Bonsoir à tous, Le trojan Win32.Banker.fgv a été repéré par "Spybot S&D " mais qui n'arrive pas a le supprimer car après un nouveau scan Spybot il revient (?) Merci de votre aide

Trojan Win32.Banker.fgv

Réponse 21 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
13 janv. 2010 à 19:16

http://www.cijoint.fr/cj201001/cij43brKrc.txt

merci

Réponse 22 / 111

jacques.gache Messages postés 33453 Date d'inscription mardi 13 novembre 2007 Statut Contributeur sécurité Dernière intervention 25 janvier 2016 1 616
13 janv. 2010 à 21:01

bonjour, ok il n'a trouvé que des Cookies donc rein de méchant , tu fais ce qui suit et si toujours des problèmes on passera un dernier outil !!

1) pasees toolscleaner pour supprimer les outils utilisés lui tu le supprimeras de sur ton bureau

Télécharge toolscleaner sur ton Bureau : http://bibou0007.com/outils-specifiques-f78/tutorial-toolscleaner-2-t375.htm

si le lien ne marche pas essais avec celui ci https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/

. Double-cliques sur ToolsCleaner2.bat et laisse le travailler
. Cliques sur Recherche et laisse le scan se terminer.
. Cliques sur Suppression pour finaliser.
. Tu peux, si tu le souhaites, te servir des Options facultatives.
. Clique sur Quitter, pour que le rapport puisse se créer.
. Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse

2) passes ccleaner avec les réglages donnés

télécharges Ccleaner à partir de cette adresses

https://www.commentcamarche.net/telecharger/utilitaires/5647-ccleaner/

.enregistres le sur le bureau
.double-cliques sur le fichier pour lancer l'installation
.sur la fenêtre de l'installation langage bien choisir français et OK
.cliques sur suivant
.lis la licence et j'accepte
.cliques sur suivant
.la tu ne gardes de coché que mettre un raccourci sur le bureau et puis contrôler automatiquement les mises à jour de Ccleaner
.cliques sur intaller
.cliques sur fermer
.double-cliques sur l'icône de Ccleaner pour l'ouvrir
.une fois ouvert tu cliques sur option et puis avancé
.tu décoches effacer uniquement les fichiers, du dossier temp de windows plus vieux que 48 heures
.cliques sur nettoyeur
.cliques sur windows et dans la colonne avancé
.cochesla première case vieilles données du perfetch que celle-la
.cliques sur analyse une fois l'analyse terminé
.cliques sur lancer le nettoyage et sur la demande de confirmation OK il vas falloir que tu le refasses une autre fois une fois fini vériffis en appuiant de nouveau sur analyse pour être sur qu'il n'y est plus rien
.cliques maintenant sur registre et puis sur rechercher les erreurs
.laisses tout cochées et cliques sur réparrer les erreurs sélectionnées
.il te demande de sauvegarder OUI
.tu lui donnes un nom pour pouvoir la retrouver et enregistre
.cliques sur corriger toutes les erreurs sélectionnées et sur la demande de confirmation OK
.il supprime et fermer tu vériffis en relancant rechercher les erreurs
.tu retournes dans option et tu recoches la case effacer uniquement les fichiers, du dossier temp de windows plus vieux que 48 heures et sur nettoyeur, windows sous avancé tu décoches la première case vieilles données du perfetch
.tu peux fermer Ccleaner

pour aider si besion tutoriel: https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

ou plus ici: http://www.lescofofides.fr/forum/viewtopic.php?f=30&t=96

Réponse 23 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
13 janv. 2010 à 22:27

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\UsbFix.txt: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Balico\Mes documents\UsbFix.exe: trouvé !
C:\Documents and Settings\Balico\Mes documents\Rsit.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\hijackthis.log: trouvé !

---------------------------------
--> Suppression:

C:\Program Files\Trend Micro\HijackThis.exe: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Balico\Mes documents\UsbFix.exe: supprimé !
C:\Documents and Settings\Balico\Mes documents\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\hijackthis.log: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !

Réponse 24 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
13 janv. 2010 à 22:48

HKEY_CLASSES_ROOT\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}

Cette extension de fichier inutilisé résiste à CCLEANER et ne se supprime pas.

Réponse 25 / 111

jacques.gache Messages postés 33453 Date d'inscription mardi 13 novembre 2007 Statut Contributeur sécurité Dernière intervention 25 janvier 2016 1 616
13 janv. 2010 à 22:55

normal c'est celle de antivir ton anti-virus https://forum.zebulon.fr/topic/168322-impossible-de-nettoyer-une-cl%C3%A9-de-registre-avec-ccleaner/ donc pas grave

Réponse 26 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
14 janv. 2010 à 06:31

ok merci.

