Infecté par un trojan bagle ?Fermé

Question

Bonjour,
Je ne peux plus lancer mon anti virus kaspersky 7 et mes anti malwares.
il me met application win 32 non valide
a savoir que j'avais telechargé un crack et j'ai effacé ce fameux fichier mais je crois que que j'ai chopé un trojan ( bagle)
de plus hijack this ne marche plus même en le ré-installant.
J'ai essayer de lancer elibagla et il m'a detecté un bagle voici le rapport : 

	  Thu May 29 01:21:39 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\LIST.OCT --> Eliminado Bagle
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Thu May 29 01:22:00 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Thu May 29 01:22:58 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Thu May 29 01:23:38 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Thu May 29 01:24:54 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.

	  Thu May 29 01:25:20 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Thu May 29 01:27:34 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Thu May 29 01:27:42 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   3732
Nº Total de Ficheros:      28997
Nº de Ficheros Analizados: 8490
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Thu May 29 01:30:35 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios:   0
Nº Total de Ficheros:      0
Nº de Ficheros Analizados: 0
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Thu May 29 01:31:01 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\FLEC006.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Reinicie para Completar la Limpieza.

	  Thu May 29 01:31:30 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios:   0
Nº Total de Ficheros:      0
Nº de Ficheros Analizados: 0
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Thu May 29 01:31:42 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad G:\

Nº Total de Directorios:   873
Nº Total de Ficheros:      11952
Nº de Ficheros Analizados: 2002
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Thu May 29 01:32:12 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad H:\

Nº Total de Directorios:   5628
Nº Total de Ficheros:      16215
Nº de Ficheros Analizados: 297
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Thu May 29 01:34:40 2008
EliBagle v11.43  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 28 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\FLEC006.EXE.Muestra EliBagle v11.43
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\HART\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Reinicie para Completar la Limpieza.



comment enlever ce trojan
j'ai essayé de faire un scan en mode sans echec avec  malwarebytes il m'a trouvé 180 fichiers infectes , j'ai donc fais un delete et quarantaine pour cela :

Mais quand je reviens en mode normal tjrs prob d'install d'un anti virus
hijackthis ne marche pas ainsi que les autres malwares
merci de votre aide

Utilisateur anonyme · Answer

salut,
ah les crack....:)

essaye un scan en ligne :

fait un scan en ligne avec internet explore, si tu as firefox fait: 
démarrer -> executer -> tape : iexplore (puis valide) 

(coche toutes les cases à chaque fois) : 
https://www.eset.com/ 

à la fin colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt 

si ta besoin d'aide tu as un tutoriel ici : http://bibou0007.com/tutos-et-lexique-f45/tutorial-nod32-online-scanner-t128.htm

hart07 · Answer

de plus j'ai une fenetre qui s'ouvre en mettant selcet file to crack 
quand l'ordi plante et se relance tout seul et qu'ensuite je clicke sur elibagla.exe
je vais faire ta procedure
je te tiens au courant merci

hart07 · Answer

voila le rapport apparement rien trouvé



version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3142 (20080528)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=b9dd53efa241e043924a942089c48dd1
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2008-05-29 12:56:18
# local_time=2008-05-29 02:56:18 (+0100, Paris, Madrid (heure d'été))
# country="France"
# osver=5.1.2600 NT Service Pack 2
# scanned=232628
# found=0
# scan_time=1867

hart07 · Answer

actuellement tjrs problème car si j'installe hijackthis , je vous juste la fenetre d'install puis elle disparait ensuite donc impossible de faire l'install.
que faire
merci

