Winupgro je suis bloqué [Résolu]

Salut ,


Je crois que je me suis chopé un virus avec un grand V.

dans un sens oui , il s appel bagle


Telecharge FindyKill sur ton bureau :

--> Lance l installation avec les parametres par default

--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 1 (Recherche)

--> Post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

Tuto : malekal
Tuto : 01net

Voici le rapport :



----------------- FindyKill V4.709 ------------------

* User : Danielle - ACER-4102WLMI
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 10/12/08 par Chiquitine29
* Recherche effectuée à 15:43:03 le 15/12/2008
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((((( *** Recherche *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\acer\epm\epm-dm.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Documents and Settings\Danielle\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Danielle\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Presence des fichiers dans C:


»»»» Presence des fichiers dans C:\WINDOWS


»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-1D75D703.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Found ! [15/12/2008 14:34] - C:\WINDOWS\system32\mdelk.exe
Found ! [15/12/2008 14:34] - C:\WINDOWS\system32\wintems.exe
Found ! [15/12/2008 15:36] - C:\WINDOWS\system32\ban_list.txt

»»»» Presence des fichiers dans C:\WINDOWS\system32\config\systemprofile\AppData\Roaming


»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers


»»»» Presence des fichiers dans C:\Documents and Settings\Danielle\Application Data

Found ! [15/12/2008 14:37] - "C:\Documents and Settings\Danielle\Application Data\m\flec006.exe"
Found ! [15/12/2008 14:37] - "C:\Documents and Settings\Danielle\Application Data\m\list.oct"
Found ! [15/12/2008 14:39] - "C:\Documents and Settings\Danielle\Application Data\m\data.oct"
Found ! [15/12/2008 14:39] - "C:\Documents and Settings\Danielle\Application Data\m\srvlist.oct"
Found ! [15/12/2008 14:40] - "C:\Documents and Settings\Danielle\Application Data\m\shared"
Found ! [15/12/2008 12:52] - "C:\Documents and Settings\Danielle\Application Data\m"
Found ! [15/12/2008 12:48] - "C:\Documents and Settings\Danielle\Application Data\drivers"
Found ! [15/12/2008 14:34] - "C:\Documents and Settings\Danielle\Application Data\drivers\srosa.sys"
Found ! [15/12/2008 14:33] - "C:\Documents and Settings\Danielle\Application Data\drivers\srosa2.sys"
Found ! [01/09/2006 09:01] - "C:\Documents and Settings\Danielle\Application Data\drivers\winupgro.exe"
Found ! [15/12/2008 14:39] - "C:\Documents and Settings\Danielle\Application Data\drivers\downld"
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\1082687.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\1087718.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\1094734.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\1196656.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\135187.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\139109.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\1460343.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\150265.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\1532218.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\1535781.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\153656.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\1536937.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\155265.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\156468.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\156703.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\157750.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\213203.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\213656.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\214703.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\215187.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\215750.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\216953.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\217421.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\248468.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\253234.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\254390.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\306062.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\307609.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\309343.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\310031.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\310296.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\311640.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\411046.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\412390.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\412765.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\412968.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\415515.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\416906.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\417546.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\446781.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\447828.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\448203.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\522031.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\525187.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\525968.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\598203.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\599687.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\600031.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\834531.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\840078.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\847890.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\858203.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\868390.exe
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Application Data\drivers\downld\877250.exe

»»»» Presence des fichiers dans C:\DOCUME~1\Danielle\LOCALS~1\Temp


»»»» Presence des fichiers dans C:\Documents and Settings\Danielle\Local Settings\Temporary Internet Files\Content.IE5