Si on a fini, pourriez vous essayer de vous attaquer à mon problème d'extinction de PC ?
Merci

Réponse 27 / 111

jacques.gache Messages postés 33453 Date d'inscription mardi 13 novembre 2007 Statut Contributeur sécurité Dernière intervention 25 janvier 2016 1 616
14 janv. 2010 à 18:05

bonjour, désolé j'ai pas de solution , je vais essayer de demander pour cela !!!

Réponse 28 / 111

Utilisateur anonyme
14 janv. 2010 à 18:52

salut

je viens apporter mon soutien :

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

▶ Télécharge et installe List&Kill'em et enregistre le sur ton bureau

▶ Branche clés usb , disques durs externes , mp3 , mp4 , etc..

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

coche la case "creer une icone sur le bureau"

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis la langue puis choisis l'option 1 = Mode Recherche

▶ laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

tu peux supprimer le rapport catchme.log de ton bureau maintenant.

Réponse 29 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
14 janv. 2010 à 19:52

List'em by g3n-h@ckm@n 1.1.8.3

Thx to El Desaparecido.....& CCM team

User : Balico (Administrateurs)
Update on 14/01/2010 by g3n-h@ckm@n ::::: 18:30
Start at: 19:19:08 | 13/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.06GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 232,88 Go (61,64 Go free) [446513] | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local | 298,09 Go (68,33 Go free) [WD Disque dur externe] | NTFS
K:\ -> Disque amovible

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\windows\System32\smss.exe
C:\windows\system32\csrss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\windows\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\System32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\windows\system32\svchost.exe
C:\windows\system32\SearchIndexer.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\windows\System32\alg.exe
C:\windows\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\system32\wscntfy.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\windows\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Balico\Local Settings\Temp\B.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Google Update REG_SZ "C:\Documents and Settings\Balico\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
ctfmon.exe REG_SZ C:\windows\system32\ctfmon.exe
SUPERAntiSpyware REG_SZ C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy 2\TeaTimer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
MailNotifierSessionManager REG_SZ C:\Program Files\Orange\Notification Mail\SessionManager\SessionManager.exe
LogitechVideoRepair REG_SZ C:\Program Files\Logitech\Video\ISStart.exe
SoundMAXPnP REG_SZ C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
StartCCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
SoundMax REG_SZ "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 128 (0x80)
NoDriveAutoRun REG_DWORD 128 (0x80)
HonorAutoRunSetting REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 128 (0x80)
NoDriveTypeAutoRun REG_DWORD 128 (0x80)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ wbsys.dll

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
{56F9679E-7826-4C84-81F3-532071A8BCC5} REG_SZ
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
C:\Documents and Settings\Balico\Mes documents\BitTorrent Downloads\fscommand\Vividas_ep18.exe REG_SZ C:\Documents and Settings\Balico\Mes documents\BitTorrent Downloads\fscommand\Vividas_ep18.exe:*:Disabled:Vividas Player
C:\Documents and Settings\Balico\Mes documents\BitTorrent Downloads\dora léon le lion du cirque.zip\fscommand\Vividas_ep18.exe REG_SZ C:\Documents and Settings\Balico\Mes documents\BitTorrent Downloads\dora léon le lion du cirque.zip\fscommand\Vividas_ep18.exe:*:Disabled:Vividas Player
C:\Documents and Settings\Balico\Mes documents\BitTorrent Downloads\dora léon le lion du cirque.zip\dora JEU PC léon le lion du cirque\fscommand\Vividas_ep18.exe REG_SZ C:\Documents and Settings\Balico\Mes documents\BitTorrent Downloads\dora léon le lion du cirque.zip\dora JEU PC léon le lion du cirque\fscommand\Vividas_ep18.exe:*:Enabled:Vividas Player
C:\Documents and Settings\Balico\Mes documents\BitTorrent Downloads\DORA clique et crée N°8 la famille buzza buzza\fscommand\Vividas_ep8.exe REG_SZ C:\Documents and Settings\Balico\Mes documents\BitTorrent Downloads\DORA clique et crée N°8 la famille buzza buzza\fscommand\Vividas_ep8.exe:*:Enabled:Vividas Player
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Disabled:Windows Live Messenger
C:\Program Files\Scrabble2009\ScrabblePCR.exe REG_SZ C:\Program Files\Scrabble2009\ScrabblePCR.exe:*:Enabled:Scrabble™ Interactif Edition 2009
C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe
C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe
C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe
E:\fscommand\Vividas_ep4.exe REG_SZ E:\fscommand\Vividas_ep4.exe:*:Disabled:Vividas Player
E:\fscommand\Vividas_ep12.exe REG_SZ E:\fscommand\Vividas_ep12.exe:*:Enabled:Vividas Player
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\Program Files\Test Drive Unlimited\TestDriveUnlimited.exe REG_SZ C:\Program Files\Test Drive Unlimited\TestDriveUnlimited.exe:*:Enabled:Test Drive Unlimited
C:\Program Files\ma-config.com\maconfservice.exe REG_SZ C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice
C:\Program Files\Logitech\Logitech Vid\Vid.exe REG_SZ C:\Program Files\Logitech\Logitech Vid\Vid.exe:*:Enabled:Logitech Vid
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Scrabble2009\ScrabblePCR.exe REG_SZ C:\Program Files\Scrabble2009\ScrabblePCR.exe:*:Enabled:ScrabblePCR
C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe
C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe
C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{00B71CFB-6864-4346-A978-C0A14556272C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{14B87622-7E19-4EA8-93B3-97215F77A6BC}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{166B1BCA-3F9C-11CF-8075-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{54B52E52-8000-4413-BD67-FC7FE24B59F2}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8E0D4DE5-3180-4024-A327-4DFAD1796A8D}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{B8BE5E93-A60C-4D26-A2DC-220313175592}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BD393C14-72AD-4790-A095-76522973D6B8}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C36112BF-2FA3-4694-8603-3B510EA3B465}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{EBF85371-A38F-485B-B28F-0B4C82D25937}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F6BF0D00-0B2A-4A75-BF7B-F385591623AF}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{47DA6053-700A-9605-F640-8FA5DF234A50}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8056AC9E-49C5-4375-9ADE-B2F862C9DF51}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{967B098A-042D-4367-BAC9-8BC11684174F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}

