-27|23:29] C:\Program Files\LimeWire
[2009-04-15|17:54] C:\Program Files\Logitech
[2009-08-13|09:49] C:\Program Files\Malwarebytes' Anti-Malware
[2009-03-18|19:37] C:\Program Files\Microsoft
[2008-02-26|17:17] C:\Program Files\Microsoft ActiveSync
[2007-08-30|20:59] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2006-11-02|08:37] C:\Program Files\Microsoft Games
[2008-02-04|21:25] C:\Program Files\Microsoft Office
[2009-07-31|02:15] C:\Program Files\Microsoft Silverlight
[2009-03-18|19:32] C:\Program Files\Microsoft SQL Server Compact Edition
[2009-03-18|19:35] C:\Program Files\Microsoft Sync Framework
[2007-08-27|12:00] C:\Program Files\Microsoft Visual Studio
[2007-08-27|12:00] C:\Program Files\Microsoft Works
[2007-08-27|12:00] C:\Program Files\Microsoft.NET
[2008-07-02|21:43] C:\Program Files\Movie Maker
[2009-06-28|17:16] C:\Program Files\Mozilla Firefox
[2006-11-02|08:37] C:\Program Files\MSBuild
[2008-01-21|11:25] C:\Program Files\MSXML 4.0
[2007-08-27|12:07] C:\Program Files\Nero
[2008-12-21|19:03] C:\Program Files\NOS
[2008-10-20|13:48] C:\Program Files\Novixys Software
[2008-01-13|10:11] C:\Program Files\Nuance
[2007-09-19|12:42] C:\Program Files\OpenOffice.org 2.2
[2009-08-17|22:45] C:\Program Files\ParetoLogic
[2008-09-28|11:55] C:\Program Files\PCFriendly
[2009-05-07|13:22] C:\Program Files\PokerStars.NET
[2008-02-18|22:29] C:\Program Files\Project64 1.6
[2008-07-13|10:43] C:\Program Files\Real
[2008-07-13|19:49] C:\Program Files\Real Alternative
[2007-08-27|11:53] C:\Program Files\Realtek
[2006-11-02|08:37] C:\Program Files\Reference Assemblies
[2008-09-14|16:03] C:\Program Files\Rockstar Games
[2008-01-13|10:09] C:\Program Files\ScanSoft
[2007-09-17|19:10] C:\Program Files\Screensavers.com
[2008-08-17|18:47] C:\Program Files\Skype
[2008-05-08|01:20] C:\Program Files\SurfingEnhancer
[2008-08-09|19:32] C:\Program Files\TorrentMan
[2009-08-18|10:38] C:\Program Files\Trend Micro
[2006-11-02|09:01] C:\Program Files\Uninstall Information
[2009-05-07|14:06] C:\Program Files\VSO
[2008-07-02|21:43] C:\Program Files\Windows Calendar
[2008-07-02|21:43] C:\Program Files\Windows Collaboration
[2008-07-02|21:43] C:\Program Files\Windows Defender
[2008-07-02|21:43] C:\Program Files\Windows Journal
[2009-03-18|19:37] C:\Program Files\Windows Live
[2009-03-18|19:29] C:\Program Files\Windows Live SkyDrive
[2009-07-16|10:41] C:\Program Files\Windows Mail
[2009-03-12|09:57] C:\Program Files\Windows Media Player
[2007-08-27|11:13] C:\Program Files\Windows NT
[2008-07-02|21:43] C:\Program Files\Windows Photo Gallery
[2008-07-02|21:43] C:\Program Files\Windows Sidebar
[2008-10-06|18:50] C:\Program Files\WinRAR
[2008-04-04|14:25] C:\Program Files\WinZip
--------------------\\ Listing des dossiers dans C:\Program Files\Common Files
[2009-04-05|11:55] C:\Program Files\Common Files\Adobe
[2009-05-07|13:49] C:\Program Files\Common Files\Ahead
[2008-02-26|17:17] C:\Program Files\Common Files\Designer
[2008-01-13|10:09] C:\Program Files\Common Files\InstallShield
[2007-08-27|23:12] C:\Program Files\Common Files\Java
[2008-08-02|12:43] C:\Program Files\Common Files\LogiShrd
[2009-03-06|08:22] C:\Program Files\Common Files\microsoft shared
[2009-08-17|22:45] C:\Program Files\Common Files\ParetoLogic
[2008-07-13|19:47] C:\Program Files\Common Files\Real
[2008-01-13|10:09] C:\Program Files\Common Files\ScanSoft Shared
[2006-11-02|07:18] C:\Program Files\Common Files\Services
[2008-08-17|18:47] C:\Program Files\Common Files\Skype
[2006-11-02|07:18] C:\Program Files\Common Files\SpeechEngines
[2008-07-02|21:43] C:\Program Files\Common Files\System
[2009-03-18|18:58] C:\Program Files\Common Files\Windows Live
[2008-03-05|15:12] C:\Program Files\Common Files\WindowsLiveInstaller
--------------------\\ Process
( 67 Processes )
... OK !
--------------------\\ Recherche avec S_Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Recherche de Fichiers / Dossiers Lop
Aucun fichier / dossier Lop trouvé !
--------------------\\ Verification du Registre
..... OK !
--------------------\\ Verification du fichier Hosts
Fichier Hosts PROPRE
--------------------\\ Recherche de fichiers avec Catchme
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-18 21:13:26
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 216
Utilisateur anonyme
19 août 2009 à 20:24
19 août 2009 à 20:24
supprime list'em , retelecharge-le et repasse l'option 1 stp
List'em by g3n-h@ckm@n 1.0.2.6
updated on 20.08.2009 ::::: 00.30
Microsoft Windows [version 6.0.6001]
2009-08-20 1:10:17,33
Nom de l'h“te: PC-DE-PROPRITA
Nom du systŠme d'exploitation: Microsoft© Windows VistaT dition Familiale Premium
Version du systŠme: 6.0.6001 Service Pack 1 version 6001
Fabricant du systŠme d'exploitation: Microsoft Corporation
Configuration du systŠme d'exploitation: Station de travail autonome
Type de version du systŠme d'exploitation: Multiprocessor Free
Propri‚taire enregistr‚: Propri‚taire
Organisation enregistr‚e:
Identificateur de produit: 89578-OEM-7359731-05079
Date d'installation originale: 2007-08-27, 11:11:23
Heure de d‚marrage du systŠme: 2009-08-20, 01:01:37
Fabricant du systŠme: System manufacturer
ModŠle du systŠme: P5K
Type du systŠme: X86-based PC
Processeur(s): 1 processeur(s) install‚(s).
[01]ÿ: x64 Family 6 Model 15 Stepping 11 GenuineIntel ~1998 MHz
Version du BIOS: American Megatrends Inc. 0603 , 2007-07-03
R‚pertoire Windows: C:\Windows
R‚pertoire systŠme: C:\Windows\system32
P‚riph‚rique d'amor‡age: \Device\HarddiskVolume1
Option r‚gionale du systŠme: fr-ca;Fran‡ais (Canada)
ParamŠtres r‚gionaux d'entr‚e: en-ca;Anglais (Canada)
Fuseau horaire: (GMT-05:00) Est (.-U. et Canada)
M‚moire physique totale: 2ÿ046 Mo
M‚moire physique disponible: 981 Mo
Fichier d'‚changeÿ: taille maximale: 4ÿ340 Mo
Fichier d'‚changeÿ: disponible: 3ÿ172 Mo
Fichier d'‚changeÿ: en cours d'utilisation: 1ÿ168 Mo
Emplacements des fichiers d'‚change: C:\pagefile.sys
Domaine: WORKGROUP
Serveur d'ouverture de session: \\PC-DE-PROPRITA
Correctif(s): 24 Corrections install‚es.