hart07 · Answer

je viens de lancer combofix en le renomant en combo-fix.exe pour pouvoir le lancer sans que le trojan le detecte : voici le rapport : ComboFix 08-05-28.4 - Hart 2008-05-29 4:10:37.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1549 [GMT 2:00] Endroit: C:\Documents and Settings\Hart\Bureau\Combo-Fix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Hart\Application Data\m C:\Documents and Settings\Hart\Application Data\m\shared C:\Documents and Settings\Hart\Application Data\m\shared\.!.Kaspersky.Antivirus.Personal.6.0.Crack-Serial-Keygen.zip C:\Documents and Settings\Hart\Application Data\m\shared\12Ghosts FileDate 8.11 (Key+Serial).zip C:\Documents and Settings\Hart\Application Data\m\shared\365 Beautiful California Screen Saver 2.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\3D Mummys Tomb 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\3D Spring Blossoms 1.0 Crack.zip C:\Documents and Settings\Hart\Application Data\m\shared\4Musics WMA to OGG Converter 4.0 (Serial).zip C:\Documents and Settings\Hart\Application Data\m\shared\70-528 Practice Exam Testing Engine Software 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\8051 Hex Code Explorer 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Aarons Clicker 2.89 [Key].zip C:\Documents and Settings\Hart\Application Data\m\shared\AbleFtp 7.11.zip C:\Documents and Settings\Hart\Application Data\m\shared\AdaptedKeys 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Advanced Port Scanner 1.3.zip C:\Documents and Settings\Hart\Application Data\m\shared\Advanced Serial Port Monitor 3.7.0 build 12 [Serial].zip C:\Documents and Settings\Hart\Application Data\m\shared\Advanced Spyware Remover 1.94.zip C:\Documents and Settings\Hart\Application Data\m\shared\Age of Mythology - Nice Day 2 scenario.zip C:\Documents and Settings\Hart\Application Data\m\shared\Aiglon Web Server 2.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\AIPL SpinCycle 2.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Ajax-Controls.NET 1.2.zip C:\Documents and Settings\Hart\Application Data\m\shared\AlbumIt! 1.0 Key+Serial.zip C:\Documents and Settings\Hart\Application Data\m\shared\AlertTAPE 4.1 Crack.zip C:\Documents and Settings\Hart\Application Data\m\shared\Aloaha POP3 SDK 2.1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Any Capture Screen 3.12 build 3121.zip C:\Documents and Settings\Hart\Application Data\m\shared\AOK MP3 Organizer 4.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Apatar Data Mashup Integration 1.0 [Cracked].zip C:\Documents and Settings\Hart\Application Data\m\shared\Argente - StartUp Manager 1.5.0.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\ASP XMLMaker 3.0 (Serial).zip C:\Documents and Settings\Hart\Application Data\m\shared\Astrology Writer 1.0 [Patch].zip C:\Documents and Settings\Hart\Application Data\m\shared\At Your Service 3.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Atlanta Falcons Screensaver 2.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Bannershop GIF Animator 5.0.8.zip C:\Documents and Settings\Hart\Application Data\m\shared\Battlefield Vietnam v1.1 server fix.zip C:\Documents and Settings\Hart\Application Data\m\shared\Beavis and Butt-head Bunghole In One demo.zip C:\Documents and Settings\Hart\Application Data\m\shared\BidSlayer 3.5.2 KeyGen.zip C:\Documents and Settings\Hart\Application Data\m\shared\Bigeye Pro 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Bigfoot Hunter 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Binaware Error Messages 2006 R1 - 1.0.0.26.zip C:\Documents and Settings\Hart\Application Data\m\shared\Bingo Caller 1.22 (Patch).zip C:\Documents and Settings\Hart\Application Data\m\shared\BITDEFENDER.9.0.PRO.plus.FR.+.key.(_`_._._[.(keskia)]_._.___).zip C:\Documents and Settings\Hart\Application Data\m\shared\Blaze Editor 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\BubbleIP 1.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\CCNT Free Practice Exam Questions 1.0 [Patch].zip C:\Documents and Settings\Hart\Application Data\m\shared\CD FrontEnd Gold 2007.16.207.zip C:\Documents and Settings\Hart\Application Data\m\shared\Cerberus FTP Server 2.45.zip C:\Documents and Settings\Hart\Application Data\m\shared\Chameleon Folder 1.4.zip C:\Documents and Settings\Hart\Application Data\m\shared\Chord keyboard major online 1.07.zip C:\Documents and Settings\Hart\Application Data\m\shared\CHP Incident Information 1.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Command & Conquer Generals - Tournament Mountains map.zip C:\Documents and Settings\Hart\Application Data\m\shared\Components Engine Viewer 4.3.2.zip C:\Documents and Settings\Hart\Application Data\m\shared\CustomerReach 3.0.263.zip C:\Documents and Settings\Hart\Application Data\m\shared\DanceForce 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\DeepBurner Free 1.8.zip C:\Documents and Settings\Hart\Application Data\m\shared\DelMar Envelopes Easy 2.2 (Patch).zip C:\Documents and Settings\Hart\Application Data\m\shared\Deltacrypt OneClick Public Key File Encryption 2.1 [Patch].zip C:\Documents and Settings\Hart\Application Data\m\shared\DemoScripter 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Distcc 2.10.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Domeru DVD to Zune Converter + Video to Zune Converter Suite 3.6.5 (Crack).zip C:\Documents and Settings\Hart\Application Data\m\shared\dRAMatic 9.0 (Key+Serial).zip C:\Documents and Settings\Hart\Application Data\m\shared\DUIL (Dynamic User Interface logic) 1.2.0.3.zip C:\Documents and Settings\Hart\Application Data\m\shared\DwgConverter 3.6.0.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\E-Gold Flash Button Creator 1.1 Patch.zip C:\Documents and Settings\Hart\Application Data\m\shared\Easy PDF Publisher 2.5.2 (Patch).zip C:\Documents and Settings\Hart\Application Data\m\shared\EasyForYou - Invoice and inventory 5.11.300 [Cracked].zip C:\Documents and Settings\Hart\Application Data\m\shared\EMS DB Extract 2005 for MySQL 2.