Found ! [15/12/2008 14:37] - C:\Documents and Settings\Danielle\Local Settings\Temporary Internet Files\Content.IE5\2E8WGNE2\b64[1].jpg
Found ! [15/12/2008 14:27] - C:\Documents and Settings\Danielle\Local Settings\Temporary Internet Files\Content.IE5\FTZ5FOBP\b64[1].jpg
Found ! [15/12/2008 14:24] - C:\Documents and Settings\Danielle\Local Settings\Temporary Internet Files\Content.IE5\FTZ5FOBP\b64_3[1].jpg
Found ! [15/12/2008 14:34] - C:\Documents and Settings\Danielle\Local Settings\Temporary Internet Files\Content.IE5\FTZ5FOBP\b64_3[2].jpg
Found ! [15/12/2008 14:37] - C:\Documents and Settings\Danielle\Local Settings\Temporary Internet Files\Content.IE5\XQEAXK5P\b64[1].jpg
Found ! [15/12/2008 14:39] - C:\Documents and Settings\Danielle\Local Settings\Temporary Internet Files\Content.IE5\XQEAXK5P\mxd[1].jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
SuperCopier2.exe=C:\Program Files\SuperCopier2\SuperCopier2.exe
Google Update="C:\Documents and Settings\Danielle\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
RocketDock="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
Ceedo AutoDetect=C:\DOCUME~1\Danielle\LOCALS~1\Temp\AutoDetect.exe /active

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
EPM-DM=c:\acer\epm\epm-dm.exe
ePowerManagement=C:\Acer\ePM\ePM.exe boot
ATIPTA=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
BluetoothAuthenticationAgent=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
SynTPLpr=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
egui="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
KernelFaultCheck=%systemroot%\system32\dumprep 0 -k
Flashget="C:\Program Files\FlashGet\FlashGet.exe" /min

[HKEY_CURRENT_USER\software\local appwizard-generated applications\install]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\SuperCopier2]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

--------------- [ Registre / Clés infectieuses ] ----------------


Found ! - HKEY_USERS\S-1-5-21-2052111302-1682526488-1417001333-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-2052111302-1682526488-1417001333-1003\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-2052111302-1682526488-1417001333-1003\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-2052111302-1682526488-1417001333-1003\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-2052111302-1682526488-1417001333-1003\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-2052111302-1682526488-1417001333-1003\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

- sans echec non fonctionnel !!



+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 3

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4



--------------- [ Recherche dans supports amovibles] ----------------


+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur fixe

F: - Lecteur fixe

H: - Lecteur de CD-ROM


+- Contenu de l'autorun : H:\autorun.inf

[autorun]
open=autorun_PES2008.exe
icon=autorun_PES2008.exe


+- presence des fichiers :

Found ! [15/05/2007 01:19][-r-------] - H:\autorun.inf


--------------- [ Registre / Mountpoint2 ] ----------------


-> Not found !


------------------- ! Fin du rapport ! --------------------

--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 2 (Suppression)


/!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "nettoyage effectué"

/!\ Ne te sert pas du pc durant la suppression , ton bureau ne sera pas accessible c est normal !

-------> ensuite post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides

voici le rapport (ça à pris du tps) :



----------------- FindyKill V4.709 ------------------

* User : Danielle - ACER-4102WLMI
* executed from : C:\Program Files\FindyKill
* Update on 10/12/08 par Chiquitine29
* Start at 17:06:20 the 15/12/2008
* Windows XP - Internet Explorer 7.0.5730.13


((((((((((((((( *** deleting *** ))))))))))))))))))


--------------- [ Active Processes ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

--------------- [ Infected files / folders ] ----------------


»»»» Supression files in C:


»»»» Supression files in C:\WINDOWS


»»»» Supression files in C:\WINDOWS\Prefetch


»»»» Supression files in C:\WINDOWS\system32


»»»» Supression files in C:\WINDOWS\system32\config\systemprofile\AppData\Roaming


»»»» Supression files in C:\WINDOWS\system32\drivers


»»»» Supression files in C:\Documents and Settings\Danielle\Application Data


»»»» Supression files in C:\DOCUME~1\Danielle\LOCALS~1\Temp

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S

»»»» Supression files in C:\Documents and Settings\Danielle\Local Settings\Temporary Internet Files\Content.IE5


--------------- [ Registry / Infected keys ] ----------------


--------------- [ States / Restarting of services ] ----------------



+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2


--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur fixe

F: - Lecteur fixe

H: - Lecteur de CD-ROM


+- deleting files :

Not deleted !! - H:\autorun.inf

--------------- [ Registry / Mountpoint2 ] ----------------


-> Not found !