[01]: {AC76BA86-7AD7-0000-2550-7A8C40000912} -
[02]: {DA256408-A2E7-41A5-8AD6-62ACB86A0FD7}
[03]: {106E7A1C-22DA-42D7-8E74-37772A9C89FB}
[04]: {17342715-5BEE-452F-BDA4-D088DE65EF7E}
[05]: {1BF24D79-2C2C-4BE7-BC24-5BD2D9FA8EA0}
[06]: {1DF482EC-3BD7-4E2F-9DEE-DAF308063753}
[07]: {4D072D56-B07B-4798-97B2-B9E7A4F53EAC}
[08]: {5472718D-B0C6-4A1C-BE1C-B0C596556E10}
[09]: {5F4B6C81-64E8-4B16-A932-1C444E1BA970}
[10]: {60556C49-6363-4A37-B4E4-2F6DB6C65567}
[11]: {6A6A5A40-FB6D-402C-8516-CC61E6DFE524}
[12]: {923D89F2-B3D7-4530-8165-309F1DE72706}
[13]: {B945219C-C51C-4BD0-BAD5-A3FED95B555F}
[14]: {C37F9508-39A3-4B7E-947E-F8C69EC8A180}
[15]: {C602034B-0E04-4A4C-994B-9BE7AEFF5931}
[16]: {CEB1A88D-195D-4350-A550-C6807B1BBB17}
[17]: {D3EFC280-3E7E-45E8-AA78-6FC148A08B62}
[18]: {F5001920-E94E-4287-80C6-158FBC1D7035}
[19]: {FA111F3D-A299-438D-A61F-2E8D5138D1D2}
[20]: {32971938-65B1-4B38-B483-9A32560B7CF2}
[21]: {385D6D1A-7D4B-41BA-ACCD-39B9CA14F562}
[22]: {B0AEF410-04FF-4AEC-8D8E-C9427C38BBCD}
[23]: {9DFD0865-4E0F-4947-A77D-43D58782A57F}
[24]: {D7C5B9DC-6E4C-4DEE-9A7B-4183DA4DC1C2}
Carte(s) r‚seau: 1 carte(s) r‚seau install‚e(s).
[01]: Attansic L1 Gigabit Ethernet 10/100/1000Base-T Controller
Nom de la connexionÿ: Connexion au r‚seau local
DHCP activ‚ÿ: Oui
Serveur DHCPÿ: 192.168.0.1
Adresse(s) IP
[01]: 192.168.0.100
[02]: fe80::402c:f9e9:816a:9887
Nom de l'image PID Nom de la sessio Num‚ro de s Utilisation
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 Ko
System 4 Services 0 98ÿ404 Ko
smss.exe 424 Services 0 564 Ko
csrss.exe 520 Services 0 3ÿ464 Ko
wininit.exe 568 Services 0 3ÿ180 Ko
csrss.exe 584 Console 1 12ÿ884 Ko
winlogon.exe 620 Console 1 4ÿ360 Ko
services.exe 664 Services 0 4ÿ496 Ko
lsass.exe 680 Services 0 6ÿ792 Ko
lsm.exe 688 Services 0 3ÿ412 Ko
svchost.exe 1048 Services 0 5ÿ768 Ko
nvvsvc.exe 1092 Services 0 2ÿ868 Ko
svchost.exe 1120 Services 0 5ÿ632 Ko
svchost.exe 1156 Services 0 12ÿ620 Ko
svchost.exe 1248 Services 0 14ÿ396 Ko
svchost.exe 1272 Services 0 54ÿ696 Ko
svchost.exe 1284 Services 0 179ÿ796 Ko
audiodg.exe 1368 Services 0 3ÿ012 Ko
SLsvc.exe 1400 Services 0 5ÿ828 Ko
svchost.exe 1428 Services 0 9ÿ892 Ko
svchost.exe 1544 Services 0 15ÿ812 Ko
spoolsv.exe 1732 Services 0 6ÿ476 Ko
svchost.exe 1756 Services 0 11ÿ340 Ko
rundll32.exe 1924 Console 1 4ÿ712 Ko
taskeng.exe 560 Services 0 5ÿ000 Ko
avgwdsvc.exe 816 Services 0 2ÿ616 Ko
LVComSer.exe 856 Services 0 5ÿ016 Ko
LVPrcSrv.exe 956 Services 0 3ÿ928 Ko
IoctlSvc.exe 2036 Services 0 2ÿ316 Ko
svchost.exe 2008 Services 0 3ÿ928 Ko
SeaPort.exe 1216 Services 0 6ÿ372 Ko
svchost.exe 1012 Services 0 5ÿ740 Ko
svchost.exe 888 Services 0 1ÿ960 Ko
avgrsx.exe 2212 Services 0 17ÿ712 Ko
LVComSer.exe 2752 Console 1 4ÿ604 Ko
taskeng.exe 2812 Console 1 9ÿ200 Ko
dwm.exe 3052 Console 1 4ÿ404 Ko
explorer.exe 3128 Console 1 28ÿ236 Ko
MSASCui.exe 3484 Console 1 2ÿ328 Ko
RtHDVCpl.exe 3516 Console 1 5ÿ028 Ko
pptd40nt.exe 3676 Console 1 3ÿ304 Ko
wmpnscfg.exe 3932 Console 1 4ÿ280 Ko
wmpnetwk.exe 3996 Services 0 17ÿ704 Ko
unsecapp.exe 772 Console 1 4ÿ140 Ko
WmiPrvSE.exe 2496 Services 0 4ÿ852 Ko
BrMfcWnd.exe 3012 Console 1 5ÿ556 Ko
avgtray.exe 3244 Console 1 1ÿ332 Ko
Communications_Helper.exe 3308 Console 1 7ÿ636 Ko
Quickcam.exe 3392 Console 1 8ÿ268 Ko
rundll32.exe 2944 Console 1 3ÿ864 Ko
sidebar.exe 3644 Console 1 8ÿ520 Ko
Gestionnaire Antidote.exe 3716 Console 1 3ÿ048 Ko
ehtray.exe 1244 Console 1 1ÿ400 Ko
GoogleToolbarNotifier.exe 2744 Console 1 1ÿ944 Ko
msnmsgr.exe 1380 Console 1 10ÿ000 Ko
BrccMCtl.exe 3860 Console 1 16ÿ448 Ko
ehmsas.exe 496 Console 1 3ÿ892 Ko
COCIManager.exe 2764 Console 1 8ÿ284 Ko
ieuser.exe 312 Console 1 18ÿ868 Ko
iexplore.exe 2076 Console 1 181ÿ636 Ko
msiexec.exe 4768 Services 0 9ÿ156 Ko
wltuser.exe 5140 Console 1 7ÿ108 Ko
FlashUtil10b.exe 4956 Console 1 4ÿ984 Ko
infocard.exe 5480 Services 0 12ÿ160 Ko
WmiPrvSE.exe 4916 Services 0 12ÿ044 Ko
wuauclt.exe 3144 Console 1 5ÿ392 Ko
