Par -feu windows

Le danger des CRACKS : https://forum.malekal.com/viewtopic.php?t=893&start=

@Antipolis a; je veux bien.. enfin, ouvrir un serveur minecraft tu passes aucunement par tout ça hein...

Bonjour.

Bonne idée.
Mais l'auteur du sujet n'a pas l'air d'accepter la possibilité d'une infection virale.

A suivre.

bonjour,

:)

Désolé: pas pu être là plus tôt, voila le rapport après scan/netoyage

RogueKiller V8.7.9 [Nov 25 2013] par Tigzy
mail : tigzyRK<at>gmail<dot>com
Remontees : http://www.adlice.com/forum/
Site Web : https://www.luanagames.com/index.fr.html
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode normal
Utilisateur : Jonak [Droits d'admin]
Mode : Suppression -- Date : 11/26/2013 17:26:08
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 0 ¤¤¤

¤¤¤ Entrees de registre : 6 ¤¤¤
[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REMPLACÉ (2)
[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> REMPLACÉ (1)
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> REMPLACÉ (2)
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> REMPLACÉ (1)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REMPLACÉ (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REMPLACÉ (0)

¤¤¤ Tâches planifiées : 1 ¤¤¤
[V2][SUSP PATH] {74FF0FF1-9E01-4AE4-8050-E11F79E24C75} : C:\Users\Jonak\Desktop\TEST DOFUS\Coeur\SharkEmuv0.8.2.2 By ReB0rNs\SharkEmuv0.8.2.2 By ReB0rNs\Bugs Reporter.exe [x] -> SUPPRIMÉ

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
[ZeroAccess][Fichier] @ : C:\Windows\Installer\{ad9022bf-4b5e-8111-d1fb-7f74aac6fdb6}\@ [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] U : C:\Windows\Installer\{ad9022bf-4b5e-8111-d1fb-7f74aac6fdb6}\U [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] L : C:\Windows\Installer\{ad9022bf-4b5e-8111-d1fb-7f74aac6fdb6}\L [-] --> SUPPRIMÉ
[ZeroAccess][Jonction] fr-FR : C:\Program Files\Windows Defender\fr-FR >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MpAsDesc.dll : C:\Program Files\Windows Defender\MpAsDesc.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MpClient.dll : C:\Program Files\Windows Defender\MpClient.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MpCmdRun.exe : C:\Program Files\Windows Defender\MpCmdRun.exe >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MpCommu.dll : C:\Program Files\Windows Defender\MpCommu.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MpEvMsg.dll : C:\Program Files\Windows Defender\MpEvMsg.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MpOAV.dll : C:\Program Files\Windows Defender\MpOAV.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MpRTP.dll : C:\Program Files\Windows Defender\MpRTP.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MpSvc.dll : C:\Program Files\Windows Defender\MpSvc.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MSASCui.exe : C:\Program Files\Windows Defender\MSASCui.exe >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MsMpCom.dll : C:\Program Files\Windows Defender\MsMpCom.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MsMpLics.dll : C:\Program Files\Windows Defender\MsMpLics.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Jonction] MsMpRes.dll : C:\Program Files\Windows Defender\MsMpRes.dll >> \systemroot\system32\config [-] --> Jonction SUPPRIMÉ
[ZeroAccess][Fichier] 00000008.@ : C:\Windows\Installer\{ad9022bf-4b5e-8111-d1fb-7f74aac6fdb6}\U\00000008.@ [-] --> SUPPRIMÉ

¤¤¤ Driver : [NON CHARGE 0x0] ¤¤¤

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD10EARX-22N0YB0 +++++
--- User ---
[MBR] 8602272621b2c7f68990e01b13cb120b
[BSP] 715d4fbaa035b22c06e8d5e1336f3a4c : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 18432 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 37750784 | Size: 100 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 37955584 | Size: 467667 Mo
3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 995737600 | Size: 467668 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[0]_D_11262013_172608.txt >>
RKreport[0]_S_11262013_172152.txt

oui, encore, même erreur

jonak

Fais ceci

=> https://forums.commentcamarche.net/forum/affich-29183679-par-feu-windows#12

En cours

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.11.26.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16428
Jonak :: CHOUCHOUTTE [administrateur]

26/11/2013 18:26:57
mbam-log-2013-11-26 (18-26-57).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 430123
Temps écoulé: 57 minute(s), 6 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 3
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdateVer.exe.vir (PUP.Optional.DealPly.A) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\Installer\543e041.msi (PUP.Optional.SmartBar.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Jonak\AppData\Local\mysearchdial_speedial_v9.0.2.crx (PUP.Optional.MySearchDial.A) -> Mis en quarantaine et supprimé avec succès.