==============
BHO :
======
[<NO NAME> REG_SZ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{0347C33E-8762-4905-BF09-768834316C61}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
SharedAccess : 0x2
wuauserv : 0x2

=========

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
233 Go total, 61,65 Go libre (26%), 3% fragment‚ (fragmentation du fichier 6%)

Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\windows\System32\autorun.inf
C:\windows\System32\drivers\etc\hosts.msn
C:\windows\System32\drivers\lvuvc.hs
C:\windows\System32\SIntf16.dll
C:\Documents and Settings\Balico\Application Data\GDIPFONTCACHEV1.DAT
C:\Documents and Settings\Balico\Application Data\ViewerApp.dat
C:\Documents and Settings\Balico\LOCAL Settings\Temp\SSUPDATE.EXE

¤¤¤¤¤¤¤¤¤¤ Keys :

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}

================
Other infections
================

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-13 19:21:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:d2,7b,5a,a2,53,9d,d9,90,7b,88,6d,6d,a5,bb,c7,0a,01,a4,8a,7e,14,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:86,33,76,d1,05,cc,91,c2,d4,1c,78,9f,98,22,dc,37,cc,18,24,a9,5f,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:44,14,f8,ee,7f,9f,16,99,0d,ef,06,13,43,1f,75,73,c3,bc,57,9f,60,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:b6,35,ec,ca,9f,0c,38,48,70,5f,90,9c,20,4b,2e,c3,dc,fa,87,d7,75,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,e9,2e,59,bf,a7,c8,c0,59,00,56,2a,6f,5f,28,c2,97,..
"khjeh"=hex:0a,25,ae,ab,5e,a6,39,c1,bc,f0,23,b9,62,59,74,8c,d3,19,42,27,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,92,6c,85,72,ec,83,47,b2,dd,6c,4c,76,8f,28,eb,5d,24,86,44,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:40,26,55,97,e8,1a,a4,94,49,e8,da,7d,20,4e,66,af,4b,a6,05,dd,ed,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:b6,35,ec,ca,9f,0c,38,48,70,5f,90,9c,20,4b,2e,c3,dc,fa,87,d7,75,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:44,14,f8,ee,7f,9f,16,99,0d,ef,06,13,43,1f,75,73,c3,bc,57,9f,60,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:b6,35,ec,ca,9f,0c,38,48,70,5f,90,9c,20,4b,2e,c3,dc,fa,87,d7,75,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,e9,2e,59,bf,a7,c8,c0,59,00,56,2a,6f,5f,28,c2,97,..
"khjeh"=hex:0a,25,ae,ab,5e,a6,39,c1,bc,f0,23,b9,62,59,74,8c,d3,19,42,27,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,92,6c,85,72,ec,83,47,b2,dd,6c,4c,76,8f,28,eb,5d,24,86,44,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:44,14,f8,ee,7f,9f,16,99,0d,ef,06,13,43,1f,75,73,c3,bc,57,9f,60,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:b6,35,ec,ca,9f,0c,38,48,70,5f,90,9c,20,4b,2e,c3,dc,fa,87,d7,75,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,e9,2e,59,bf,a7,c8,c0,59,00,56,2a,6f,5f,28,c2,97,..
"khjeh"=hex:0a,25,ae,ab,5e,a6,39,c1,bc,f0,23,b9,62,59,74,8c,d3,19,42,27,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,92,6c,85,72,ec,83,47,b2,dd,6c,4c,76,8f,28,eb,5d,24,86,44,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:44,14,f8,ee,7f,9f,16,99,0d,ef,06,13,43,1f,75,73,c3,bc,57,9f,60,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:b6,35,ec,ca,9f,0c,38,48,70,5f,90,9c,20,4b,2e,c3,dc,fa,87,d7,75,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,e9,2e,59,bf,a7,c8,c0,59,00,56,2a,6f,5f,28,c2,97,..
"khjeh"=hex:0a,25,ae,ab,5e,a6,39,c1,bc,f0,23,b9,62,59,74,8c,d3,19,42,27,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,92,6c,85,72,ec,83,47,b2,dd,6c,4c,76,8f,28,eb,5d,24,86,44,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:44,14,f8,ee,7f,9f,16,99,0d,ef,06,13,43,1f,75,73,c3,bc,57,9f,60,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:b6,35,ec,ca,9f,0c,38,48,70,5f,90,9c,20,4b,2e,c3,dc,fa,87,d7,75,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,e9,2e,59,bf,a7,c8,c0,59,00,56,2a,6f,5f,28,c2,97,..