TrustedInstaller.exe 2604 Services 0 8ÿ468 Ko
List_Killem.exe 4456 Console 1 5ÿ728 Ko
cmd.exe 4372 Console 1 3ÿ008 Ko
WmiPrvSE.exe 2624 Services 0 5ÿ368 Ko
tasklist.exe 3660 Console 1 4ÿ848 Ko
Infections :
========
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Program Files\BitLord"
"C:\Program Files\FBrowsingAdvisor"
"C:\Program Files\PlayMP3z"
C:\Users\Propri‚taire\LOCAL Settings\Temp\BitLord-v2.0-Installer.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate01.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate02.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\Installe.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\Install_WLMessenger.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\mirc632.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\mirc635.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\TorrentManToolbar.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\wlsetup-cvr.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\_is70BC.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\_unps.exe
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings
"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser"
HKEY_CURRENT_USER\SOFTWARE\PlayMP3
¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch :
7035551.TMP-7CC32C74.pf
7035645.TMP-E5A73480.pf
7035738.TMP-3B358207.pf
ACROBROKER.EXE-8BC3F433.pf
AgAppLaunch.db
AgCx_S1_S-1-5-21-4017860491-3366806851-76704201-1000.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgCx_SC3_CB986082.db
AGENTSVR.EXE-2DB83BDE.pf
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-4017860491-3366806851-76704201-1000.db
AgGlUAD_P_S-1-5-21-4017860491-3366806851-76704201-501.db
AgGlUAD_S-1-5-21-4017860491-3366806851-76704201-1000.db
AgGlUAD_S-1-5-21-4017860491-3366806851-76704201-501.db
AgRobust.db
ATBROKER.EXE-FF58B71D.pf
AVGCFGEX.EXE-54CEEB00.pf
AVGCMGR.EXE-556E623C.pf
AVGCSRVX.EXE-82C246DD.pf
AVGNSX.EXE-D53DAA4F.pf
AVGSRMAX.EXE-4B50ECB6.pf
AVGUI.EXE-97BB505D.pf
AVGUPD.EXE-2AF460D4.pf
AVGWSC.EXE-49F51870.pf
BITLORD.EXE-E856D3D1.pf
BRMFCMON.EXE-AABE8E4B.pf
CALC.EXE-AC08706A.pf
CMD.EXE-89305D47.pf
COCIMANAGER.EXE-24AD6BC2.pf
CONSENT.EXE-65F6206D.pf
CONTROL.EXE-9459D5A0.pf
CSRSS.EXE-8C04D631.pf
DEFRAG.EXE-738093E8.pf
DFRGNTFS.EXE-4F838A89.pf
DLLHOST.EXE-01BB85F0.pf
DLLHOST.EXE-6202E8F2.pf
DLLHOST.EXE-71214090.pf
DLLHOST.EXE-7D2183B8.pf
DLLHOST.EXE-875FC13D.pf
DLLHOST.EXE-893DDF55.pf
DLLHOST.EXE-8AF42443.pf
DLLHOST.EXE-928474CF.pf
DLLHOST.EXE-C5C55E89.pf
DWM.EXE-AEABE78B.pf
EHMSAS.EXE-6BE9D904.pf
EXPLORER.EXE-7A3328DA.pf
FIXCFG.EXE-67406AF4.pf
FLASHUTIL10B.EXE-4AA9BDDC.pf
FREE.MOVIE.LICENSE[1].EXE-5F7BEA27.pf
GAMMADVD.EXE-02F09C20.pf
GOOGLETOOLBAR1USER.EXE-7F556BE2.pf
GOOGLETOOLBARNOTIFIER.EXE-30287F94.pf
HELPPANE.EXE-D1016F9E.pf
HIJACKTHIS.EXE-4187566C.pf
HJTINSTALL[1].EXE-4626974B.pf
IEUSER.EXE-D895AB54.pf
IEXPLORE.EXE-1B894AFB.pf
INFOCARD.EXE-0C9B4CAB.pf
Layout.ini
LIMEWIRE.EXE-7CCD1B8D.pf
LISTEM.EXE-54490B62.pf
LOGITECHUPDATE.EXE-A45F17F1.pf
LOGONUI.EXE-1BEE4A84.pf
LULNCHR.EXE-B4187A87.pf
LVCOMSER.EXE-74C0B0CF.pf
LVPRCSRV.EXE-E0306B6B.pf
MBAM-SETUP.EXE-FE9DE4FB.pf
MBAM-SETUP.TMP-9BB3CFDD.pf
MBAM-SETUP.TMP-9F7F9592.pf
MBAM.EXE-CD3441D7.pf
MBAMGUI.EXE-00780130.pf
MCUPDATE.EXE-AF07FDE6.pf
MFPMP.EXE-73140A33.pf
MINESWEEPER.EXE-64897C84.pf
MIRC.EXE-144490BE.pf
MODE.COM-0F3F3F6D.pf
MPAS-D.EXE-C74E749D.pf
MPCMDRUN.EXE-BB72ED6F.pf
MPLAYERC.EXE-8335E260.pf
MPSIGSTUB.EXE-743CD36E.pf
MPSIGSTUB.EXE-E51C1B8B.pf
MRT.EXE-C3C3D3DA.pf
MRTSTUB.EXE-22E72F09.pf
MSASCUI.EXE-6465DB72.pf
MSIEXEC.EXE-B5AFA339.pf
MSNMSGR.EXE-DD43BBF4.pf
NOTEPAD.EXE-EB1B961A.pf
NTOSBOOT-B00DFAAD.pf
OFFICELIVESIGNIN.EXE-3E8ACCCB.pf
PDMSETUP.EXE-CEC10DD5.pf
PfSvPerfStats.bin
POQEXEC.EXE-CFF63269.pf
POWERPNT.EXE-C30F94F3.pf
ReadyBoot
REG.EXE-26976709.pf
REGISTERIEPKEYS.EXE-A8651B1E.pf
REGSVR32.EXE-55A4EE79.pf
RUNDLL32.EXE-905D47B9.pf
RUNDLL32.EXE-9497DC51.pf