--------------- [ Searching Cracks / Keygen ] ----------------



---------------- ! End of report ! ------------------

re voui je vois ça -;)


fais ceci :

en plus tu as un programme infecté par bagle, on va le supprimer :

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous :





:processes
explorer.exe
SuperCopier2.exe

:services
srosa

:files
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\SuperCopier2

:reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY­_SROSA]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SRO­SA]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY­_SK9OU0S]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9­OU0S]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"SuperCopier2.exe"=-

:commands
[emptytemp]
[start explorer]
[reboot]




---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

ci-dessous (plus rapide :-))

========== PROCESSES ==========
Process explorer.exe killed successfully.
Unable to kill process: SuperCopier2.exe
========== SERVICES/DRIVERS ==========
Unable to stop service srosa .
========== FILES ==========
C:\Program Files\SuperCopier2\SuperCopier2.exe moved successfully.
C:\Program Files\SuperCopier2\Languages moved successfully.
C:\Program Files\SuperCopier2 moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa\\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa\\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY _SROSA\\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SRO SA\\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY _SK9OU0S\\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9 OU0S\\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run\\SuperCopier2.exe deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Danielle\LOCALS~1\Temp\etilqs_Mmdg0dKGabgi7Vs scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Danielle\LOCALS~1\Temp\etilqs_zw6GvTgoUXIQ710 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2d4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12152008_172350

re ;


oui cool

bon si tu tiens a SuperCopier2 , tu as gagné le droit de le réinstaller

sinon ensuite désinstal et réinstal ESET (ton antivirus)

ensuite :

Télécharge ToolsCleaner sur ton bureau.
-->
http://pc-system.fr/TC/ToolsCleaner2.exe
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).


et ensuite :

Télécharge HijackThis (outils de diagnostic) ici :

-> Fais un clic droit sur un des liens et choisi enregistrer la cible sous .... le bureau

-> http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
-> http://static.commentcamarche.net/www.commentcamarche.net/download/fichiers/HJTInstall.exe

-> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

-> Clique sur Install ensuite sur I Accept

-> Clique sur Do a scan system and save log file

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

Rapport Toll :

[ Rapport ToolsCleaner version 2.2.7 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\FindyKill.txt: trouvé !
C:\HijackThis: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\Danielle\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\Danielle\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\Danielle\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Hijackthis\hijackthis.log: trouvé !
C:\Program Files\FindyKill: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\Danielle\Bureau\HJTInstall.exe: supprimé !
C:\FindyKill.txt: supprimé !
C:\Documents and Settings\Danielle\Bureau\OTMoveIt3.exe: supprimé !
C:\Hijackthis\hijackthis.log: supprimé !
C:\HijackThis: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\Danielle\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\FindyKill: supprimé !

Fichiers temporaires nettoyés !
Corbeille vidée!

Rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:50:11, on 15/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\acer\epm\epm-dm.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Documents and Settings\Danielle\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Documents and Settings\Danielle\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Danielle\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.207.189.254:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Danielle\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Ceedo AutoDetect] C:\DOCUME~1\Danielle\LOCALS~1\Temp\AutoDetect.exe /active
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Microsoft Office Outlook 2007.lnk = ? (User 'SYSTEM')
O4 - S-1-5-18 Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Microsoft Office Outlook 2007.lnk = ? (User 'Default user')
O4 - .DEFAULT Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe (User 'Default user')
O4 - .DEFAULT Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe (User 'Default user')
O4 - .DEFAULT Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe (User 'Default user')
O4 - Startup: Microsoft Office Outlook 2007.lnk = ?
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

WOUAHH !!!