"khjeh"=hex:0a,25,ae,ab,5e,a6,39,c1,bc,f0,23,b9,62,59,74,8c,d3,19,42,27,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,92,6c,85,72,ec,83,47,b2,dd,6c,4c,76,8f,28,eb,5d,24,86,44,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:44,14,f8,ee,7f,9f,16,99,0d,ef,06,13,43,1f,75,73,c3,bc,57,9f,60,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:b6,35,ec,ca,9f,0c,38,48,70,5f,90,9c,20,4b,2e,c3,dc,fa,87,d7,75,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,e9,2e,59,bf,a7,c8,c0,59,00,56,2a,6f,5f,28,c2,97,..
"khjeh"=hex:0a,25,ae,ab,5e,a6,39,c1,bc,f0,23,b9,62,59,74,8c,d3,19,42,27,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,92,6c,85,72,ec,83,47,b2,dd,6c,4c,76,8f,28,eb,5d,24,86,44,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:02,e0,63,0f,d5,0d,f9,6a,cf,9d,47,e7,e1,82,2e,d2,ec,ab,fa,25,ff,..
"p0"="C:\Program Files\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:b6,35,ec,ca,9f,0c,38,48,70,5f,90,9c,20,4b,2e,c3,dc,fa,87,d7,75,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,31,e9,2e,59,bf,a7,c8,c0,59,00,56,2a,6f,5f,28,c2,97,..
"khjeh"=hex:0a,25,ae,ab,5e,a6,39,c1,bc,f0,23,b9,62,59,74,8c,d3,19,42,27,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8b,92,6c,85,72,ec,83,47,b2,dd,6c,4c,76,8f,28,eb,5d,24,86,44,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:ecc24041
"s2"=dword:6ad14240
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:62,c5,41,9b,2f,1a,81,ad,44,23,82,50,23,7b,c4,97,bf,e6,4a,b7,5b,..
"p0"="C:\Program Files\Alcohol 52\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:e1,23,6c,e1,60,90,36,58,ca,21,9c,3d,9c,d3,e5,76,e3,2c,5d,be,13,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet011\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:cd,f9,6a,2e,fc,33,5b,31,18,97,16,f9,ae,98,d0,e3,f5,53,3f,85,a3,..
"p0"="C:\Program Files\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet011\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:e1,23,6c,e1,60,90,36,58,ca,21,9c,3d,9c,d3,e5,76,e3,2c,5d,be,13,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet012\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:cd,f9,6a,2e,fc,33,5b,31,18,97,16,f9,ae,98,d0,e3,f5,53,3f,85,a3,..
"p0"="C:\Program Files\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet012\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:e1,23,6c,e1,60,90,36,58,ca,21,9c,3d,9c,d3,e5,76,e3,2c,5d,be,13,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet013\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:cd,f9,6a,2e,fc,33,5b,31,18,97,16,f9,ae,98,d0,e3,f5,53,3f,85,a3,..
"p0"="C:\Program Files\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet013\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:e1,23,6c,e1,60,90,36,58,ca,21,9c,3d,9c,d3,e5,76,e3,2c,5d,be,13,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet014\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:62,c5,41,9b,2f,1a,81,ad,44,23,82,50,23,7b,c4,97,bf,e6,4a,b7,5b,..
"p0"="C:\Program Files\Alcohol 52\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet014\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000001
