voila le rapport:
############################## | FindyKill V5.045 |
# User : jean terrien (Administrateurs) # JEAN-TERRIEN
# Update on 23/06/2010 by El Desaparecido
# Start at: 03:05:18 | 24/06/2010
# Website :
http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com
# AMD Athlon(tm) XP 3000+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 149,04 Go (138,44 Go free) # NTFS
# D:\ # Disque amovible # 969,69 Mo (105,5 Mo free) # FAT
############################## | Processus infectieux stoppés |
"C:\Documents and Settings\jean terrien\Application Data\drivers\winupgro.exe" (1736)
"C:\Documents and Settings\jean terrien\Application Data\m\flec006.exe" (1760)
"C:\WINDOWS\wintems.exe" (2356)
################## | Eléments infectieux |
C:\WINDOWS\ban_list.txt
C:\WINDOWS\mdelk.exe
C:\WINDOWS\wintems.exe
C:\WINDOWS\system32\srosa2.sys
C:\WINDOWS\system32\wfsintwq.sys
C:\Documents and Settings\jean terrien\Application Data\drivers
C:\Documents and Settings\jean terrien\Application Data\drivers\downld
C:\Documents and Settings\jean terrien\Application Data\drivers\winupgro.exe
C:\Documents and Settings\jean terrien\Application Data\m
C:\Documents and Settings\jean terrien\Application Data\m\data.oct
C:\Documents and Settings\jean terrien\Application Data\m\flec006.exe
C:\Documents and Settings\jean terrien\Application Data\m\list.oct
C:\Documents and Settings\jean terrien\Application Data\m\srvlist.oct
C:\Documents and Settings\jean terrien\Application Data\m\shared
C:\Documents and Settings\jean terrien\Local Settings\Temporary Internet Files\Content.IE5\CX2R0TQR\servernames[1].html
################## | Registre |
[HKLM\SYSTEM\CurrentControlSet\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet002\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet003\Services\sK9Ou0s]
[HKLM\SYSTEM\CurrentControlSet\Services\srosa]
[HKLM\SYSTEM\ControlSet001\Services\srosa]
[HKLM\SYSTEM\ControlSet002\Services\srosa]
[HKLM\SYSTEM\ControlSet003\Services\srosa]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
[HKCU\Software\bisoft]
[HKCU\Software\DateTime4]
[HKCU\Software\MuleAppData]
[HKCU\Software\WS4001]
[HKCR\ed2k]
[HKCU\Software\Classes\ed2k]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKU\S-1-5-21-1801674531-2052111302-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKU\S-1-5-21-1801674531-2052111302-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
[HKU\S-1-5-21-1801674531-2052111302-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
[HKU\S-1-5-21-1801674531-2052111302-839522115-1004\Software\bisoft]
[HKU\S-1-5-21-1801674531-2052111302-839522115-1004\Software\DateTime4]
[HKU\S-1-5-21-1801674531-2052111302-839522115-1004\Software\MuleAppData]
[HKCU\Software\Local AppWizard-Generated Applications\key_generator]
[HKCU\Software\Local AppWizard-Generated Applications\winupgro]
[HKU\S-1-5-21-1801674531-2052111302-839522115-1004\Software\Local AppWizard-Generated Applications\key_generator]
[HKU\S-1-5-21-1801674531-2052111302-839522115-1004\Software\Local AppWizard-Generated Applications\winupgro]
################## | Etat |
# Affichage des fichiers cachés : OK
Clé manquante : HKLM\...\SafeBoot | Mode sans echec non fonctionnel !
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# (!) Ip6Fw -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) SharedAccess -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wuauserv -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wscsvc -> Start = 4 ( Good = 2 | Bad = 4 )
################## | ! Fin du rapport # FindyKill V5.045 ! |