(fin)

>> Marche toujours pas... je test l"aide suivante ;p

malwarbytes en cours; je fais le lien juste après.

Impossible Pre_Scan (renommé winlogon) n'est pas une application valide Win32

c:\Users\Jonak\Desktop\winlogon.exe n'est pas une application Win32 valide

Avec Avast Désactivé " définitivement '

Plus d'idée ?

Costaux ce logiciel ! tout m'a l'air Ok !

Oui, si tu me dis ou le trouver ^^

désolé du délai.

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan | g3n-h@ckm@n | Saachaa | 3.1126.6 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

~ ¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤ - Start 12:43:33

~ Update on 26/11/2013 | 23.30 by g3n-h@ckm@n
~ Evolution : http://security-helpzone.com/gen-hackman/pre_scan-2/changelog/2013-2/
~ Pre_Script Infos : http://security-helpzone.com/gen-hackman/pre_scan-2/les-switchs-pre_script/
~ Pre_scan Feedbacks : http://security-helpzone.com/gen-hackman/pre_scan-2/retours-bugs/

~ [Jonak (Administrator)] - [CHOUCHOUTTE]
~ SID = S-1-5-21-3458661665-1007077899-1945117035-1000

~ System : Windows 7 Home Premium (64 bits) HomePremium Service Pack 1
~ ProcessorNameString : Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz
~ Identifier : Intel64 Family 6 Model 42 Stepping 7


~ Memory RAM = Total (MB) : 4176 | Free (MB) : 2651
~ Pagefile = Total (MB) : 8350 | Free (MB) : 6840
~ Virtual = Total (MB) : 4194 | Free (MB) : 4047

¤¤¤¤¤¤¤¤¤¤ | Boot's scripts

C:\Windows\Setup\Scripts\MonitorAuto_x64.exe
C:\Windows\Setup\Scripts\MOD01SET5O000N0002.enc
C:\Windows\Setup\Scripts\MOD01SET5O000N0005.enc
C:\Windows\Setup\Scripts\SetupComplete.cmd
C:\Windows\Setup\Scripts\useralaunch.cmd
C:\Windows\Setup\Scripts\OOBE.CMD

¤¤¤¤¤¤¤¤¤¤ | Drives

c:\-> [Fixed] | [Packard Bell] | Total : 467670 Mo | Free : 131920 Mo -> NTFS
d:\-> [Fixed] | [DATA] | Total : 467670 Mo | Free : 467560 Mo -> NTFS
e:\-> [CDROM] | [LOTRBFME] | Total : 4050 Mo | Free : 0 Mo -> UDF
g:\-> [CDROM] | [20100124_200105] | Total : 500 Mo | Free : 0 Mo -> CDFS
h:\-> [CDROM] | [T4-EFG] | Total : 3950 Mo | Free : 0 Mo -> CDFS

¤¤¤¤¤¤¤¤¤¤ | Windows Updates

No windows updates detected !!!


¤¤¤¤¤¤¤¤¤¤ | Sessions

~ C:\Windows\system32\config\systemprofile
~ C:\Windows\ServiceProfiles\LocalService
~ C:\Windows\ServiceProfiles\NetworkService
~ C:\Users\Jonak

New restorepoint created : To restore the registry : C:\Pre_Scan\Save\Scan\ERDNT.exe

Standby deleted !