RUNDLL32.EXE-B9EF4314.pf
RUNDLL32.EXE-CE557EE2.pf
RUNDLL32.EXE-F452D79D.pf
SEARCHFILTERHOST.EXE-1FE91C16.pf
SEARCHFILTERHOST.EXE-AA7A1FDD.pf
SEARCHINDEXER.EXE-77D27BAC.pf
SEARCHPROTOCOLHOST.EXE-AFAD3EF9.pf
SETDEPNX.EXE-0520665A.pf
SETIEINSTALLEDDATE.EXE-A2F270A3.pf
SETUP.EXE-E3E06AE2.pf
SETUP1.EXE-081676FF.pf
SETUP_WM.EXE-4A6000A5.pf
SMSS.EXE-1DCD0EB1.pf
SNDVOL.EXE-783DCB11.pf
SSVAGENT.EXE-AE309E15.pf
SSVAGENT.EXE-C26271B1.pf
ST6UNST.EXE-D8E422D8.pf
SVCHOST.EXE-8FD92526.pf
SVCHOST.EXE-E2D30E5C.pf
TASKENG.EXE-5BAF290C.pf
TASKMGR.EXE-72398DC0.pf
TRUSTEDINSTALLER.EXE-031B6478.pf
UNSECAPP.EXE-CD982D99.pf
UNZIXWIN.EXE-53733B29.pf
USERINIT.EXE-F39AB672.pf
VERCLSID.EXE-4D95F5A7.pf
VSSVC.EXE-04D079CC.pf
WERCON.EXE-FE5CD389.pf
WERFAULT.EXE-B7E27BE5.pf
WERMGR.EXE-2A1BCBC7.pf
WINDOWS-KB890830-V2.13-DELTA.-9464FE4E.pf
WINZIP32.EXE-D7CC28A7.pf
WLCOMM.EXE-648065CA.pf
WLLOGINPROXY.EXE-E9051163.pf
WLTUSER.EXE-A6CDB501.pf
WMIADAP.EXE-369DF1CD.pf
WMIPRVSE.EXE-43972D0F.pf
WMPLAYER.EXE-9DE758AE.pf
WMPNETWK.EXE-BD0344CA.pf
WMPNSCFG.EXE-DF1DD51A.pf
WMPSHARE.EXE-73C9F24C.pf
WUAUCLT.EXE-830BCC14.pf
WUIESETUP_PREREQ.EXE-69ADC0D0.pf
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
updated on 20.08.2009 ::::: 00.30
Microsoft Windows [version 6.0.6001]
2009-08-20 1:10:17,33
Nom de l'h“te: PC-DE-PROPRITA
Nom du systŠme d'exploitation: Microsoft© Windows VistaT dition Familiale Premium
Version du systŠme: 6.0.6001 Service Pack 1 version 6001
Fabricant du systŠme d'exploitation: Microsoft Corporation
Configuration du systŠme d'exploitation: Station de travail autonome
Type de version du systŠme d'exploitation: Multiprocessor Free
Propri‚taire enregistr‚: Propri‚taire
Organisation enregistr‚e:
Identificateur de produit: 89578-OEM-7359731-05079
Date d'installation originale: 2007-08-27, 11:11:23
Heure de d‚marrage du systŠme: 2009-08-20, 01:01:37
Fabricant du systŠme: System manufacturer
ModŠle du systŠme: P5K
Type du systŠme: X86-based PC
Processeur(s): 1 processeur(s) install‚(s).
[01]ÿ: x64 Family 6 Model 15 Stepping 11 GenuineIntel ~1998 MHz
Version du BIOS: American Megatrends Inc. 0603 , 2007-07-03
R‚pertoire Windows: C:\Windows
R‚pertoire systŠme: C:\Windows\system32
P‚riph‚rique d'amor‡age: \Device\HarddiskVolume1
Option r‚gionale du systŠme: fr-ca;Fran‡ais (Canada)
ParamŠtres r‚gionaux d'entr‚e: en-ca;Anglais (Canada)
Fuseau horaire: (GMT-05:00) Est (.-U. et Canada)
M‚moire physique totale: 2ÿ046 Mo
M‚moire physique disponible: 981 Mo
Fichier d'‚changeÿ: taille maximale: 4ÿ340 Mo
Fichier d'‚changeÿ: disponible: 3ÿ172 Mo
Fichier d'‚changeÿ: en cours d'utilisation: 1ÿ168 Mo
Emplacements des fichiers d'‚change: C:\pagefile.sys
Domaine: WORKGROUP
Serveur d'ouverture de session: \\PC-DE-PROPRITA
Correctif(s): 24 Corrections install‚es.
[01]: {AC76BA86-7AD7-0000-2550-7A8C40000912} -
[02]: {DA256408-A2E7-41A5-8AD6-62ACB86A0FD7}
[03]: {106E7A1C-22DA-42D7-8E74-37772A9C89FB}
[04]: {17342715-5BEE-452F-BDA4-D088DE65EF7E}
[05]: {1BF24D79-2C2C-4BE7-BC24-5BD2D9FA8EA0}
[06]: {1DF482EC-3BD7-4E2F-9DEE-DAF308063753}
[07]: {4D072D56-B07B-4798-97B2-B9E7A4F53EAC}
[08]: {5472718D-B0C6-4A1C-BE1C-B0C596556E10}
[09]: {5F4B6C81-64E8-4B16-A932-1C444E1BA970}
[10]: {60556C49-6363-4A37-B4E4-2F6DB6C65567}
[11]: {6A6A5A40-FB6D-402C-8516-CC61E6DFE524}
[12]: {923D89F2-B3D7-4530-8165-309F1DE72706}
[13]: {B945219C-C51C-4BD0-BAD5-A3FED95B555F}
[14]: {C37F9508-39A3-4B7E-947E-F8C69EC8A180}
[15]: {C602034B-0E04-4A4C-994B-9BE7AEFF5931}
[16]: {CEB1A88D-195D-4350-A550-C6807B1BBB17}
[17]: {D3EFC280-3E7E-45E8-AA78-6FC148A08B62}
[18]: {F5001920-E94E-4287-80C6-158FBC1D7035}
[19]: {FA111F3D-A299-438D-A61F-2E8D5138D1D2}
[20]: {32971938-65B1-4B38-B483-9A32560B7CF2}
[21]: {385D6D1A-7D4B-41BA-ACCD-39B9CA14F562}
[22]: {B0AEF410-04FF-4AEC-8D8E-C9427C38BBCD}
[23]: {9DFD0865-4E0F-4947-A77D-43D58782A57F}
[24]: {D7C5B9DC-6E4C-4DEE-9A7B-4183DA4DC1C2}
Carte(s) r‚seau: 1 carte(s) r‚seau install‚e(s).