Ultar rapide ,


réouvre hijackthis
fais scan only
coches ces lignes :

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab


tu les coches et tu clic sur fix checked


ensuite :

Telecharge malwarebytes

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examen Rapide".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.

PS : les rapport sont aussi rangé dans l onglet rapport/log

--> Durant ce scan je t invite a visiter ces liens :

/!\ A lire dans tons cas 1 : http://www.libellules.ch/...
/!\ A lire dans tons cas 2 : http://forum.malekal.com/ftopic893.php

voilà et j'ai suivi ton conseil j'ai lu les liens.
Merci de ta bienveillance.

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1503
Windows 5.1.2600 Service Pack 3

15/12/2008 18:18:22
mbam-log-2008-12-15 (18-18-22).txt

Type de recherche: Examen rapide
Eléments examinés: 48916
Temps écoulé: 4 minute(s), 7 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Merci de ta bienveillance

lol ; il faut ....


ok c finit ,


* pour supprimer les outils/fix utilisés :

Télécharge ToolsCleaner sur ton bureau.
-->
http://pc-system.fr/TC/ToolsCleaner2.exe
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

Désactive et réactive ta restauration system :

(1) Désactiver la Restauration du système

cliques sur Démarrer
Cliques droit sur Poste de travail
cliques sur Propriétés
Cliques sur l'onglet Restauration du système
Coches Désactiver la Restauration du système sur tous les lecteurs
Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
cliques sur Oui.
Cliques sur OK.


(2) Activer la Restauration du système


cliques sur Démarrer
Cliques droit sur Poste de travail
cliques sur Propriétés
Cliques sur l'onglet Restauration du système
Décoches Désactiver la Restauration du système sur tous les lecteurs
Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
cliques sur Oui.
Cliques sur OK.


Tuto xp : http://service1.symantec.com/...

Voila :

[ Rapport ToolsCleaner version 2.2.7 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Danielle\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Danielle\Bureau\HJTInstall.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Danielle\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Danielle\Bureau\HJTInstall.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

parfais Danielle

/!\ aux cracks


je te souhaite une bonne soirée

joyeuses fetes et tout plein de bonheur pour 2009


zé

si tu n as pas d autres soucis change le statut du sujet en resolu stp

http://www.commentcamarche.net/faq/sujet 11365 marquer un fil de discussion comme etant resolu

ps : si question n hesites pas

Si une petite question.
C'est un métier désinfecteur ?

lol non

perso je vais plus loin ,

par exemple findykill que nous avons utilisé est de moi

mais tout cela ne fais pas vivre .... (les salop lol )

hi hi

bref c est apporter nos connaissances pour le bien d autrui

mon metier : Chef de cuisine

voila tu sais tout

Alors merci CHEF

lol bah de rien

le reveillon 170 euros chez moi mais je te diré pas ou je taff

breff

+++ et fais attention a ton pc

bisous

j'ai le même problèmes je suis bloquer pas cette application elle m'en perche d'activer mon antivirus me bloque mes programme comme ccleaner et m'en perche d'installer d'autre antivirus
*
help plzzzzz

je vous donne le rapport sans winupgro.exe sinon je ne peu pas le faire !!!




----------------- FindyKill V4.710 ------------------

* User : Kazu - RAPHAEL
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 21/12/08 par Chiquitine29
* Recherche effectuée à 23:14:31 le 28/12/2008
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((((( *** Recherche *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\LogMeIn\x86\RaMaint.exe
D:\Program Files\LogMeIn\x86\LogMeIn.exe
D:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
D:\Program Files\OO Software\CleverCache\ooccag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
D:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Kazu\Application Data\drivers\downld\428468.exe
C:\WINDOWS\system32\NOTEPAD.EXE

--------------- [ Processus infectieux stoppés ] ----------------


"C:\Documents and Settings\Kazu\Application Data\drivers\downld\428468.exe" (2688)


--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Presence des fichiers dans C:


»»»» Presence des fichiers dans C:\WINDOWS


»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\prefetch\136015.EXE-05CE4A11.pf
Found ! - C:\WINDOWS\prefetch\151500.EXE-0AC75953.pf
Found ! - C:\WINDOWS\prefetch\389312.EXE-2E76F753.pf
Found ! - C:\WINDOWS\prefetch\413187.EXE-34664C51.pf
Found ! - C:\WINDOWS\prefetch\4634406.EXE-3A6AD78C.pf
Found ! - C:\WINDOWS\prefetch\473375.EXE-0F391076.pf
Found ! - C:\WINDOWS\prefetch\497421.EXE-2FF88C9D.pf
Found ! - C:\WINDOWS\prefetch\499640.EXE-11E4AB12.pf
Found ! - C:\WINDOWS\prefetch\524281.EXE-1F5383D1.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-3110EAA4.pf
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-121CE6F1.pf
Found ! - C:\WINDOWS\Prefetch\INSTALL_CRACK.EXE-21D57628.pf
Found ! - C:\WINDOWS\Prefetch\INSTALL_CRACK.EXE-25E4EBE5.pf
Found ! - C:\WINDOWS\Prefetch\INSTALL_CRACK.EXE-21D57628.pf
Found ! - C:\WINDOWS\Prefetch\INSTALL_CRACK.EXE-25E4EBE5.pf
Found ! - C:\WINDOWS\Prefetch\PATCH.EXE-249855D5.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Found ! [28/12/2008 22:58] - C:\WINDOWS\system32\mdelk.exe
Found ! [28/12/2008 22:58] - C:\WINDOWS\system32\wintems.exe
Found ! [28/12/2008 22:58] - C:\WINDOWS\system32\ban_list.txt

»»»» Presence des fichiers dans C:\WINDOWS\system32\config\systemprofile\AppData\Roaming


»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers


»»»» Presence des fichiers dans C:\Documents and Settings\Kazu\Application Data

Found ! [28/12/2008 22:13] - "C:\Documents and Settings\Kazu\Application Data\m\flec006.exe"
Found ! [28/12/2008 22:13] - "C:\Documents and Settings\Kazu\Application Data\m\list.oct"
Found ! [28/12/2008 22:15] - "C:\Documents and Settings\Kazu\Application Data\m\data.oct"
Found ! [28/12/2008 22:15] - "C:\Documents and Settings\Kazu\Application Data\m\srvlist.oct"
Found ! [28/12/2008 22:57] - "C:\Documents and Settings\Kazu\Application Data\m\shared"
Found ! [28/12/2008 21:38] - "C:\Documents and Settings\Kazu\Application Data\m"
Found ! [28/12/2008 20:52] - "C:\Documents and Settings\Kazu\Application Data\drivers"
Found ! [28/12/2008 22:57] - "C:\Documents and Settings\Kazu\Application Data\drivers\srosa.sys"
Found ! [28/12/2008 22:57] - "C:\Documents and Settings\Kazu\Application Data\drivers\srosa2.sys"
Found ! [25/03/2006 04:02] - "C:\Documents and Settings\Kazu\Application Data\drivers\winupgro.exe"
Found ! [28/12/2008 23:01] - "C:\Documents and Settings\Kazu\Application Data\drivers\downld"
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\130796.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\131109.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\131125.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\136015.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\139312.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\139640.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\139656.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\151500.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\215687.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\216531.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\216546.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\230468.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\250765.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\251484.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\251531.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\251843.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\252375.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\252703.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\266140.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\266843.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\267140.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\366062.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\366656.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\366671.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\378156.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\379390.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\379828.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\389312.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\400140.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\400812.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\401140.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\407265.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\410593.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\411187.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\411515.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\413187.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\422390.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\422953.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\428468.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\434750.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\436031.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\436531.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\437281.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\437656.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\438109.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\438171.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\440031.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\441781.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\449171.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\449750.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\449765.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\461875.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\4630093.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\4630656.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\463140.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\4634406.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\463750.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\463937.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\464562.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\464765.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\465062.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\467531.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\473312.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\473375.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\478171.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\478875.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\479250.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\493750.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\494390.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\494718.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\497421.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\499640.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\504125.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\504796.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\505125.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\508234.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\508750.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\508937.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\524281.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\533906.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\534375.exe
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Application Data\drivers\downld\534453.exe