¤¤¤¤¤¤¤¤¤¤ | stopped Processes

(992) -- atiesrxx.exe
(1416) -- atieclxx.exe
(1636) -- spoolsv.exe
(1968) -- PhotoshopElementsFileAgent.exe
(1088) -- armsvc.exe
(1428) -- AppleMobileDeviceService.exe
(1380) -- mDNSResponder.exe
(1464) -- Garmin.Cartography.MapUpdate.CoreService.exe
(2296) -- GREGsvc.exe
(2356) -- UpdaterService.exe
(2392) -- MaConfigAgent.exe
(2552) -- PnkBstrA.exe
(2728) -- TeamViewer_Service.exe
(2748) -- WUDFHost.exe
(3548) -- taskhost.exe
(3652) -- explorer.exe
(3980) -- IAStorDataMgrSvc.exe
(2864) -- LMS.exe
(2124) -- NASvc.exe
(2144) -- Skype.exe
(2588) -- SearchIndexer.exe
(3020) -- iTunesHelper.exe
(2996) -- wmpnetwk.exe
(4108) -- iPodService.exe
(4652) -- UNS.exe
(3556) -- MOM.exe
(3320) -- CCC.exe
(2232) -- PresentationFontCache.exe
(5000) -- firefox.exe
(1028) -- plugin-container.exe
(4012) -- FlashPlayerPlugin_11_9_900_152.exe
(2372) -- FlashPlayerPlugin_11_9_900_152.exe
(5604) -- SearchProtocolHost.exe
(5884) -- SearchFilterHost.exe

Boot : Normal


¤¤¤¤¤¤¤¤¤¤ | Winlogon User : OK !


¤¤¤¤¤¤¤¤¤¤ | Winlogon Machine

Repaired : [HKLM | Winlogon]|[userinit] : userinit.exe, -> C:\Windows\SysWOW64\userinit.exe,
Repaired : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon]|[userinit] : C:\Windows\SysWOW64\userinit.exe, -> C:\Windows\System32\userinit.exe,

¤¤¤¤¤¤¤¤¤¤ | Associations

Repaired : [HKCR\Folder\shell\open\command] : %SystemRoot%\Explorer.exe -> C:\Windows\Explorer.exe


¤

Repaired : [HKLM\Software\Clients\StartMenuInternet\IExplore.exe\shell\open\command] : C:\Program Files\Internet Explorer\iexplore.exe -> "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

¤¤¤¤¤¤¤¤¤¤ | Registry

Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{9343812e-1c37-4a49-a12e-4b2d810d956b}] : 1 -> 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}] : 1 -> 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{20D04FE0-3AEA-1069-A2D8-08002B30309D}] : 1 -> 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{208D2C60-3AEA-1069-A2D7-08002B30309D}] : 1 -> 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{871C5380-42A0-1069-A2EA-08002B30309D}] : 1 -> 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}] : 1 -> 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{59031a47-3f72-44a7-89c5-5595fe6b30ee}] : 1 -> 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Policies\Explorer]|[NoActiveDesktop] : 1 -> 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Policies\Explorer]|[NoActiveDesktopChanges] : 1 -> 0
Repaired : [HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]|[Hidden] : 1 -> 0
Repaired : [HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel]|[AllItemsIconView] : 0 -> 1

¤¤¤¤¤¤¤¤¤¤ | Taskmgr and Registry Access



¤¤¤¤¤¤¤¤¤¤ | SafeBoot | Control | Repair

Safeboot Keys are O.K

Alternate shell is OK !

¤

Safeboot Minimal Subkeys : O.K !

¤

Safeboot Network Subkeys : O.K !

¤¤¤¤¤¤¤¤¤¤ | IFEO


¤¤¤¤¤¤¤¤¤¤ | Mountpoints2

Deleted : HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{538ba4a8-2cef-11e2-a02d-c89cdcfe90d8} | AutoRun\command : G:\AOMsetup.exe /autorun
Deleted : HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{538ba4a8-2cef-11e2-a02d-c89cdcfe90d8} | directx\command : G:\DirectX\dxsetup.exe
Deleted : HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{538ba4a8-2cef-11e2-a02d-c89cdcfe90d8} | setup\command : G:\AOMsetup.exe
Deleted : HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{9cfaaa71-51cf-11e3-b82a-c89cdcfe90d8} | AutoRun\command : H:\Autorun.exe
Deleted : HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{af439b9d-2ce8-11e2-95cb-c89cdcfe90d8} | AutoRun\command : G:\autorun.exe
Deleted : HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{d90dc034-98e4-11e1-8d2b-806e6f6e6963} | AutoRun\command : E:\Setup.exe
Deleted : HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2\{de72470e-c7a8-11e2-a3e1-c89cdcfe90d8} | AutoRun\command : G:\autorun.exe