[01]: Attansic L1 Gigabit Ethernet 10/100/1000Base-T Controller
Nom de la connexionÿ: Connexion au r‚seau local
DHCP activ‚ÿ: Oui
Serveur DHCPÿ: 192.168.0.1
Adresse(s) IP
[01]: 192.168.0.100
[02]: fe80::402c:f9e9:816a:9887
Nom de l'image PID Nom de la sessio Num‚ro de s Utilisation
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 Ko
System 4 Services 0 98ÿ404 Ko
smss.exe 424 Services 0 564 Ko
csrss.exe 520 Services 0 3ÿ464 Ko
wininit.exe 568 Services 0 3ÿ180 Ko
csrss.exe 584 Console 1 12ÿ884 Ko
winlogon.exe 620 Console 1 4ÿ360 Ko
services.exe 664 Services 0 4ÿ496 Ko
lsass.exe 680 Services 0 6ÿ792 Ko
lsm.exe 688 Services 0 3ÿ412 Ko
svchost.exe 1048 Services 0 5ÿ768 Ko
nvvsvc.exe 1092 Services 0 2ÿ868 Ko
svchost.exe 1120 Services 0 5ÿ632 Ko
svchost.exe 1156 Services 0 12ÿ620 Ko
svchost.exe 1248 Services 0 14ÿ396 Ko
svchost.exe 1272 Services 0 54ÿ696 Ko
svchost.exe 1284 Services 0 179ÿ796 Ko
audiodg.exe 1368 Services 0 3ÿ012 Ko
SLsvc.exe 1400 Services 0 5ÿ828 Ko
svchost.exe 1428 Services 0 9ÿ892 Ko
svchost.exe 1544 Services 0 15ÿ812 Ko
spoolsv.exe 1732 Services 0 6ÿ476 Ko
svchost.exe 1756 Services 0 11ÿ340 Ko
rundll32.exe 1924 Console 1 4ÿ712 Ko
taskeng.exe 560 Services 0 5ÿ000 Ko
avgwdsvc.exe 816 Services 0 2ÿ616 Ko
LVComSer.exe 856 Services 0 5ÿ016 Ko
LVPrcSrv.exe 956 Services 0 3ÿ928 Ko
IoctlSvc.exe 2036 Services 0 2ÿ316 Ko
svchost.exe 2008 Services 0 3ÿ928 Ko
SeaPort.exe 1216 Services 0 6ÿ372 Ko
svchost.exe 1012 Services 0 5ÿ740 Ko
svchost.exe 888 Services 0 1ÿ960 Ko
avgrsx.exe 2212 Services 0 17ÿ712 Ko
LVComSer.exe 2752 Console 1 4ÿ604 Ko
taskeng.exe 2812 Console 1 9ÿ200 Ko
dwm.exe 3052 Console 1 4ÿ404 Ko
explorer.exe 3128 Console 1 28ÿ236 Ko
MSASCui.exe 3484 Console 1 2ÿ328 Ko
RtHDVCpl.exe 3516 Console 1 5ÿ028 Ko
pptd40nt.exe 3676 Console 1 3ÿ304 Ko
wmpnscfg.exe 3932 Console 1 4ÿ280 Ko
wmpnetwk.exe 3996 Services 0 17ÿ704 Ko
unsecapp.exe 772 Console 1 4ÿ140 Ko
WmiPrvSE.exe 2496 Services 0 4ÿ852 Ko
BrMfcWnd.exe 3012 Console 1 5ÿ556 Ko
avgtray.exe 3244 Console 1 1ÿ332 Ko
Communications_Helper.exe 3308 Console 1 7ÿ636 Ko
Quickcam.exe 3392 Console 1 8ÿ268 Ko
rundll32.exe 2944 Console 1 3ÿ864 Ko
sidebar.exe 3644 Console 1 8ÿ520 Ko
Gestionnaire Antidote.exe 3716 Console 1 3ÿ048 Ko
ehtray.exe 1244 Console 1 1ÿ400 Ko
GoogleToolbarNotifier.exe 2744 Console 1 1ÿ944 Ko
msnmsgr.exe 1380 Console 1 10ÿ000 Ko
BrccMCtl.exe 3860 Console 1 16ÿ448 Ko
ehmsas.exe 496 Console 1 3ÿ892 Ko
COCIManager.exe 2764 Console 1 8ÿ284 Ko
ieuser.exe 312 Console 1 18ÿ868 Ko
iexplore.exe 2076 Console 1 181ÿ636 Ko
msiexec.exe 4768 Services 0 9ÿ156 Ko
wltuser.exe 5140 Console 1 7ÿ108 Ko
FlashUtil10b.exe 4956 Console 1 4ÿ984 Ko
infocard.exe 5480 Services 0 12ÿ160 Ko
WmiPrvSE.exe 4916 Services 0 12ÿ044 Ko
wuauclt.exe 3144 Console 1 5ÿ392 Ko
TrustedInstaller.exe 2604 Services 0 8ÿ468 Ko
List_Killem.exe 4456 Console 1 5ÿ728 Ko
cmd.exe 4372 Console 1 3ÿ008 Ko
WmiPrvSE.exe 2624 Services 0 5ÿ368 Ko
tasklist.exe 3660 Console 1 4ÿ848 Ko
Infections :
========
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Program Files\BitLord"
"C:\Program Files\FBrowsingAdvisor"
"C:\Program Files\PlayMP3z"
C:\Users\Propri‚taire\LOCAL Settings\Temp\BitLord-v2.0-Installer.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate01.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate02.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\Installe.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\Install_WLMessenger.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\mirc632.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\mirc635.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\TorrentManToolbar.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\wlsetup-cvr.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\_is70BC.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\_unps.exe
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings
"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser"
HKEY_CURRENT_USER\SOFTWARE\PlayMP3
¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch :
7035551.TMP-7CC32C74.pf
7035645.TMP-E5A73480.pf
7035738.TMP-3B358207.pf
ACROBROKER.EXE-8BC3F433.pf
AgAppLaunch.db
AgCx_S1_S-1-5-21-4017860491-3366806851-76704201-1000.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgCx_SC3_CB986082.db