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Emsa PC FlexInfo 1.0.57.zip C:\Documents and Settings\Hart\Application Data\m\shared\Epson Stylus Color 440 USB Driver 5.5AE.zip C:\Documents and Settings\Hart\Application Data\m\shared\ES JInputMaskTextField 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Excel Find and Replace In Multiple Files Software 7.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Extra Utility Tools For Microsoft Excel 3.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\FAQTool 1.0.1 Key.zip C:\Documents and Settings\Hart\Application Data\m\shared\FAS Calculator 1.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\FastSpa Modbus OPC Server 2.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\File Backup Watcher Professional 2.7.10R1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Finding Neverland Trailer.zip C:\Documents and Settings\Hart\Application Data\m\shared\FormFuscator 1.2 (Crack).zip C:\Documents and Settings\Hart\Application Data\m\shared\Freddy - Episode 1 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Free Video to iPhone Converter 1.2.1.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\GetPDF Terminal Server 2.21 [Serial].zip C:\Documents and Settings\Hart\Application Data\m\shared\Googly-Eyes 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Gumboy Crazy Features 1.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Handy Patients Personal edition 4.3b.zip C:\Documents and Settings\Hart\Application Data\m\shared\Headache Diary 5.9.zip C:\Documents and Settings\Hart\Application Data\m\shared\HealthEngage Depression 3.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Hearts of Iron 1.05 patch (Asian).zip C:\Documents and Settings\Hart\Application Data\m\shared\HTML Coloring Guide 2.1.684.zip C:\Documents and Settings\Hart\Application Data\m\shared\i.Xchange MP3 editor 3.3.5 Crack.zip C:\Documents and Settings\Hart\Application Data\m\shared\Illusionae 2.21.zip C:\Documents and Settings\Hart\Application Data\m\shared\Inbox Cleaner 1.0.3 (Crack).zip C:\Documents and Settings\Hart\Application Data\m\shared\Intelliant OCR 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Internet Connection Watcher 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Internet Usage Monitor Lite 7.7.zip C:\Documents and Settings\Hart\Application Data\m\shared\IPAccounting 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Irivium Explorer 8.7.6.zip C:\Documents and Settings\Hart\Application Data\m\shared\Jigsaw Puzzle Promo Creator 2.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\JrDebugLogger 1.01.18.zip C:\Documents and Settings\Hart\Application Data\m\shared\JurikSoft Proxy Provider 1.1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Kaspersky.Internet.Security.2008_06_29_001C8F09.KEY.zip C:\Documents and Settings\Hart\Application Data\m\shared\Leads Master Pro 1.0 [Crack].zip C:\Documents and Settings\Hart\Application Data\m\shared\Learn Spanish Slideshow 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Littleeye Network Monitor 3.zip C:\Documents and Settings\Hart\Application Data\m\shared\MadLogic ScreenShot 1.5.zip C:\Documents and Settings\Hart\Application Data\m\shared\madPROFI 2312.zip C:\Documents and Settings\Hart\Application Data\m\shared\Magic Button 2.0 build 51023.zip C:\Documents and Settings\Hart\Application Data\m\shared\MailBee SSL 5.2 Key+Serial.zip C:\Documents and Settings\Hart\Application Data\m\shared\Maitreya 4.2.2.zip C:\Documents and Settings\Hart\Application Data\m\shared\Man With A Cause 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Maze Cube 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\MemoCode 3.0.11 Build 188 (Serial).zip C:\Documents and Settings\Hart\Application Data\m\shared\Metriscope SQL Server package 0.9.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Microangelo On Display 6.10.0008 Serial.zip C:\Documents and Settings\Hart\Application Data\m\shared\MicroChart 2000 8.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Mipsis Product Catalog 2.zip C:\Documents and Settings\Hart\Application Data\m\shared\MLP-Class 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\MrDiary 1.96.zip C:\Documents and Settings\Hart\Application Data\m\shared\MSDict Concise Oxford-Paravia Italian Dictionary (Pocket PC) 4.30.zip C:\Documents and Settings\Hart\Application Data\m\shared\MsgConnect 1.57 [With Crack].zip C:\Documents and Settings\Hart\Application Data\m\shared\MSIDIFF 07.0.064.zip C:\Documents and Settings\Hart\Application Data\m\shared\muveeNow 2.1 (Cracked).zip C:\Documents and Settings\Hart\Application Data\m\shared\mVoice 5.0.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\my CASH BOX (POS) 1.0 [Patch].zip C:\Documents and Settings\Hart\Application Data\m\shared evers 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Neverwinter Nights Birthright of the North Campaign.zip C:\Documents and Settings\Hart\Application Data\m\shared\NS0-121 - Network Appliance Data ONTAP Advanced Exam 7G Practice Exam Questions 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Outlook Email Verifier 1.10 With Crack.zip C:\Documents and Settings\Hart\Application Data\m\shared\Panda.Antivirus.Firewall.2007.zip C:\Documents and Settings\Hart\Application Data\m\shared\PARIS AUDIO Guide MP3 MP4 v. 5.8.zip C:\Documents and Settings\Hart\Application Data\m\shared\PBBalloon & PBTray 2.