"khjeh"=hex:e1,23,6c,e1,60,90,36,58,ca,21,9c,3d,9c,d3,e5,76,e3,2c,5d,be,13,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG11.00.00.01WORKSTATION"="C932FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A9C6AECB7A5D1407A2D97226D213B555BA7FD869164D67945DDF4E4DA5C535526903DA56C00A7B416323B11398E13EE8B194363A6BE5B882F88684E0B209EB7EFDD313A5944B0263A01A5834E2BAC3EF5EA8069527501897EBBCD250C00A1647591058591867A903CAAF7BD2572BC6C9BDAD64A0BBECA650DF1E0C4474069F0CF4DED60F8F3986034EB7BFA3FA46A27ECF450EC50EB0A77E08B725FA316B5601565BDCFA7F4F119D9FF96C6E925897ED1983E382C6404743180BB8481FE0EAAF0195DC64B269A1623534ED8E2B5F4BCB1F72EA67D0F81297491004912DBDF6F57E8F6DA538FC79B28815D3F6130DC59D700DCC99DCE9F8C7D6AD69508C8FF2035D404AAF60B3BCC2194152A8DD4AF240994655D3DE57517303446E14B016BDDCAF935384426C709D69CEC03E632F235F318375E18FB7D48C91263D7ED4C599DA89E709BBB8B703A080CD9B63BC0B0C00CC9B43A5EAB6A0DCCA9824C5F3C6ACAA06101401DFDAC0FDE7B982574AE1C477085DF514B034B600FCD41534D0F6814D41D33E931DCFDFBAAF0A3AEF2FE74972040A6C3764C3FB6576892528F0E508175E6DF7C6934476B0E9A429945388FBED6454262B4F2DB9D08E590E159B5910B1820C53802E19008F2D66DCC16063203D4FE747A1FDEA9E5A1BD9AF7FDEC6D01857D3073D9BE3DAD5139F8308C649DD8771601B603FAD3AEC7B1409818D5E661D0B5AEC8CCDEE4C5C3C14F28BB9C1C1C7F9CF0DC0285882C88E88C24B39FECCE3CD2B0611FB377A4B4AFAA083AE86BB4B1DBA2EAF9183D10239A6A59DBE3C6866D6C4F3021EEEF1A0E302AA3DE107A1379119332E9578640064551F5038607D70DE1B7EAB73FAA02E3447501AD2E52A8014D875521539DC7FFCEEC0CB89E739A224158FEBFE74DB99E961F48CC479F272645B71443577BF0E73C1C10ED50127F3670EB7378629D8DD3655219C3ECA7BABC47548425D1C76913C0F7BAB8613BBAAEE54A714131C3447D0A180E88A1A2A9E7E70BF1DB9C1CD41CF0EEB4AC9B4CC6484AAB69EF280EC77F4B4621FB95AC493DB09BEB93BB7F8A8AB67B4A2903494927548E084B9416766E0F33B051DB078A3AD6F531394030CA750B91C040F90B1F794D8450ABCFB695B56B52372CCF757BE46492F34BED880F141968CD03F7E26B0B5FA2508958120F41D48D55424BE53A67EB0A5BFF5A734100805127F5D66D8A634C16967A35719A4FEE834AAC247C672323131EA3A0C685C31FDDF19EBE5939BEB349AA78738C9B1CB4EBF088A096D0EBFCBECFD50DB4387CDEFCC3D30CC05A440CDE9DD29900834D59E2218242F66B68AF59BD73F1D4C9471BD509EB12041AA157C292FB002"
"OODEFRAG12.00.00.01PROFESSIONAL"="8B3449EA6DC88EFED0F9CB9E8557A0CF0D6A72876005F025D01938A0D27FEFBF27F685E7392A7AE1A5A64720B477DD5CCED8D1242CC61DA2C0389745ABE391FC34682BC5080BD33DD19893D4DBFB7D8A4F1EF522CB242F405FA3800220D474D0F2673B9EB08668C64B8E113D9733B9CCD8F8B90C3FBCEEC66CBC6E0737DE0D7F3799ED6EDC3BF95E9A8CD1BED7ECBFB8CA712E50DC3096A63DAA8C6F491542FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3DBA7FD869164D6794BA7FD869164D6794EB67346367E83999C9A767E23654B9EC76D6D56EB08FD808E7AA7D9F5BBA463829B52151B40B3BBFB0D1F39DDD67ACB6CCE4D81B47D017311CEFB2F4789853C199EF41CEE06A7BC2370B8F78382264F18997747472F9A0E0FDE71DC7447D1A2E2A6AB0A432D23512A39DF8DAB4D70DBD6BCD279DEA84328367A51D975EA408D6ED11CFCED1E7A618E069B05C262D5430577C34ECCDB88BFA545457174D9F0E8B1B61C4FE4F1B902FFDE17F4CC41D6DCED3AB24ED9B35EE1C66B034AEFA4FA00C8A6D78981D38B8252F8E6D2A2B748F178D763F5EB66FA530638CDEF8B3EDB7903ADC19341059E73DC88AC82D5AD4F3F8540F1830E8ABF973314B4847A806D041CC68951EE46F6DAEC604A4BEB3345AD81CB97F8BDF87BC17DE69A39A7078EB3D87DEA458B8C11AA54940D6FB00DD848C7CCD8C49A96EC0BF1EF06AAC83F68E15D5A2BF950E66C3BF9115F8B5E86CB9E3B1361CF83C24DD08C105D867BF0BC151432A2340CBCCC31087ED6AF180D4441B9B764CDCEE416F7B44DA6D6CE59110E982FE50F33C33F71F35CACBE937DB7368BEA1006B7F2FD61B413BEC0C1CB78C4EE9410D800DAFC1E54A3D048C671A1A73C15EDE4F8D2C755CFA0360D06B81C95EF3A0616A50A907D41A6E3DFA4A7E8D57F16AD3671DCBB329D5249375C1C8E1723D651AEB7D60B1CE1999E58880CAA8263D950E4596F4FD5E5AA316E87037F05409E8CA70EF62AF29650D30C18C94CAE1B9C380AF47E143CA359BBCCE2CCD97403C98C597639571323CAB9162D6C557039D6FE221DE21773638B81FFD0F60FAE9DF79A638FCB2ECA5016EC4DCA99B33764622B049729792D7D73B990495164376A41FC7D840C69DB8B9DE47D4B4284A9AB27DA70AF9F80FDDAC7A4D1EA2EB1D01D9354D369AB17E91929EDB270C518B4686B5CBF952D1ECE775DD1D42FA2F3996F6F99A42D828934C595E885E2651683E8A1364E1BA00B08D10E3B19546064C39153E58202CB3E0F4026697BD5F3557412AF17CC3D738E1D4031DF6F494688EDEF16A75A8AD31EF12A2919639775ED37D754162CE34FE8BBC77AE1D6F561FBDF2EF77A2E756D04F9975D0587B10045D189F"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BF7CD221-C241-8100-9978-4F32856C9627}]