AGENTSVR.EXE-2DB83BDE.pf
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-4017860491-3366806851-76704201-1000.db
AgGlUAD_P_S-1-5-21-4017860491-3366806851-76704201-501.db
AgGlUAD_S-1-5-21-4017860491-3366806851-76704201-1000.db
AgGlUAD_S-1-5-21-4017860491-3366806851-76704201-501.db
AgRobust.db
ATBROKER.EXE-FF58B71D.pf
AVGCFGEX.EXE-54CEEB00.pf
AVGCMGR.EXE-556E623C.pf
AVGCSRVX.EXE-82C246DD.pf
AVGNSX.EXE-D53DAA4F.pf
AVGSRMAX.EXE-4B50ECB6.pf
AVGUI.EXE-97BB505D.pf
AVGUPD.EXE-2AF460D4.pf
AVGWSC.EXE-49F51870.pf
BITLORD.EXE-E856D3D1.pf
BRMFCMON.EXE-AABE8E4B.pf
CALC.EXE-AC08706A.pf
CMD.EXE-89305D47.pf
COCIMANAGER.EXE-24AD6BC2.pf
CONSENT.EXE-65F6206D.pf
CONTROL.EXE-9459D5A0.pf
CSRSS.EXE-8C04D631.pf
DEFRAG.EXE-738093E8.pf
DFRGNTFS.EXE-4F838A89.pf
DLLHOST.EXE-01BB85F0.pf
DLLHOST.EXE-6202E8F2.pf
DLLHOST.EXE-71214090.pf
DLLHOST.EXE-7D2183B8.pf
DLLHOST.EXE-875FC13D.pf
DLLHOST.EXE-893DDF55.pf
DLLHOST.EXE-8AF42443.pf
DLLHOST.EXE-928474CF.pf
DLLHOST.EXE-C5C55E89.pf
DWM.EXE-AEABE78B.pf
EHMSAS.EXE-6BE9D904.pf
EXPLORER.EXE-7A3328DA.pf
FIXCFG.EXE-67406AF4.pf
FLASHUTIL10B.EXE-4AA9BDDC.pf
FREE.MOVIE.LICENSE[1].EXE-5F7BEA27.pf
GAMMADVD.EXE-02F09C20.pf
GOOGLETOOLBAR1USER.EXE-7F556BE2.pf
GOOGLETOOLBARNOTIFIER.EXE-30287F94.pf
HELPPANE.EXE-D1016F9E.pf
HIJACKTHIS.EXE-4187566C.pf
HJTINSTALL[1].EXE-4626974B.pf
IEUSER.EXE-D895AB54.pf
IEXPLORE.EXE-1B894AFB.pf
INFOCARD.EXE-0C9B4CAB.pf
Layout.ini
LIMEWIRE.EXE-7CCD1B8D.pf
LISTEM.EXE-54490B62.pf
LOGITECHUPDATE.EXE-A45F17F1.pf
LOGONUI.EXE-1BEE4A84.pf
LULNCHR.EXE-B4187A87.pf
LVCOMSER.EXE-74C0B0CF.pf
LVPRCSRV.EXE-E0306B6B.pf
MBAM-SETUP.EXE-FE9DE4FB.pf
MBAM-SETUP.TMP-9BB3CFDD.pf
MBAM-SETUP.TMP-9F7F9592.pf
MBAM.EXE-CD3441D7.pf
MBAMGUI.EXE-00780130.pf
MCUPDATE.EXE-AF07FDE6.pf
MFPMP.EXE-73140A33.pf
MINESWEEPER.EXE-64897C84.pf
MIRC.EXE-144490BE.pf
MODE.COM-0F3F3F6D.pf
MPAS-D.EXE-C74E749D.pf
MPCMDRUN.EXE-BB72ED6F.pf
MPLAYERC.EXE-8335E260.pf
MPSIGSTUB.EXE-743CD36E.pf
MPSIGSTUB.EXE-E51C1B8B.pf
MRT.EXE-C3C3D3DA.pf
MRTSTUB.EXE-22E72F09.pf
MSASCUI.EXE-6465DB72.pf
MSIEXEC.EXE-B5AFA339.pf
MSNMSGR.EXE-DD43BBF4.pf
NOTEPAD.EXE-EB1B961A.pf
NTOSBOOT-B00DFAAD.pf
OFFICELIVESIGNIN.EXE-3E8ACCCB.pf
PDMSETUP.EXE-CEC10DD5.pf
PfSvPerfStats.bin
POQEXEC.EXE-CFF63269.pf
POWERPNT.EXE-C30F94F3.pf
ReadyBoot
REG.EXE-26976709.pf
REGISTERIEPKEYS.EXE-A8651B1E.pf
REGSVR32.EXE-55A4EE79.pf
RUNDLL32.EXE-905D47B9.pf
RUNDLL32.EXE-9497DC51.pf
RUNDLL32.EXE-B9EF4314.pf
RUNDLL32.EXE-CE557EE2.pf
RUNDLL32.EXE-F452D79D.pf
SEARCHFILTERHOST.EXE-1FE91C16.pf
SEARCHFILTERHOST.EXE-AA7A1FDD.pf
SEARCHINDEXER.EXE-77D27BAC.pf
SEARCHPROTOCOLHOST.EXE-AFAD3EF9.pf
SETDEPNX.EXE-0520665A.pf
SETIEINSTALLEDDATE.EXE-A2F270A3.pf
SETUP.EXE-E3E06AE2.pf
SETUP1.EXE-081676FF.pf
SETUP_WM.EXE-4A6000A5.pf
SMSS.EXE-1DCD0EB1.pf
SNDVOL.EXE-783DCB11.pf
SSVAGENT.EXE-AE309E15.pf
SSVAGENT.EXE-C26271B1.pf
ST6UNST.EXE-D8E422D8.pf
SVCHOST.EXE-8FD92526.pf
SVCHOST.EXE-E2D30E5C.pf
TASKENG.EXE-5BAF290C.pf
TASKMGR.EXE-72398DC0.pf
TRUSTEDINSTALLER.EXE-031B6478.pf
UNSECAPP.EXE-CD982D99.pf
UNZIXWIN.EXE-53733B29.pf
USERINIT.EXE-F39AB672.pf
VERCLSID.EXE-4D95F5A7.pf
VSSVC.EXE-04D079CC.pf
WERCON.EXE-FE5CD389.pf
WERFAULT.EXE-B7E27BE5.pf
WERMGR.EXE-2A1BCBC7.pf
WINDOWS-KB890830-V2.13-DELTA.-9464FE4E.pf
WINZIP32.EXE-D7CC28A7.pf
WLCOMM.EXE-648065CA.pf
WLLOGINPROXY.EXE-E9051163.pf
WLTUSER.EXE-A6CDB501.pf
WMIADAP.EXE-369DF1CD.pf
WMIPRVSE.EXE-43972D0F.pf
WMPLAYER.EXE-9DE758AE.pf
WMPNETWK.EXE-BD0344CA.pf
WMPNSCFG.EXE-DF1DD51A.pf
WMPSHARE.EXE-73C9F24C.pf
WUAUCLT.EXE-830BCC14.pf
WUIESETUP_PREREQ.EXE-69ADC0D0.pf
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Utilisateur anonyme
20 août 2009 à 15:06
20 août 2009 à 15:06
salut :
Ferme toutes tes fenetres(y compris internet et windows live messenger) , puis :
▶ Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),
mais cette fois-ci :
▶ choisis l'option 2 = Mode Destruction
laisse travailler l'outil
apres les verifications , un rapport va s'ouvrir.
▶ ferme-le.
un deuxieme rapport va s'ouvrir ,
▶ colle son contenu dans ta reponse
Ferme toutes tes fenetres(y compris internet et windows live messenger) , puis :
▶ Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),
mais cette fois-ci :
▶ choisis l'option 2 = Mode Destruction
laisse travailler l'outil
apres les verifications , un rapport va s'ouvrir.
▶ ferme-le.