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\PDFNet SDK for .NET 3.16.zip C:\Documents and Settings\Hart\Application Data\m\shared\PDFspy 1.0 Crack.zip C:\Documents and Settings\Hart\Application Data\m\shared\PhaseOut 5.4.4.zip C:\Documents and Settings\Hart\Application Data\m\shared\Photo History Doc 1.2.0.3.zip C:\Documents and Settings\Hart\Application Data\m\shared\PhotoMeister 2.6 [KeyGen].zip C:\Documents and Settings\Hart\Application Data\m\shared\Places I'd Rather Be Screensaver 2.3.1 (Crack).zip C:\Documents and Settings\Hart\Application Data\m\shared\PopUps Blocker 3.13.5.zip C:\Documents and Settings\Hart\Application Data\m\shared\Portals of Arnak 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Printer Squirrel 2.0.5.zip C:\Documents and Settings\Hart\Application Data\m\shared\Professional Icon Set 3.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Project Manager 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\QMSys Tolerances and Fits 3.1 Cracked.zip C:\Documents and Settings\Hart\Application Data\m\shared\QuadroNoid - The Magic Worlds 1.7.zip C:\Documents and Settings\Hart\Application Data\m\shared\Quebec Toolbar 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\quick3D Professional 4.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\QuickUPX-Win32 Shell 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\RCDD Practice Exam Testing Engine Software 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Reach for the Stars demo.zip C:\Documents and Settings\Hart\Application Data\m\shared\Regards 1.0.3.2.zip C:\Documents and Settings\Hart\Application Data\m\shared\Registry Comparison 3.200.zip C:\Documents and Settings\Hart\Application Data\m\shared\Remote Agent Extension for Network File Monitor 2.20.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\RemoteScan 4.3 Patch.zip C:\Documents and Settings\Hart\Application Data\m\shared\ReviewWriter 2007 1.0 (Key+Serial).zip C:\Documents and Settings\Hart\Application Data\m\shared\RMOEdit 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\RPG Patsy 4.5.zip C:\Documents and Settings\Hart\Application Data\m\shared\Scores 1.1c.zip C:\Documents and Settings\Hart\Application Data\m\shared\sendmefile torrent toolbar for IE 4.5.126.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\ServerBrowse 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\ShowDirector for PowerPoint 2.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Shutdown Scheduler 3.1.3.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Snappy Snippets 1.0.5 Serial.zip C:\Documents and Settings\Hart\Application Data\m\shared\Soldier of Fortune II Double Helix Carpathian Estates map.zip C:\Documents and Settings\Hart\Application Data\m\shared\Soldier of Fortune II Double Helix Dutch Apartments Map.zip C:\Documents and Settings\Hart\Application Data\m\shared\Spyware Sledgehammer 2.2.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\SpyWareNuker 4.8.85.1815 With Crack.zip C:\Documents and Settings\Hart\Application Data\m\shared\ST Invoice Standard 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\StartUp Tool 1.3.zip C:\Documents and Settings\Hart\Application Data\m\shared\Strong Contact 1.00.zip C:\Documents and Settings\Hart\Application Data\m\shared\SuperScan 1.24.zip C:\Documents and Settings\Hart\Application Data\m\shared\Talking English-Spanish Health Care Phrases 5.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\TCAD for Delphi&BCB&Kylix 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Team America World Police Trailer.zip C:\Documents and Settings\Hart\Application Data\m\shared\The DA Toolbar 4.5.145.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\TOEFL Secrets Study Guide.zip C:\Documents and Settings\Hart\Application Data\m\shared\Toolbar Studio 1.0 [Crack].zip C:\Documents and Settings\Hart\Application Data\m\shared\Total pic menu 1.6 [Key].zip C:\Documents and Settings\Hart\Application Data\m\shared\Total Video2DVD Author 2.00.zip C:\Documents and Settings\Hart\Application Data\m\shared\Transparent Controls ActiveX 1.3.zip C:\Documents and Settings\Hart\Application Data\m\shared\Transposer 2.0 Patch.zip C:\Documents and Settings\Hart\Application Data\m\shared\Tray Calendar - MicroCalendar 2.0.1.6.zip C:\Documents and Settings\Hart\Application Data\m\shared\Tree2HTML 0.4.zip C:\Documents and Settings\Hart\Application Data\m\shared\Tweaki...for Power Users v4.3.5.zip C:\Documents and Settings\Hart\Application Data\m\shared\uCertify - OCP Practice Test for Exam 1Z0-031 - 280+ Questions 8.00.05.zip C:\Documents and Settings\Hart\Application Data\m\shared\UltraSnap Pro 2.2.zip C:\Documents and Settings\Hart\Application Data\m\shared\Understand for Delphi 1.4 Build 375.zip C:\Documents and Settings\Hart\Application Data\m\shared\Unreal Tournament 2003 - Head Pack mod.zip C:\Documents and Settings\Hart\Application Data\m\shared\Userbase - Software Sales Tracking 1.5 Serial.zip C:\Documents and Settings\Hart\Application Data\m\shared\VBA Password Recovery 1.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Video Poker 5000 1.2.6.zip C:\Documents and Settings\Hart\Application Data\m\shared\Visage PC Surveillance 2.4 Build 73.zip C:\Documents and Settings\Hart\Application Data\m\shared\Vista Upgrade Prank 1.00.zip C:\Documents and Settings\Hart\Application Data\m\shared\VISUAL BASIC .NET FOR KIDS 2.0 Key+Serial.zip C:\Documents and Settings\Hart\Application Data\m\shared\Visual Basic 5.0 Runtime Module 5.00.4319.zip C:\Documents and Settings\Hart\Application Data\m\shared\Visual Similarity Duplicate Image Finder 1.8.0.2 Serial.zip C:\Documents and Settings\Hart\Application Data\m\shared\Web Update Wizard 4.0.0.10 [Serial].zip C:\Documents and Settings\Hart\Application Data\m\shared\Wine Maker Online 2005.zip C:\Documents and Settings\Hart\Application Data\m\shared\WinISO 5.3.zip C:\Documents and Settings\Hart\Application Data\m\shared\WNBA Ticker 2.0.zip C:\Documents and Settings\Hart\Application Data\m\shared\Word FindReplacer 1.0.1.zip C:\Documents and Settings\Hart\Application Data\m\shared\Worms World Party 1.zip C:\Documents and Settings\Hart\Application Data\m\shared\XmlSendmail 1.4.zip C:\Documents and Settings\Hart\Application