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

3GP Video Converter 3
7-Zip
a-squared Free
a2FreeSetup.exe
Ad-Aware
Adobe
Alcohol 52
Alcohol Soft
Alcohol52_FE_1.9.6.5429.exe
Analog Devices
Apple Software Update
ATI Technologies
Audacity
AutoGK
AUTORUN.INF
Avira
AviSynth 2.5
Ballance.ico
Barbie(TM)
BSplayer
Call of Duty Dawnville Demo
CCleaner
ccleaner.setup140.exe
Charlotte aux Fraises
CleanUp!
Common Files
ComPlus Applications
CyberLink
data1.cab
data1.hdr
data2.cab
directx
DivX
DNA
Dsetup.dll
Eidos Interactive
eMule
EphPod
Extras
EZFace
Fichiers communs
free-downloads
Freez 3GP Video Converter
GameHouse
Google
help
Hewlett-Packard
HP
ImTOO
Install.exe
InstallShield Installation Information
install_flash_player.exe
Intel
Internet Explorer
InterVideo
Java
Kellogg's Asie
Kodak
Launch.exe
Launch.ini
Lavalys
LG Electronics
LG PC Suite
List_Kill'em
Logiciel Photo Orange
Logitech
ma-config.com
Malwarebytes' Anti-Malware
Martine … la montagne
Media Player Classic
mes donn‚es
Messenger
Messenger Plus! Live
MessengerPlus! 3
Microsoft
Microsoft CAPICOM 2.1.0.2
microsoft frontpage
Microsoft Office
Microsoft SQL Server Compact Edition
Microsoft Sync Framework
Microsoft Visual Studio
Microsoft Works
Mindscape
Movie Maker
Mozilla Firefox
MSBuild
MSECACHE
MSN
MSN Apps
MSN Gaming Zone
MSXML 4.0
Nero
NetMeeting
NFO viewer
NOS
Online Services
orange
OrangeHSS
Outlook Express
PeerGuardian2
perfect disk d‚fragmenteur
Philips
Photo Mixer 3.0
Photodex
PhotoFiltre Studio
Raccourcis de programmes
Real
Real Alternative
Realtek AC97
Reference Assemblies
Rockstar Games
SAGEM WiFi manager
Samsung
Satsuki Decoder Pack
ScanSoft
scrabble
Scrabble2009
Securitoo
Services en ligne
Session 1
Setup
Skype
Sony Corporation
Sony Print Service
SopCast
Spybot - Search & Destroy
Spybot - Search & Destroy 2
Stardock
startup.exe
SUPER
SUPERAntiSpyware
SystemRequirementsLab
Test Drive Unlimited
THQ
TmNationsForever
TomTom DesktopSuite
TomTom HOME 2
TomTom International B.V
Tomtomax Maxi-Box
Trend Micro
TribalWeb.net
TVAnts
Ubi Soft
Unlocker
uTorrent
VideoLAN
VirtualDub
VLC
vso
Wanadoo
Web Media Player
Winamp
WinAVI MP4 Converter
Windows Desktop Search
Windows Installer Clean Up
Windows Live
Windows Live Safety Center
Windows Live SkyDrive
Windows Media Connect 2
Windows Media Player
Windows NT
WindowsUpdate
WinRAR
wmp11-windowsxp-x86-FR-FR.exe
xerox
[C51].nfo