un deuxieme rapport va s'ouvrir ,
▶ colle son contenu dans ta reponse
Kill'em by g3n-h@ckm@n 1.0.2.6
updated on 20.08.2009 ::::: 00.30
Microsoft Windows [version 6.0.6001]
2009-08-20 10:22:55,92
Fichiers analysés :
=================
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Program Files\BitLord"
"C:\Program Files\FBrowsingAdvisor"
"C:\Program Files\PlayMP3z"
C:\Users\Propri‚taire\LOCAL Settings\Temp\BitLord-v2.0-Installer.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate01.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate02.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\Installe.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\Install_WLMessenger.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\mirc632.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\mirc635.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\TorrentManToolbar.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\wlsetup-cvr.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\_is70BC.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\_unps.exe
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :
Quarantaine :
BitLord-v2.0-Installer.exe.Kill'em
BitLord.Kill'em
FBrowsingAdvisor.Kill'em
FlashPlayerUpdate.exe.Kill'em
FlashPlayerUpdate01.exe.Kill'em
FlashPlayerUpdate02.exe.Kill'em
Installe.exe.Kill'em
Install_WLMessenger.exe.Kill'em
mirc632.exe.Kill'em
mirc635.exe.Kill'em
PlayMP3z.Kill'em
TorrentManToolbar.exe.Kill'em
wlsetup-cvr.exe.Kill'em
_is70BC.exe.Kill'em
_unps.exe.Kill'em
¤¤¤¤¤¤¤¤¤¤ Verification :
Infections :
========
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings
"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser"
HKEY_CURRENT_USER\SOFTWARE\PlayMP3
¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch :
AgAppLaunch.db
AgCx_S1_S-1-5-21-4017860491-3366806851-76704201-1000.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgCx_SC3_CB986082.db
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-4017860491-3366806851-76704201-1000.db
AgGlUAD_P_S-1-5-21-4017860491-3366806851-76704201-501.db
AgGlUAD_S-1-5-21-4017860491-3366806851-76704201-1000.db
AgGlUAD_S-1-5-21-4017860491-3366806851-76704201-501.db
AgRobust.db
Layout.ini
NTOSBOOT-B00DFAAD.pf
PfSvPerfStats.bin
ReadyBoot
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
updated on 20.08.2009 ::::: 00.30
Microsoft Windows [version 6.0.6001]
2009-08-20 10:22:55,92
Fichiers analysés :
=================
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Program Files\BitLord"
"C:\Program Files\FBrowsingAdvisor"
"C:\Program Files\PlayMP3z"
C:\Users\Propri‚taire\LOCAL Settings\Temp\BitLord-v2.0-Installer.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate01.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\FlashPlayerUpdate02.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\Installe.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\Install_WLMessenger.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\mirc632.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\mirc635.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\TorrentManToolbar.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\wlsetup-cvr.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\_is70BC.exe
C:\Users\Propri‚taire\LOCAL Settings\Temp\_unps.exe
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :
Quarantaine :
BitLord-v2.0-Installer.exe.Kill'em
BitLord.Kill'em
FBrowsingAdvisor.Kill'em
FlashPlayerUpdate.exe.Kill'em
FlashPlayerUpdate01.exe.Kill'em
FlashPlayerUpdate02.exe.Kill'em
Installe.exe.Kill'em
Install_WLMessenger.exe.Kill'em
mirc632.exe.Kill'em
mirc635.exe.Kill'em
PlayMP3z.Kill'em
TorrentManToolbar.exe.Kill'em
wlsetup-cvr.exe.Kill'em
_is70BC.exe.Kill'em
_unps.exe.Kill'em
¤¤¤¤¤¤¤¤¤¤ Verification :
Infections :
========
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings
"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser"
HKEY_CURRENT_USER\SOFTWARE\PlayMP3
¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch :
AgAppLaunch.db
AgCx_S1_S-1-5-21-4017860491-3366806851-76704201-1000.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgCx_SC3_CB986082.db
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-4017860491-3366806851-76704201-1000.db
AgGlUAD_P_S-1-5-21-4017860491-3366806851-76704201-501.db
AgGlUAD_S-1-5-21-4017860491-3366806851-76704201-1000.db
AgGlUAD_S-1-5-21-4017860491-3366806851-76704201-501.db
AgRobust.db
Layout.ini
NTOSBOOT-B00DFAAD.pf
PfSvPerfStats.bin
ReadyBoot
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Utilisateur anonyme
20 août 2009 à 16:46
20 août 2009 à 16:46
▶ Double clic sur OTL.exe pour le lancer.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous Customs Scans/Fixes :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:reg
[-HKEY_CURRENT_USER\SOFTWARE\MediaHoldings]
[-HKEY_CURRENT_USER\SOFTWARE\PlayMP3]
:commands
[emptytemp]
[reboot]
▶ Clique sur RunFix pour lancer la suppression.
▶ Poste le rapport.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous Customs Scans/Fixes :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:reg
[-HKEY_CURRENT_USER\SOFTWARE\MediaHoldings]
[-HKEY_CURRENT_USER\SOFTWARE\PlayMP3]
:commands
[emptytemp]
[reboot]
▶ Clique sur RunFix pour lancer la suppression.
▶ Poste le rapport.
jai démarrer le run fix ce matin mais ca prenait beaucoup de temps mai je l'ai quand meme laisser rouler jusqua ce que je revienne pour diner. Il a buguer en chemin, donc n'a jamais completer sa tache. Donc aucun rapport a te donner pour linstand. Je vais cependant en démarrer un autre a l'instand et vérifier plus tard ce que cela aura donner. Je te redonne des nouvelles
absolument, je nai pas le choix comme je tai dis mon clique gauche ne fonctionne pas, donc je ne peux pas faire de double-clic sur rien dans mon bureau, je dois toujours cliquer droit et faire executer en tant qu'administrateur
Utilisateur anonyme
21 août 2009 à 16:37
21 août 2009 à 16:37
▶ Désactive ton antivirus le temps de la manipulation car OTM est détecté comme une infection à tort.
▶ Télécharge OTM (OldTimer) sur ton Bureau :
▶ Double-clique sur OTM.exe afin de le lancer.
▶ Copie (Ctrl+C) le texte suivant ci-dessous :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:reg
[-HKEY_CURRENT_USER\SOFTWARE\MediaHoldings]
[-HKEY_CURRENT_USER\SOFTWARE\PlayMP3]
:commands
[emptytemp]
[reboot]
▶ Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
▶ Clique maintenant sur le bouton MoveIt! puis ferme OTM
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
▶ Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
*Le nom du rapport correspond au moment de sa création : date_heure.log
▶ Télécharge OTM (OldTimer) sur ton Bureau :
▶ Double-clique sur OTM.exe afin de le lancer.
▶ Copie (Ctrl+C) le texte suivant ci-dessous :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:reg
[-HKEY_CURRENT_USER\SOFTWARE\MediaHoldings]
[-HKEY_CURRENT_USER\SOFTWARE\PlayMP3]
:commands
[emptytemp]
[reboot]
▶ Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
▶ Clique maintenant sur le bouton MoveIt! puis ferme OTM
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
▶ Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
*Le nom du rapport correspond au moment de sa création : date_heure.log
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\MediaHoldings\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\PlayMP3\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Invité
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Propriétaire
->Temp folder emptied: 524111 bytes
File delete failed. C:\Users\Propriétaire\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2U7CC31Q(25)\M5OTZlLTg4ODgtMTFkZS1iMjhlLTAwMWIyNGJlNWFjMgAAAAAAAAA=,,http%3A%2F%2Fserved.antventure.com%2Fcreatives%2Fanswer.com2%2Fnews%2F160600ad[1].html,;ord=1250223092 scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: -1866174862 bytes
->Java cache emptied: 20903971 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\logishrd\LVPrcInj03.dll scheduled to be deleted on reboot.
Windows Temp folder emptied: 641534644 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = -1147,47 mb
OTM by OldTimer - Version 3.0.0.6 log created on 08212009_110811
Files moved on Reboot...
File C:\Users\Propriétaire\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2U7CC31Q(25)\M5OTZlLTg4ODgtMTFkZS1iMjhlLTAwMWIyNGJlNWFjMgAAAAAAAAA=,,http%3A%2F%2Fserved.antventure.com%2Fcreatives%2Fanswer.com2%2Fnews%2F160600ad[1].html,;ord=1250223092 not found!
File C:\Windows\temp\logishrd\LVPrcInj03.dll not found!
Registry entries deleted on Reboot...
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\MediaHoldings\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\PlayMP3\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Invité
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Propriétaire
->Temp folder emptied: 524111 bytes
File delete failed. C:\Users\Propriétaire\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2U7CC31Q(25)\M5OTZlLTg4ODgtMTFkZS1iMjhlLTAwMWIyNGJlNWFjMgAAAAAAAAA=,,http%3A%2F%2Fserved.antventure.com%2Fcreatives%2Fanswer.com2%2Fnews%2F160600ad[1].html,;ord=1250223092 scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: -1866174862 bytes
->Java cache emptied: 20903971 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\logishrd\LVPrcInj03.dll scheduled to be deleted on reboot.