Data\m\shared\ZipBot 1.0.zip C:\windows\system32\drivers\downld C:\windows\system32\drivers\downld\103171.exe C:\windows\system32\drivers\downld\127125.exe C:\windows\system32\drivers\downld\140890.exe C:\windows\system32\drivers\downld\155593.exe C:\windows\system32\drivers\downld\155703.exe C:\windows\system32\drivers\downld\220765.exe C:\windows\system32\drivers\downld\236406.exe C:\windows\system32\drivers\downld\240593.exe C:\windows\system32\drivers\downld\292015.exe C:\windows\system32\drivers\downld\299781.exe C:\windows\system32\drivers\downld\305343.exe C:\windows\system32\drivers\downld\45062.exe C:\windows\system32\drivers\downld\65546.exe C:\windows\system32\drivers\downld\71828.exe C:\windows\system32\drivers\downld\733281.exe C:\windows\system32\drivers\downld\748968.exe C:\windows\system32\drivers\downld\79093.exe C:\windows\system32\drivers\downld\930937.exe C:\windows\system32\drivers\downld\960343.exe C:\windows\system32\drivers\downld\985390.exe C:\windows\system32\drivers\hldrrr.exe C:\windows\system32\drivers\mdelk.exe C:\windows\system32\drivers\srosa.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SROSA ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-28 to 2008-05-29 )))))))))))))))))))))))))))))))))))) . 2008-05-29 04:13 . 2008-05-29 04:13 d-------- C:\WINDOWS\system32\drivers\downld 2008-05-29 02:23 . 2008-05-29 02:56 d-------- C:\Program Files\EsetOnlineScanner 2008-05-29 01:38 . 2007-06-16 20:39 d--h----- C:\Documents and Settings\Administrateur.HART-435D30ED1E\Voisinage r‚seau 2008-05-29 01:38 . 2007-06-16 20:39 d--h----- C:\Documents and Settings\Administrateur.HART-435D30ED1E\Voisinage d'impression 2008-05-29 01:38 . 2007-06-16 18:45 d--h----- C:\Documents and Settings\Administrateur.HART-435D30ED1E\ModŠles 2008-05-29 01:38 . 2007-06-16 20:39 d-------- C:\Documents and Settings\Administrateur.HART-435D30ED1E\Mes documents 2008-05-29 01:38 . 2007-06-16 20:39 dr------- C:\Documents and Settings\Administrateur.HART-435D30ED1E\Menu D‚marrer 2008-05-29 01:38 . 2007-06-16 20:39 d-------- C:\Documents and Settings\Administrateur.HART-435D30ED1E\Favoris 2008-05-29 01:38 . 2008-05-29 01:43 d-------- C:\Documents and Settings\Administrateur.HART-435D30ED1E\Bureau 2008-05-29 01:38 . 2008-05-29 01:38 d-------- C:\Documents and Settings\Administrateur.HART-435D30ED1E\Application Data\Malwarebytes 2008-05-29 01:38 . 2008-05-29 01:38 d-------- C:\Documents and Settings\Administrateur.HART-435D30ED1E 2008-05-29 01:35 . 2008-05-29 01:35 d-------- C:\Documents and Settings\Hart\Application Data\Malwarebytes 2008-05-29 01:35 . 2008-05-29 01:35 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-05-29 01:35 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-05-29 01:35 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-05-29 01:25 . 2008-05-29 01:31 d-------- C:\Muestras 2008-05-29 00:27 . 2008-05-29 00:27 d-------- C:\Program Files\Utilitaire de gestion du LAN Wifi IEEE 802.11g 2008-05-29 00:27 . 2004-09-24 18:12 929,792 --a------ C:\WINDOWS\system32\AegisE5.dll 2008-05-29 00:27 . 2004-09-24 18:12 651,264 --a------ C:\WINDOWS\system32\libeay32.dll 2008-05-29 00:27 . 2004-09-24 18:12 381,312 --a------ C:\WINDOWS\system32\drivers\WlanUIG.sys 2008-05-29 00:27 . 2004-09-24 18:12 147,456 --a------ C:\WINDOWS\system32\ssleay32.dll 2008-05-29 00:27 . 2004-09-24 18:12 15,781 --a------ C:\WINDOWS\system32\drivers\mdc8021x.sys 2008-05-28 22:50 . 2008-05-28 22:50 249 --a------ C:\WINDOWS\prtsc.INI 2008-05-28 22:47 . 2000-08-25 09:48 184,320 --a------ C:\WINDOWS\amuninst.exe 2008-05-28 22:47 . 2008-05-28 22:47 304 --a------ C:\WINDOWS\unprt.ini 2008-05-28 18:29 . 2008-05-28 18:29 d-------- C:\WINDOWS eufBOX_ADSL 2008-05-25 05:49 . 2008-05-25 05:56 1,829 --a------ C:\WINDOWS\iris.ini 2008-05-24 04:00 . 2008-05-24 04:00 d-------- C:\Program Files\MySpace 2008-05-24 04:00 . 2008-05-24 04:00 d-------- C:\Documents and Settings\Hart\Application Data\MySpace 2008-05-23 20:17 . 2008-05-23 20:29 d-------- C:\Documents and Settings\Hart\Application Data\gtk-2.0 2008-05-23 20:17 . 2008-05-23 20:17 d-------- C:\Documents and Settings\Hart\.thumbnails 2008-05-23 19:54 . 2008-05-27 04:05 d-------- C:\Documents and Settings\Hart\.gimp-2.4 2008-05-21 04:59 . 2008-05-29 01:00 d-------- C:\fixwareout 2008-05-18 06:18 . 2008-05-18 06:18 d-------- C:\Program Files\Neuf 2008-05-09 03:01 . 2008-05-09 03:01 d-------- C:\Program Files\MSXML 4.0 2008-05-09 03:01 . 2004-08-05 14:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-05-08 22:35 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-05-08 22:35 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-05-08 22:35 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-05-08 18:52 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-05-08 18:51 . 2008-05-08 18:51 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-08 18:44 . 2008-05-22 23:03 d-------- C:\Program Files\Windows Live 2008-05-08 18:44 . 2008-05-08 18:48 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-05-08 18:44 . 2008-05-08 18:44 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-08 18:19 . 2006-12-30 19:27 7,208 --------- C:\WINDOWS\system32\secupd.sig 2008-05-08 18:19 . 2006-12-30 19:27 7,208 --a--c--- C:\WINDOWS\system32\dllcache\secupd.sig 2008-05-08 18:19 . 2006-12-30 19:27 4,569 --------- C:\WINDOWS\system32\secupd.dat 2008-05-08 18:19 . 2006-12-30 19:27 4,569 --a--c--- C:\WINDOWS\system32\dllcache\secupd.dat 2008-05-08 17:56 . 2008-05-09 03:14 d-------- C:\WINDOWS\system32\CatRoot_bak 2008-05-08 17:55 . 2008-05-13 22:12 d--h----- C:\WINDOWS\$hf_mig$ 2008-05-08 17:51 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-05-08 17:51 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-05-08 17:51 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-05-08 17:51 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-05-07 19:19 . 