============
Lecteur C:
============

2df0be1c7b70d91090233652d8b1
774cf97690075fd37e624681e3918848
8670edef1067db1ef6a52d938fd9cd
9307af7191069f64cce3ef7a
about
ATI
autorun.inf
Bootfont.bin
c6537fe020c1b6565e9e940d81f7e9
c6923f3fd7b38e93fdb95d9af915fd
coktel
Config.Msi
Documents and Settings
Drivers
e41c87ad66d56c23c7a03ee33d
e611fd68d4e861ad934202bcbfbcde
emme
f908eb63c5c8e1fa4aef
FirstSteps
found.000
hegames
I386
IO.SYS
ISP
Kill'em
LGFolder
List'em.txt
MSDOS.SYS
MSWorks
notifier
NTDETECT.COM
ntldr
Office11
pagefile.sys
player
Program Files
RECYCLER
SBSI
scripts
shade
standardframe
SXS
System Volume Information
TCleaner.txt
Temp
titlebar
updatedatfix.log
USB_DRV
window
WINDOWS
xml
~ErdUserProfile.$$$

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Documents and Settings\Balico\Mes documents\TomTom\HOME\Sauvegarde\ONE\Backup01\InternalMemory\Western_Europe_1GB\PatchFilter.dat
C:\Documents and Settings\THOMAS\Bureau\STEPHANIE\Bureau\Patch_Window_A_0_14.exe
C:\Documents and Settings\THOMAS\Mes documents\mes jeux\Need for Speed - Poursuite Infernale 2\Serial NFSHP2.txt
C:\Documents and Settings\THOMAS\Mes documents\Mes vid‚os\Emule films\Programmes\Serial Microsoft Office Ultimate 2007 French Iso-Engine.txt
C:\Documents and Settings\THOMAS\Mes documents\Mes vid‚os\Emule films\Programmes\Serial Nero-9.0.9.4b_trial
C:\Documents and Settings\THOMAS\Mes documents\Mes vid‚os\Emule films\Programmes\Serial Office 2007 Pro French.txt
C:\Documents and Settings\THOMAS\Mes documents\Mes vid‚os\Emule films\Programmes\N‚ro Serial\Serial.txt
C:\Documents and Settings\THOMAS\Mes documents\Mes vid‚os\Emule films\Programmes\Serial Nero-9.0.9.4b_trial\Serials.txt
J:\Balico\Programmes\Serial Microsoft Office Ultimate 2007 French Iso-Engine.txt
J:\Balico\Programmes\Serial Nero-9.0.9.4b_trial
J:\Balico\Programmes\Serial Office 2007 Pro French.txt
J:\Balico\Programmes\N‚ro Serial\Serial.txt
J:\Balico\Programmes\Serial Nero-9.0.9.4b_trial\Serials.txt
J:\Balico\TomTom\HOME\Sauvegarde\ONE\Backup01\InternalMemory\Western_Europe_1GB\PatchFilter.dat
C:\MSWorks\Install.exe
C:\Program Files\Install.exe
J:\Program Files\Install.exe

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Réponse 30 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
14 janv. 2010 à 20:30

Merci à Jacques Gache et Gen-Hackman !!!

Réponse 31 / 111

Utilisateur anonyme
14 janv. 2010 à 22:00

▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'option 2 = Mode Suppression

laisse travailler l'outil.

en fin de scan un rapport s'ouvre

▶ colle le contenu dans ta reponse

Réponse 32 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
15 janv. 2010 à 01:15

Kill'em by g3n-h@ckm@n 1.1.8.3

User : Balico (Administrateurs)
Update on 14/01/2010 by g3n-h@ckm@n ::::: 18:30
Start at: 01:11:01 | 14/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.06GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local | 232,88 Go (60,22 Go free) [446513] | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local | 298,09 Go (68,33 Go free) [WD Disque dur externe] | NTFS
K:\ -> Disque amovible

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

Detections :
==========

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\windows\System32\autorun.inf
"C:\windows\System32\drivers\etc\hosts.msn"
"C:\windows\System32\drivers\lvuvc.hs"
"C:\windows\System32\SIntf16.dll"
Quarantine & Deleted !! : C:\Documents and Settings\Balico\LOCAL Settings\Temp\SSUPDATE.EXE
==============
host file OK !
==============

========
Registry
========
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe
Deleted : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}

============
Disk Cleaned
============

================
Prefetch cleaned
================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Réponse 33 / 111

Utilisateur anonyme
15 janv. 2010 à 12:12

Télécharge OTL de OLDTimer

▶ enregistre le sur ton Bureau.