»»»» Presence des fichiers dans C:\DOCUME~1\Kazu\LOCALS~1\Temp

Found ! - C:\DOCUME~1\Kazu\LOCALS~1\Temp\IncrediMail\IMInstall\Contents\Sound\tchaikovsky_the_nutcracker.imw

»»»» Presence des fichiers dans C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5

Found ! [22/12/2008 23:09] - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg
Found ! [29/05/2008 20:38] - C:\Documents and Settings\Kazu\Bureau\RAPHAEL Priv‚\Depeche Mode\Violator\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Large.jpg
Found ! [29/05/2008 20:38] - C:\Documents and Settings\Kazu\Bureau\RAPHAEL Priv‚\Depeche Mode\Violator\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Small.jpg
Found ! [28/12/2008 23:01] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\FUTDZ0CK\b64_1[1].jpg
Found ! [28/12/2008 22:15] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\FUTDZ0CK\b64_2[1].jpg
Found ! [28/12/2008 20:52] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\FUTDZ0CK\b64_3[1].jpg
Found ! [28/12/2008 21:39] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\GL17FBXN\b64_1[1].jpg
Found ! [28/12/2008 21:33] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\GL17FBXN\b64_3[1].jpg
Found ! [28/12/2008 22:15] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\GL17FBXN\mxd[1].jpg
Found ! [28/12/2008 22:13] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\MG692VED\b64[1].jpg
Found ! [28/12/2008 22:09] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\MG692VED\b64_3[1].jpg
Found ! [27/12/2008 16:39] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\MG692VED\DC3CF461A9B3B27DB6499182FDC432[1].jpg
Found ! [28/12/2008 21:38] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\VLOTUTYG\b64[1].jpg
Found ! [28/12/2008 22:14] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\VLOTUTYG\b64_1[1].jpg
Found ! [28/12/2008 21:39] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\VLOTUTYG\b64_2[1].jpg
Found ! [28/12/2008 22:58] - C:\Documents and Settings\Kazu\Local Settings\Temporary Internet Files\Content.IE5\VLOTUTYG\b64_3[1].jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
DAEMON Tools="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
SuperCopier2.exe=C:\Program Files\SuperCopier2\SuperCopier2.exe
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AdobeUpdater=
<NO NAME>=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
SkyTel=SkyTel.EXE
Alcmtr=ALCMTR.EXE
NeroFilterCheck=C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
SSBkgdUpdate="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
OpwareSE4="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
Adobe Reader Speed Launcher="D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
LogMeIn GUI="D:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

[HKEY_CURRENT_USER\software\local appwizard-generated applications\daemon]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\install_crack]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

--------------- [ Registre / Clés infectieuses ] ----------------


Found ! - HKEY_USERS\S-1-5-21-2025429265-706699826-839522115-1003\Software\Local AppWizard-Generated Applications\install_crack
Found ! - HKEY_USERS\S-1-5-21-2025429265-706699826-839522115-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-2025429265-706699826-839522115-1003\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-2025429265-706699826-839522115-1003\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-2025429265-706699826-839522115-1003\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-2025429265-706699826-839522115-1003\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-2025429265-706699826-839522115-1003\Software\MuleAppData
Found ! - HKEY_USERS\S-1-5-21-2025429265-706699826-839522115-1003\Software\Ubisoft
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_crack
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sK9Ou0s

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

- sans echec non fonctionnel !!



+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 3

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4



--------------- [ Recherche dans supports amovibles] ----------------


+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe


+- presence des fichiers :



--------------- [ Registre / Mountpoint2 ] ----------------


-> Not found !


------------------- ! Fin du rapport ! --------------------