2008-05-07 19:19 d-------- C:\Documents and Settings\Hart\Application Data\EBP 2008-05-07 19:19 . 2008-05-07 20:09 d-------- C:\Documents and Settings\Hart\Application Data\Comptabilit‚ et Facturation 2008-05-07 19:08 . 2008-05-07 20:09 2,048 --a------ C:\MKDEWE.TRN 2008-05-07 19:07 . 2008-05-07 19:07 d-------- C:\Program Files\EBP 2008-05-07 19:07 . 2006-05-10 14:18 1,929,216 --a------ C:\WINDOWS\system32\cdintf250.dll 2008-05-06 00:44 . 2008-05-06 00:44 d-------- C:\Documents and Settings\All Users\Application Data\eMule . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-28 23:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-28 22:27 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-28 22:25 116,432 --sha-w C:\windows\system32\drivers\fidbox2.idx 2008-05-28 22:25 106,932,256 --sha-w C:\windows\system32\drivers\fidbox.dat 2008-05-28 22:25 1,430,216 --sha-w C:\windows\system32\drivers\fidbox.idx 2008-05-28 22:25 1,202,720 --sha-w C:\windows\system32\drivers\fidbox2.dat 2008-05-28 17:04 96,966 ----a-w C:\windows\system32\drivers\klin.dat 2008-05-28 17:04 88,262 ----a-w C:\windows\system32\drivers\klick.dat 2008-05-27 18:28 --------- d-----w C:\Documents and Settings\Hart\Application Data\vlc 2008-05-07 18:09 --------- d-----w C:\Documents and Settings\Hart\Application Data\Comptabilité et Facturation 2008-05-07 01:25 --------- d-----w C:\Documents and Settings\Hart\Application Data\Vso 2008-04-02 13:42 --------- d-----w C:\Documents and Settings\Hart\Application Data\TransRender 2008-04-02 13:42 --------- d-----w C:\Documents and Settings\Hart\Application Data\Temporary 2008-03-25 04:51 621,344 ----a-w C:\windows\system32\mswstr10.dll 2008-03-25 04:51 194,144 ----a-w C:\windows\system32\msjint40.dll 2008-03-20 08:09 1,845,376 ----a-w C:\windows\system32\win32k.sys 2006-06-23 06:48 32,768 -c--a-r C:\windows\inf\UpdateUSB.exe 2006-05-03 09:06 163,328 --sh--r C:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r C:\windows\system32\msfDX.dll . ------- Sigcheck ------- 2008-04-14 04:34 512000 dd73d6b9f6b4cb630cf35b438b540174 C:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\winlogon.exe 2007-06-16 19:03 506368 86db0fdaf2591c86389d36cf44658cfe C:\windows\system32\winlogon.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\windows\system32\ctfmon.exe" [2004-08-05 14:00 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinampAgent"="G:\program files\Winamp\winampa.exe" [2004-08-20 10:04 692224] "RunpdplusManager"="pdplusnt.exe" [2002-03-20 01:10 602112 C:\WINDOWS\system32\pdplusnt.exe] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-02-08 09:48 135168] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-02-08 09:48 159744] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-02-08 09:48 131072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll "midi"= rddv1009.dll "vidc.yv12"= yv12vfw.dll "msacm.ac3filter"= ac3filter.acm "wave"= pdplusr.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal ga.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check.lnk backup=C:\windows\pss\EPSON Status Monitor 3 Environment Check.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 23:16 39792 G:\program files\Adobe\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2006-11-12 12:48 157592 G:\program files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-03-18 07:57 185896 C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "WLSetupSvc"=3 (0x3) "usnjsvc"=3 (0x3) "ose"=3 (0x3) "IDriverT"=3 (0x3) "AVP"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "G:\program files\DC++\DCPlusPlus.exe"= "G:\program files\WinMX\WinMX.exe"= "G:\program files\BitComet\BitComet.exe"= "C:\WINDOWS\system32\dpvsetup.exe"= "C:\Program Files\Internet Explorer\IEXPLORE.EXE"= "G:\program files\TVAnts\Tvants.exe"= "G:\program files\SopCast\SopCast.exe"= "G:\program files\SopCast\adv\SopAdver.exe"= "G:\program files\TVUPlayer\TVUPlayer.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Neuf\Media Center\httpd\httpd.exe"= C:\Program Files\Neuf\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0,192.168.1.2/255.255.255.255:Enabled:Serveur de partage Media Center (Player Neuf Cegetel) "H:\Save IDE C\softs\peer to peer\emule extreme\emule.exe"= "H:\Save IDE C\softs\peer to peer\emule sharkX\eMule0.48a-SharkX-BIN\emule.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "11379:TCP"= 11379:TCP:BitComet 11379 TCP "11379:UDP"= 11379:UDP:BitComet 11379 UDP R1 pdplus;Prodif PLUS Kernel;C:\windows\system32\DRIVERS\pdplus.sys [2002-03-20 01:10] R2 Dnscache;Client DNS;C:\windows\system32\svchost.exe [2004-08-05 14:00] R3 NBXG7031;NB 802.11g XG703 SP1 Driver;C:\windows\system32\DRIVERS\WlanUIG.sys [2004-09-24 18:12] R3 RDID1009;EDIROL UM-1 USB Driver;C:\windows\system32\Drivers dwm1009.sys [2003-10-30 01:24] S3 MBAMCatchMe;MBAMCatchMe;C:\windows\system32\drivers\mbamcatchme.sys [2008-05-05 20:46] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d32e8be1-9ec3-11dc-8db2-0060b3b010a3}] \Shell\AutoRun\command - E:\Autorun.exe . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-05-26 20:48:00 C:\windows\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-29 04:13:20 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . --------------------- DLLs a charg‚ sous des processus courants --------------------- PROCESS: C:\windows\system32\winlogon.exe -> C:\windows\system32\pdplusr.dll PROCESS: C:\windows\system32\lsass.exe -> C:\windows\system32\pdplusr.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\igfxsrvc.exe . ************************************************************************** . Temps d'accomplissement: 2008-05-29 4:15:28 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-29 02:15:25 Pre-Run: 1,396,973,568 octets libres Post-Run: 1,334,599,680 octets libres 429 --- E O F --- 2008-05-16 01:01:27 qu'en pensez vous suis je encore uinfecté ou pas ? puis je installer a nouveau un antivirus ? merci