Windows Temp folder emptied: 641534644 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = -1147,47 mb
OTM by OldTimer - Version 3.0.0.6 log created on 08212009_110811
Files moved on Reboot...
File C:\Users\Propriétaire\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2U7CC31Q(25)\M5OTZlLTg4ODgtMTFkZS1iMjhlLTAwMWIyNGJlNWFjMgAAAAAAAAA=,,http%3A%2F%2Fserved.antventure.com%2Fcreatives%2Fanswer.com2%2Fnews%2F160600ad[1].html,;ord=1250223092 not found!
File C:\Windows\temp\logishrd\LVPrcInj03.dll not found!
Registry entries deleted on Reboot...
Utilisateur anonyme
22 août 2009 à 11:02
22 août 2009 à 11:02
hello :
Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.
▶ Télécharge :
Malwarebytes
ou :
Malwarebytes
▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .
(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX
▶ Potasses le Tuto pour te familiariser avec le prg :
( cela dit, il est très simple d'utilisation ).
relance malwarebytes en suivant scrupuleusement ces consignes :
! Déconnecte toi et ferme toutes applications en cours !
▶ Lance Malwarebyte's .
Fais un examen dit "Complet" .
▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .
▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !
▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)
Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.
▶ Télécharge :
Malwarebytes
ou :
Malwarebytes
▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .
(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX
▶ Potasses le Tuto pour te familiariser avec le prg :
( cela dit, il est très simple d'utilisation ).
relance malwarebytes en suivant scrupuleusement ces consignes :
! Déconnecte toi et ferme toutes applications en cours !
▶ Lance Malwarebyte's .
Fais un examen dit "Complet" .
▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .
▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !
▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)
Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2685
Windows 6.0.6001 Service Pack 1
2009-08-23 20:15:50
mbam-log-2009-08-23 (20-15-50).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 215631
Temps écoulé: 52 minute(s), 20 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 22
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 5
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\sssinstaller.installer (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sssinstaller.installer.1 (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sssinstaller.sinstaller (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sssinstaller.sinstaller.1 (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{0fbc3efb-fc98-4b32-bf10-bde9aa4dea5a} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6a4b7d17-1de9-4c14-8adf-eb4c07060519} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{abf441b2-9b57-4838-96a0-34b1cecd4aa5} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{74278296-0ec7-4f7a-ad55-eb7a2f35f311} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3 (Rogue.PlayMp3) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SSSInstaller (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GroupManager (Backdoor.Bot) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Program Files\Screensavers.com (Adware.Comet) -> Delete on reboot.
C:\Program Files\Screensavers.com\ActiveDesktop (Adware.Comet) -> Delete on reboot.
C:\Program Files\Screensavers.com\ActiveDesktop\bin (Adware.Comet) -> Quarantined and deleted successfully.
C:\Program Files\Screensavers.com\SSSInstaller (Adware.Comet) -> Delete on reboot.
C:\Program Files\Screensavers.com\SSSInstaller\bin (Adware.Comet) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Program Files\Screensavers.com\SSSUninst.exe (Adware.Comet) -> Quarantined and deleted successfully.
C:\Program Files\Screensavers.com\ActiveDesktop\bin\ActiveDesktopExe.exe (Adware.Comet) -> Quarantined and deleted successfully.
C:\Users\Invité\Desktop\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
Version de la base de données: 2685
Windows 6.0.6001 Service Pack 1
2009-08-23 20:15:50
mbam-log-2009-08-23 (20-15-50).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 215631
Temps écoulé: 52 minute(s), 20 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 22
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 5
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\sssinstaller.installer (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sssinstaller.installer.1 (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sssinstaller.sinstaller (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sssinstaller.sinstaller.1 (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{0fbc3efb-fc98-4b32-bf10-bde9aa4dea5a} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6a4b7d17-1de9-4c14-8adf-eb4c07060519} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{abf441b2-9b57-4838-96a0-34b1cecd4aa5} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{74278296-0ec7-4f7a-ad55-eb7a2f35f311} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3 (Rogue.PlayMp3) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SSSInstaller (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GroupManager (Backdoor.Bot) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Program Files\Screensavers.com (Adware.Comet) -> Delete on reboot.
C:\Program Files\Screensavers.com\ActiveDesktop (Adware.Comet) -> Delete on reboot.
C:\Program Files\Screensavers.com\ActiveDesktop\bin (Adware.Comet) -> Quarantined and deleted successfully.
C:\Program Files\Screensavers.com\SSSInstaller (Adware.Comet) -> Delete on reboot.
C:\Program Files\Screensavers.com\SSSInstaller\bin (Adware.Comet) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Program Files\Screensavers.com\SSSUninst.exe (Adware.Comet) -> Quarantined and deleted successfully.
C:\Program Files\Screensavers.com\ActiveDesktop\bin\ActiveDesktopExe.exe (Adware.Comet) -> Quarantined and deleted successfully.
C:\Users\Invité\Desktop\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
Utilisateur anonyme
24 août 2009 à 07:03
24 août 2009 à 07:03
hello :
▶ Télécharge Superantispyware (SAS)
▶ Choisis "enregistrer" et enregistre-le sur ton bureau.
▶ Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.
▶ Créé une icône sur le bureau.
▶ Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.
▶- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
▶- Sous Configuration and Preferences, clique sur le bouton "Preferences"
▶- Clique sur l'onglet "Scanning Control "
▶- Dans "Scanner Options ", assure toi que la case devant les lignes suivantes est cochée :
▶Close browsers before scanning
▶Scan for tracking cookies
▶Terminate memory threats before quarantining
▶ Laisse les autres lignes décochées.
▶ Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.
▶ Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".
▶ Dans la colonne de gauche, coche C:\Fixed Drive.
▶ Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"
▶ Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.
▶ A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.
▶ Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".
▶ Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.
Pour recopier les informations sur le forum, fais ceci :
▶ - après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
▶ - Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
▶- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.
▶ - Le rapport va s'ouvrir dans ton éditeur de texte par défaut.
▶ - Copie son contenu dans ta réponse.
Regarde bien le tuto SUPERAntiSpyware il est très bien expliqué.
▶ Télécharge Superantispyware (SAS)
▶ Choisis "enregistrer" et enregistre-le sur ton bureau.
▶ Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.
▶ Créé une icône sur le bureau.
▶ Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.
▶- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
▶- Sous Configuration and Preferences, clique sur le bouton "Preferences"
▶- Clique sur l'onglet "Scanning Control "
▶- Dans "Scanner Options ", assure toi que la case devant les lignes suivantes est cochée :
▶Close browsers before scanning
▶Scan for tracking cookies
▶Terminate memory threats before quarantining
▶ Laisse les autres lignes décochées.
▶ Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.
▶ Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".
▶ Dans la colonne de gauche, coche C:\Fixed Drive.
▶ Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"
▶ Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.
▶ A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.
▶ Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".
▶ Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.
Pour recopier les informations sur le forum, fais ceci :
▶ - après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
▶ - Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
▶- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.
▶ - Le rapport va s'ouvrir dans ton éditeur de texte par défaut.
▶ - Copie son contenu dans ta réponse.
Regarde bien le tuto SUPERAntiSpyware il est très bien expliqué.