Contenu de E:\Autorun.inf :

[autorun]
open=Setup.exe
Icon=lotrbfme.ico
Name=The Battle for Middle-earth

[Special]
Disk=1


Contenu de G:\Autorun.inf :

[autorun]
open=AOMsetup.exe /autorun
icon=AOMGOLD.ico
Name=Age of Mythology Gold

shell\setup=&Installer Age of Mythology Gold
shell\setup\command=AOMsetup.exe

shell\directx=Installer &DirectX 9a
shell\directx\command=DirectX\dxsetup.exe

Contenu de H:\Autorun.inf :

[AutoRun]
open=Autorun.exe
label=Tropico 4
icon=Tropico4.ico

¤¤¤¤¤¤¤¤¤¤ | Windows

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]|[Shell] : SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

Winsrv : OK !


[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]|[AppInit_DLLS] :
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]|[LoadAppInit_DLLs] : 1

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]|[AppInit_DLLS] :
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]|[LoadAppInit_DLLs] : 1

¤¤¤¤¤¤¤¤¤¤ | Security Center




¤¤¤¤¤¤¤¤¤¤ | Services Corrections


Repaired : [HKLM | Services\Compbatt] : 3 -> 0
Repaired : [HKLM | Services\agp440] : 3 -> 2
Repaired : [HKLM | Services\Browser] : 2 -> 3
Repaired : [HKLM | Services\EapHost] : 3 -> 2
Repaired : [HKLM | Services\Wlansvc] : 3 -> 2
Repaired : [HKLM | Services\SharedAccess] : 3 -> 2
Repaired : [HKLM | Services\wudfsvc] : 3 -> 2
Repaired : [HKLM | Services\WerSvc] : 3 -> 2

¤¤¤¤¤¤¤¤¤¤ | Internet Explorer

Repaired : [HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Internet Explorer\Main]|[Start Page] : https://www.google.com/?gws_rd=ssl -> https://www.google.com/?gws_rd=ssl
Repaired : [HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Internet Explorer\Main]|[Local Page] : C:\Windows\system32\blank.htm -> C:\Windows\SysWOW64\blank.htm
Repaired : [HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Internet Explorer\Main]|[Search Page] : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Repaired : [HKLM\Software\Microsoft\Internet Explorer\Main]|[Start Page] : https://www.google.com/?gws_rd=ssl -> https://www.msn.com/fr-fr/?ocid=iehp
Repaired : [HKLM\Software\Microsoft\Internet Explorer\Main]|[Default_Page_URL] : https://www.msn.com/fr-fr/?ocid=iehp -> https://www.msn.com/fr-fr/?ocid=iehp
Repaired : [HKLM\Software\Microsoft\Internet Explorer\AboutURLs]|[Tabs] : https://www.google.com/?gws_rd=ssl -> res://ieframe.dll/tabswelcome.htm

¤

Repaired : [HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\Microsoft\Windows\CurrentVersion\Internet settings]|[WarnonZoneCrossing] : 0 -> 1

¤¤¤¤¤¤¤¤¤¤ | Hosts

C:\Windows\System32\Drivers\etc\hosts : Cleaned

¤¤¤¤¤¤¤¤¤¤ | reparsepoint



¤¤¤¤¤¤¤¤¤¤ | Offsets detection


¤¤¤¤¤¤¤¤¤¤ | Files | Folders | Registry


Deleted : HKU\S-1-5-21-3458661665-1007077899-1945117035-1000\Software\AVS4YOU
Deleted : HKLM\Software\AVS4YOU

Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{9BD0E7F9-2C9D-4B66-A330-0CDA0500583F}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{7924FD51-AF44-404B-9F3E-1AA456BFB89F}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{49D9E931-2837-4935-9351-73B5A124CF55}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{37C46AB4-B3B2-4297-9165-F0A703B916D7}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{2C789183-039F-4C6D-93C9-0EEA692FE77A}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{3098F8C9-82C0-4296-B5A3-0E252584CDA8}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{4F46AE49-A90A-4E8C-80A4-5AFA29BAFC69}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{CD3C8515-6937-403F-8F01-CFE840A6BBBF}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{E2798EDC-5412-4FFA-9963-91A868587F1C}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{949A3E45-46C1-46DC-8EB8-49354513A738}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{A55E6BF4-5919-49DE-9689-0CCE30E6845B}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{4130F71C-114D-4B32-B280-B228750F2FDB}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{73D95912-9CA2-485B-A010-D64044DBB6B6}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{2D65932B-F5D1-49FD-A3EC-4AF83B328D30}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{898D745C-3405-46B8-BC9B-D8618B85669B}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{533C32CD-8CD5-442F-8FB9-0FD9E440A248}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{D2D8F00C-7801-4074-9D63-0EF1259A2A2D}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{5A77E2CE-D3E9-4E46-A331-D4ADDBCD2BD5}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{7D0E0700-3F65-43D0-89A1-BEB65FA53874}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{A9D07A6C-C2A7-4865-90F2-8F3ACC13E618}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{F1C07D92-CD09-4ECA-956C-DA7D3CB5CCC1}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{7E9EF688-E305-42CE-A7D6-966E1580C5B6}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{36E79A35-55F7-4AE8-ABC1-E939A1FBB2CE}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{E31D4531-671B-4340-9F67-8DCAD5A66A85}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{F3C7A42C-7A22-452B-BC98-DF72C2F9BBF5}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{8912CAED-63E2-47B2-AF85-76A11D2BA0E1}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{C5694E44-EBDF-4764-B008-B63E27892D1F}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{B072F356-7ADA-4D8A-B19D-2FCC467CCEE7}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{B10E720B-BF08-41BA-A9C8-A5D74DE6C727}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{108DC1C3-3D5A-4BDE-9817-16E49B401B2E}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{B9EAAC21-9817-4683-B10A-45A0F6D87BD6}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{06B1BB8A-6CC0-48DF-A7E4-7C577C2D4366}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{E7DB66C0-BE5B-4489-8400-E8A280039920}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{F79CE80C-0EFC-43FC-8B9D-F15E3D591EB2}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{3FD0D2A0-FC0C-456D-8337-5791F0500554}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{75753504-981C-4A97-AC4D-55183ED3AE6A}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{B69F045E-566C-4B70-BC47-1012597B5E4A}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{81393106-4D0B-45B1-95B8-D8FF8672600C}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{843EC84F-F8E1-4EDA-97D0-1379D9046372}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{BBC854BD-843A-47C5-8858-5AA60B304E8B}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{9C73DA49-797B-4262-86B6-C8BC3D964CF1}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{249461C5-7D5B-4A0A-895B-6F8EC10A76EA}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{546803CA-4516-441B-918F-A6140EA12024}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{17F393E6-CDF6-4378-AAF7-583C545B9D7C}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{4D87A233-3874-4251-B85E-3217FF953170}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{2718912D-4BF3-409D-9D92-B9106C90F69C}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{220FE40C-C836-4453-8FF0-58C8DB2FFD02}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{E2B30CE3-9F4B-4E74-B0B3-2AC84397122E}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{3454E226-12A2-424C-8EB5-418897FCE27E}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{9AB56C9F-C39B-482F-A21D-3FBDA1569FD7}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{87DAC61B-EB01-457E-ADD3-8E00B15B1515}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{E1C1B5E0-6BB6-489C-81C2-09952900E8F4}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{FB3ADF65-2AC0-49F4-B64E-644D139E5586}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{0523EFB3-054F-4E1C-B7A0-0611A3E8C611}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{EEDA1938-050A-410A-AC1B-27BE527828CC}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{484310FD-1C59-462E-81FF-FC371075EC34}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{EF96E51D-377A-43B1-A1EE-FC75DF486394}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{10EA7783-3D08-433A-824C-74A9BBE841B3}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{465E4BB8-C0E2-437E-B1BA-17A6D859D6B7}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{3F2185DE-672F-40BA-A930-6EB006DF1FC9}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{9E795537-0FD2-4466-9314-865B7C923179}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{E3C74955-7F10-463A-B2C5-D3385CDB12CB}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{1FF4C200-7A31-45B4-8F04-0D2806A4D53B}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{42A7C27E-A659-47CC-A241-1B9BBA57B508}
Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\{B61AF8E7-034F-4B5C-8A15-2F2DF39C1099}
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run : QuickTime Task