hart07 · Answer

qui peut me dire si tout est ok ou pas avec ce rapport combofix ?
merci

hart07 · Answer

personne ne peut m'aider ?
merci

DeNisCoOl · Answer

salut hart07,


- Renvois ton rapport HJThis ici, tu dois vraiment éviter les doublons et être patient.



- Tu es vraiment très infecté.
Dans ton rapport elibagla tu as en particulier :

* Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.43
a "virus@satinfo.es". Gracias. 

* Por favor, envienos una muestra del fichero
C:\Muestras\FLEC006.EXE.Muestra EliBagle v11.43 
a "virus@satinfo.es". Gracias. 

Tu dois envoyer ce(s) fichier(s) :
C:\Muestras\HLDRRR.EXE.Muestra et 
C:\Muestras\FLEC006.EXE.Muestra
à l'adresse e-mail indiquée (virus@satinfo.es).

-- L'outil a rencontré un fichier qu'il reconnait mais ne sait pas encore éradiquer --

Tu recevras dans les 24 à 48h une réponse avec un accès à une nouvelle version qui pourra régler ton infection, de plus tu participes à l'amélioration du programme qui servira à tous.

- Pour retrouver les fichiers à envoyer par e-mail.
Affiche les dossiers les fichiers cachés de XP : https://1map.com/fr/astwindscom



-----------
C'est la java dans votre système de gestion des adresses DNS, infection Wareout.
Je viens de voir que tu as pourtant déjà FixWareout, tu ne l'as pas utilisé?

- Sinon télécharger le FixWareout d'un de ces deux sites sur le bureau: 
http://downloads.subratam.org/Fixwareout.exe
http://download.bleepingcomputer.com/lonny/Fixwareout.exe

Lancer le fix: cliquer sur Next, puis Install, puis s'assurer que "Run fixit" est activé puis cliquer sur Finish. 
Le fix va commencer, suivre les messages à l'écran. Il sera demandé de redémarrer votre ordinateur. 
Le système mettra un peu plus de temps au démarrage, c'est normal. 

Quand le système aura redémarré, suivre les invites des messages.
Fermer toutes les applications et le navigateur. 
Cliquer sur Fix Checked. Fermer HijackThis et cliquer sur OK pour continuer la procédure. 

A la fin du fix, il faudra peut-être encore redémarrer le PC.
Au final, poste le contenu du fichier C:\fixwareout\report.txt avec un nouveau rapport HiJackthis 

---------- 
Si et seulement si il y a des difficultés de connexion après cette manip: 
Démarrer---->Paramètres---->Panneau de configuration---->Connexions réseau 
Faire un clic droit sur la connexion par défaut, nommée en général "Connexion au réseau local" ou "Accès à distance" si tu utilises un modem téléphonique, et choisir Propriétés. 
Faire un double clic sur l'élément Protocole Internet (TCP/IP) et choisir le bouton-radio Obtenir les adresses des serveurs DNS automatiquement. 
Clique deux fois sur OK, et redémarre l'ordinateur.