▶ Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

▶ Coche les 2 cases Lop et Purity

▶ Coche la case devant scan all users

▶ règle-le sur "60 Days"

▶ dans la colonne de gauche , mets tout sur all

ne modifie pas ceci :

"files created whithin" et "files modified whithin"

▶Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

▶▶ Tu feras la meme chose avec le "Extra.txt".

Réponse 34 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
15 janv. 2010 à 19:55

http://www.cijoint.fr/cjlink.php?file=cj201001/cijnTlWimd.txt

Réponse 35 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
15 janv. 2010 à 20:04

http://www.cijoint.fr/cjlink.php?file=cj201001/cijhhSQ1fU.txt

Réponse 36 / 111

Utilisateur anonyme
15 janv. 2010 à 20:13

▶ Télécharge Zeb-Restoreet enregistre ce fichier sur le bureau.

▶-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.

▶-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe

▶- Coche la case devant : sites de confiance

▶- Ne coche aucune autre case

▶-Clique sur Restaurer

▶-Redémarre ton PC

ensuite :

▶ Double clic sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:services
bonjour service

:OTL
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B3D74A13
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:417F5F46
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion]
"Adobe Reader Speed Launcher"=-
"TkBellExe"=-

:files
C:\Documents and Settings\Balico\Mes documents\List_Killem_Install.exe
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
C:\Documents and Settings\Balico\Application Data\Temporary
C:\Documents and Settings\THOMAS\Application Data\Temporary

:commands
[emptytemp]
[start explorer]
[reboot]

▶ Clique sur RunFix pour lancer la suppression.

▶ Poste le rapport.

Réponse 37 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
15 janv. 2010 à 20:38

Et hop ! C'est grave docteur ? :-)

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
Process firefox.exe killed successfully!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== SERVICES/DRIVERS ==========
Service bonjour service stopped successfully!
Service bonjour service deleted successfully!
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:B3D74A13 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:417F5F46 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\\Adobe Reader Speed Launcher not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\\TkBellExe not found.
========== FILES ==========
C:\Documents and Settings\Balico\Mes documents\List_Killem_Install.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses folder moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357} folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86\x86 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} folder moved successfully.
C:\Documents and Settings\Balico\Application Data\Temporary folder moved successfully.
C:\Documents and Settings\THOMAS\Application Data\Temporary folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: All Users

User: Balico
->Temp folder emptied: 208276 bytes
->Temporary Internet Files folder emptied: 6008059 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 215216538 bytes
->Google Chrome cache emptied: 30455941 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 583224 bytes

User: STEPHANIE
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 670 bytes

User: Stéphanie
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 469 bytes
->Java cache emptied: 309858 bytes
->FireFox cache emptied: 21237616 bytes

User: THOMAS
->Temp folder emptied: 5275 bytes
->Temporary Internet Files folder emptied: 136692 bytes
->Java cache emptied: 244635 bytes
->FireFox cache emptied: 16888763 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 169767 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 26009492 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 3725098339 bytes

Total Files Cleaned = 3 855,00 mb

OTL by OldTimer - Version 3.1.25.0 log created on 01142010_203559

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Réponse 38 / 111

Utilisateur anonyme
15 janv. 2010 à 20:40

fais une mise a jour avec malwarebytes et un scan complet

Réponse 39 / 111

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
15 janv. 2010 à 21:43

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3570
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

14/01/2010 21:45:39
mbam-log-2010-01-14 (21-45-39).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 245691
Temps écoulé: 59 minute(s), 17 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Réponse 40 / 111

Utilisateur anonyme
15 janv. 2010 à 21:57

quels soucis persistent ?

balico06 Messages postés 100 Date d'inscription vendredi 8 août 2008 Statut Membre Dernière intervention 17 juillet 2015
15 janv. 2010 à 22:27

Mon soucis c'est que lorsque je veux éteindre mon PC soit en faisant "démarrer/fermer la session/arrêter" ou "démarrer/arrêter", il reboote (ou redémarre comme si j'avais cliqué sur "redémarrer") jusqu'à la page bleue de windows où on choisi l'utilisateur.
De là, un clic sur "arrêter" et il s'éteint rapidement.

Trojan Win32.Banker.fgv

111 réponses

Discussions similaires

Newsletters