Moved to quarantine successfully : C:\Users\Jonak\AppData\Local\fusioncache.dat
Moved to quarantine successfully : C:\Users\Jonak\AppData\Roaming\AVS4YOU
Moved to quarantine successfully : C:\Program Files (x86)\Common Files\AVSMedia
Moved to quarantine successfully : C:\Users\Jonak\AppData\Roaming\WildTangent
Moved to quarantine successfully : C:\Windows\assembly\tmp\
Moved to quarantine successfully : C:\Users\Jonak\AppData\LocalLow\Sun\Java\Deployment\cache\6.0
Moved to quarantine successfully : C:\Users\Jonak\AppData\LocalLow\Sun\Java\Deployment\cache\security

Prefetch -> Emptied


Suspect : C:\Users\Jonak\AppData\Roaming\.minecraft - Copie\lastlogin
Suspect : C:\Users\Jonak\AppData\Roaming\.minecraft\lastlogin
Suspect : C:\Users\Jonak\AppData\Roaming\Dofus2\path.d2p
Suspect : C:\Users\Jonak\AppData\Roaming\Awesomium\Local State
Suspect : C:\Users\Jonak\AppData\Roaming\redsn0w\Keys_618122727361638152.plist
Suspect : C:\Users\Jonak\AppData\Roaming\Mumble\mumble.sqlite-journal
Suspect : C:\Users\Jonak\AppData\Roaming\Mumble\mumble.sqlite
Suspect : C:\ProgramData\BitRaider\swtor_swtor.bitraid
Suspect : C:\Users\Jonak\AppData\Local\MicrosoftStore\downloader.bundle
Suspect : C:\Users\Jonak\AppData\Local\MicrosoftStore\launcher.bundle
Suspect : C:\Users\Jonak\AppData\Local\libimobiledevice\RootPrivateKey.pem
Suspect : C:\Users\Jonak\AppData\Local\libimobiledevice\HostPrivateKey.pem
Suspect : C:\Users\Jonak\AppData\Local\libimobiledevice\RootCertificate.pem
Suspect : C:\Users\Jonak\AppData\Local\libimobiledevice\HostCertificate.pem
Suspect : C:\Users\Jonak\AppData\Local\libimobiledevice\60096339a197d61dbfa9cdd0cea9cd177a93ea33.pem
Suspect : C:\Users\Jonak\AppData\Local\libimobiledevice\libimobiledevicerc

D:\ : Vaccinated (Vaccin created by Pre_Scan)

¤¤¤¤¤¤¤¤¤¤ | Hidden files

~ [Drive C:] : Hidden : 4 | Restored : 4
~ [Program Files] : Hidden : 3 | Restored : 3
~ [Users] : Hidden : 2 | Restored : 2
~ [Music] : Hidden : 2 | Restored : 2
~ [Documents] : Hidden : 3 | Restored : 3
~ [Desktop] : Hidden : 1 | Restored : 1
~ [Searches] : Hidden : 2 | Restored : 2
~ [Windows] : Hidden : 121 | Restored : 121
~ [Start Menu | Programs | Startup] : Hidden : 1 | Restored : 1
~ [Libraries] : Hidden : 28 | Restored : 28


¤¤¤¤¤¤¤¤¤¤ | Listing Partition(s)

Disk: 0 Size=954G
Pos MBRndx Type/Name Size Active Hide Start Sector Sectors
--- ------ ---------- ---- ------ ---- ------------ ------------
0 0 27-UNKNWN 18G No No 2,048 37,748,736
1 1 07-NTFS 100M Yes No 37,750,784 204,800
2 2 07-NTFS 468G No No 37,955,584 957,782,016
3 3 07-NTFS 468G No No 995,737,600 957,784,064

¤¤¤¤¤¤¤¤¤¤

[HKLM64 | Winlogon]|[AutoRestartShell] : 1

End : 12:53:39


Standby Restored !
¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤ - 378