- Combofix a fait beaucoup de nettoyage.


- Vu ta question Kaspersky ne se relance pas ?
Car il est toujours présent dans ta machine.



A+



Denis

hart07 · Answer

merci pouir ta réponse
alors depuis j'ai pu re-installer kaspersky ( vendredi 30 mai)
j'ai lancé a nouveau elibagla en mode sans echec il m'a detecté et eliminé deux fichiers ( apparement trojan) ( vendredi 30 mai)
j'ai effacé manuellement le fichier muestra depuis detécté par elibagla ( jeudi 29 mai)
je poste là mon nouveau rapport hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:53:02, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\windows\system32\pdplusnt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
G:\program files\Kaspersky\avp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
G:\program files\Kaspersky\avp.exe
C:\windows\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
G:\program files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [WinampAgent] G:\program files\Winamp\winampa.exe
O4 - HKLM\..\Run: [RunpdplusManager] pdplusnt.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVP] "G:\program files\Kaspersky\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - G:\program files\Kaspersky\SCIEPlgn.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - https://www.eset.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D956554-A0F6-4EB2-96F4-A4C4CEC64917}: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222 ,207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\..\{635C254F-57EC-490F-9B4A-9F992D2E55B2}: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222 ,207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\..\{856C6875-DE74-47E4-BC81-93A231576B5E}: NameServer = 192.168.1.1,84.103.237.140
O17 - HKLM\System\CCS\Services\Tcpip\..\{972AABCE-2AD6-4E5D-99E4-3622A75CAACF}: NameServer = 84.103.237.146 86.64.145.146
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222  207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CS2\Services\Tcpip\..\{0D956554-A0F6-4EB2-96F4-A4C4CEC64917}: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222 ,207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222  207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CS3\Services\Tcpip\..\{0D956554-A0F6-4EB2-96F4-A4C4CEC64917}: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222 ,207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222  207.68.160.190 194.25.2.129 208.67.222.222 
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - G:\program files\Kaspersky\avp.exe

hart07 · Answer

alors voila le rapport du fix lancé aujourd'hui vendredi 30 mai suivi du rapport hijackthis d'aujourd'hui aussi. : 
Username "Hart" - 30/05/2008 21:01:17 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Cache de résolution DNS vidé.


System was rebooted successfully. 
 
~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "System"="" 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="G:\program files\Winamp\winampa.exe"
"RunpdplusManager"="pdplusnt.exe"
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe"
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe"
"Persistence"="C:\WINDOWS\system32\igfxpers.exe"
"AVP"="\"G:\program files\Kaspersky\avp.exe\""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\windows\system32\ctfmon.exe"
"MsnMsgr"="\"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~


Rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:07:50, on 30/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
G:\program files\Kaspersky\avp.exe
C:\windows\system32\wuauclt.exe
C:\windows\system32\pdplusnt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
G:\program files\Kaspersky\avp.exe
C:\windows\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\windows\system32\wuauclt.exe
G:\program files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [WinampAgent] G:\program files\Winamp\winampa.exe
O4 - HKLM\..\Run: [RunpdplusManager] pdplusnt.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVP] "G:\program files\Kaspersky\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - G:\program files\Kaspersky\SCIEPlgn.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - https://www.eset.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D956554-A0F6-4EB2-96F4-A4C4CEC64917}: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222 ,207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\..\{635C254F-57EC-490F-9B4A-9F992D2E55B2}: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222 ,207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\..\{856C6875-DE74-47E4-BC81-93A231576B5E}: NameServer = 192.168.1.1,84.103.237.140
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222  207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CS2\Services\Tcpip\..\{0D956554-A0F6-4EB2-96F4-A4C4CEC64917}: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222 ,207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222  207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CS3\Services\Tcpip\..\{0D956554-A0F6-4EB2-96F4-A4C4CEC64917}: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222 ,207.68.160.190 194.25.2.129 208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 207.68.160.190 194.25.2.129 208.67.222.222  207.68.160.190 194.25.2.129 208.67.222.222 
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - G:\program files\Kaspersky\avp.exe

DeNisCoOl · Answer

salut hart07,

merci pour tes réponses précises.


- j'ai effacé manuellement le fichier muestra depuis detécté par elibagla ( jeudi 29 mai) 
As tu envoyé les fichiers que je t'ai indiqué a l'éditeur du fix Elibagla?

- alors depuis j'ai pu re-installer kaspersky ( vendredi 30 mai) 
Bonne nouvelle alors.


j'avais configuré manuellement mes adresses IP et DNS 
Ok mais tu as 2 adresses bizarres:
208.67.222.222
Address: 199 Fremont St.
Address: 12th Floor
C'est une adresse en californie qui reviens souvent lors d'une infection Wareout.

Puis celle ci:
194.25.2.129
address: Deutsche Telekom AG
address: D-90492 Nuernberg
address: Germany
Neuf et Deutsche telecom partagent ils leur lignes?


- Je penses que ton ordi servait de serveurs zombie quand je vois le nombre de fichiers zip partagé que combofix a supprimé.


- Evites les programmes du genre Bitcomet, BitTorrent... infection lors de l'installation et pendant l'utilisation et surtout utilisation souvent illégal.


- Je vais t'envoyer de quoi compléter ta protection et finir le nettoyage de ta machine.


A+

Infecté par un trojan bagle ?

11 réponses

Discussions similaires

Newsletters