Bonjour, Je viens d'allumer mon ordi et avast m'envoi un message d'alerte en me disant qu'un logiciel malveillant se trouve sur mon ordinateur il m'a proposé de le mettre en quarantaine et c'est ce que j'ai fait. Ce logiciel malveillant s'apelle Win32:Rootkit-gen Nom du fichier original : stnetlib.exe Localisation d'origine : C:\windows Je voudrais savoir si ce fichier est dangereux et si je dois le supprimer ou le laisser en quarentaine Merci.

Rotkit Win32

Réponse 101 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 18:39

Bon, je peux le redemarer mntnt en faisant:
Démarer, arreter, redemarer l'ordi??.?
Merci.

sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 463
27 mai 2009 à 20:17

re,

tu fais " redemarer l'ordi " ... et beh ... ^^"

Réponse 102 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 20:47

Ok c'est bon je fais quoi maintenant?

Réponse 103 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 20:48

En tout cas SP3 il est encore pas installé c'est embetant vraiment^^.

Réponse 104 / 167

sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 463
27 mai 2009 à 21:46

En tout cas SP3 il est encore pas installé

C'est a dire ? ... encore un message d'erreur ? ...

branche ton mp3 au pc .... Puis redémarre le pc tout en laissant le lecteur mp3 branché ...

Puis fais ceci :

Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Ferme bien toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer .

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

* Devant l'option "List files/folders created ..." , tu choisis : 2 months

* clique ensuite sur " Continue " pour lancer l'analyse ...

Note : Si la dernière version de HijackThis n'est pas détectée sur ton PC, RSIT le téléchargera et te demandera d'accepter la licence > accepte !

-> laisse faire le scan et ne touche pas au PC ...

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note).

Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

Important : poste un rapport, puis l'autre dans la réponse suivante ... si tu essaies de poster les deux en même temps,
cela risque d'être trop long pour le forum ...
Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ...

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

Réponse 105 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 21:57

Je t'ai dit ke SP3 ba il s'est pas installé a cause de lerreur je fais koi je laisse tomber.
Merci.

Réponse 106 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 22:10

Bon je te sigale au cas où je branche un MP3 et un MP4.
Voila
Merci.

Réponse 107 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 22:19

Bon voila je poste log.txt:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Florian at 2009-05-27 22:17:31
WIN_XP Service Pack 2
System drive C: has 106 GB (69%) free of 153 GB
Total RAM: 511 MB (34% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:17:47, on 27/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\lxdxcoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\system32\PnkBstrA.exe
C:\windows\system32\PnkBstrB.exe
C:\windows\system32\slserv.exe
C:\windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Lexmark 3600-4600 Series\lxdxMsdMon.exe
C:\windows\system32\wuauclt.exe
C:\Program Files\IncrediMail\bin\ImApp.exe
C:\Documents and Settings\Florian\Bureau\RSIT.exe
C:\Program Files\trend micro\Florian.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lxdxmon.exe] "C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe"
O4 - HKLM\..\Run: [lxdxamon] "C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-21-1292428093-682003330-725345543-1005\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-1292428093-682003330-725345543-1005\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-1292428093-682003330-725345543-1005\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1292428093-682003330-725345543-1005\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c (User '?')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User '?')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://intranet.eps-etampes.fr
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {1D6E056F-D1BB-40F6-88E4-11EE98056FD2} (Oberon ActiveX Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - file:///C:/Documents%20and%20Settings/Florian/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash2_fr.1.0.0.70.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - file:///C:/Documents%20and%20Settings/Florian/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash.1.0.0.98.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxdxCATSCustConnectService - Lexmark International, Inc. - C:\windows\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe
O23 - Service: lxdx_device - - C:\windows\system32\lxdxcoms.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\windows\system32\PnkBstrB.exe
O23 - Service: SmartLinkService (SLService) - - C:\windows\SYSTEM32\slserv.exe

Réponse 108 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 22:19

voici info.txt:

info.txt logfile of random's system information tool 1.06 2009-05-27 22:17:52

======Uninstall list======

-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNNMP.exe /UNINSTALL
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" -uninstall
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 6.0 Sprint-->MsiExec.exe /X{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Ad-Aware SE Personal-->C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Flash Player 10 ActiveX-->C:\windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Adobe Shockwave Player-->C:\WINDOWS\system32\Adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
AIDA32 v3.93-->"C:\Program Files\AIDA32 - Personal System Information\unins000.exe"
Apple Mobile Device Support-->MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ArcSoft PhotoImpression-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35B8CC58-F128-4169-82EB-0E6CB0C3AFE6}\setup.exe" -l0x40c -uninst
ArcSoft VideoImpression 1.6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DEF2E5A3-0317-4822-B930-8B721EB483E4}\setup.exe" -l0x40c -uninst
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Astérix Maxi-Délirium-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{09C8B025-F0C5-4EF2-BC4F-399269BDE0C8}\setup.exe"
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
Battlefield 1942-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}\setup.exe" -l0x40c
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Diner Dash 2-->"C:\Program Files\orange\jeux\Diner Dash 2\Uninstall.exe" "C:\Program Files\orange\jeux\Diner Dash 2\install.log"
Dofus 1.23.0-->C:\Program Files\Dofus\uninstall.exe
EasyCleaner-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F5346614-B7C4-4E94-826A-E2363155233D}\setup.exe" -l0x9 -removeonly
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Encyclopédie Universelle Larousse-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{666ADC9C-9C34-4B56-8B22-0419F257FB80}\setup.exe" -l0x40c
Free Music Zilla-->"C:\Program Files\Free Music Zilla\unins000.exe"
GameSpy Arcade-->C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG
getPlus(R) for Adobe-->"C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1
Google Earth-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x40c -removeonly
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_BDA1448D3D255554.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
IncrediMail-->C:\Program Files\IncrediMail\bin\ImSetup.exe /remove /addon:IncrediMail /log:IncMail.log
INDEX EDUCATION - ProfNOTE 2008-->C:\Program Files\InstallShield Installation Information\{5DD31E03-4843-4352-9F8B-919430E80C98}\setup.exe -runfromtemp -l0x040c -uninst -removeonly
iWizz-->C:\Program Files\iWizz\uninstall.exe
iWizz-->C:\Program Files\iWizz\uninstall.exe
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Kaspersky Online Scanner-->C:\windows\system32\KASPER~1\KASPER~1\kavuninstall.exe
KnC-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{71C554B9-79B7-4B5A-8AF0-C6E5CBE108CC}\setup.exe" -l0x40c -removeonly
Lame ACM MP3 Codec-->"C:\WINDOWS\IFinst26.exe" -UC:\Program Files\Lame MP3 Codec\IFU4F.inf
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LEGO® Batman™ DEMO-->C:\Program Files\InstallShield Installation Information\{0B9F8BEE-59F2-43D5-A890-65F649D887A2}\setup.exe -runfromtemp -l0x040c
Lexmark 3600-4600 Series-->C:\Program Files\Lexmark 3600-4600 Series\Install\x86\Uninst.exe
Lexmark Barre d'outils-->regsvr32.exe /s /u "C:\Program Files\Lexmark Toolbar\toolband.dll"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Mega Manager-->C:\Program Files\InstallShield Installation Information\{3B6E3FC6-274C-4B6C-BC85-5C3B15DE18E2}\setup.exe -runfromtemp -l0x0009 -removeonly
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Micro Application Marine Aquarium-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Micro Application\Aquarium\Uninst.isu"
Microsoft .NET Framework 2.0-->C:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Small Business Edition 2003-->MsiExec.exe /I{91CA040C-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\windows\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\windows\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\windows\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\windows\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\windows\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\windows\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\windows\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\windows\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\windows\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\windows\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\windows\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\windows\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\windows\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\windows\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\windows\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\windows\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\windows\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\windows\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\windows\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\windows\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\windows\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\windows\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\windows\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\windows\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\windows\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\windows\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\windows\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\windows\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\windows\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\windows\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\windows\$NtUninstallKB967715$\spuninst\spuninst.exe"
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
My DSC-->C:\Program Files\InstallShield Installation Information\{225af9a1-b556-88d5-94aa-0010b5426419}\setup.exe
Nero Suite-->C:\Program Files\Fichiers communs\Nero\Uninstall\Setupx.exe /uninstall ExtraUninstallID=""
OpenOffice.org 3.0-->MsiExec.exe /I{6860B340-530D-46B3-91F8-1AE1F70F7C33}
Orange Desktop Search-->C:\Program Files\Orange HSS\Orange Desktop Search\uninst.exe
Orbit Downloader-->"C:\Program Files\Orbitdownloader\unins000.exe"
Packard Bell ImageWriter v1.0-->"C:\Program Files\Packard Bell ImageWriter\unins000.exe"
Pangya_Eu (GOA)-->C:\Program Files\GOA\Pangya_Eu\uninstall.exe
PRINCIPIANTE SIN NOCIONES-->"C:\Program Files\Auralog\PRINCIPIANTE SIN NOCIONES\Bin\unsetup.exe" -file "C:\Program Files\Auralog\PRINCIPIANTE SIN NOCIONES\unsetup.aui"
PunkBuster Services-->C:\windows\system32\pbsvc.exe -u
Quake Live Mozilla Plugin-->MsiExec.exe /I{6F3F58D0-6CE9-4B76-B3C2-9E5BD6323992}
RAYMANM-->C:\windows\UbiSoft\SetupUbi.exe -uninstall RAYMANM
RayV-->C:\Program Files\RayV\RayV\uninstall.exe
RCT3 Soaked-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EA926717-CE5A-4CB4-AB21-9E6E9565A458}\setup.exe" -l0x40c
RollerCoaster Tycoon 3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\Setup.exe" -l0x40c
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Shareaza 2.4.0.0-->"C:\Program Files\Shareaza\Uninstall\unins000.exe"
Shockwave-->C:\WINDOWS\system32\Macromed\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~2\Install.log
Smart Link 56K Modem-->C:\WINDOWS\Modio\SLAMR2KO\Setup.exe /Remove
Solutions de télécopie Lexmark-->C:\Program Files\Lexmark Fax Solutions\Install\x86\Uninst.exe /R:faxunst
Starsky&Hutch-->C:\Program Files\Empire Interactive\Starsky&Hutch\Uninstall.exe
SUPER © Version 2009.bld.35 (Jan 5, 2009)-->C:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
The Battle for Middle-earth (tm) II Demo-->C:\Program Files\Electronic Arts\The Battle for Middle-earth (tm) II Demo\EAUninstall.exe
TmNationsForever-->"C:\Program Files\TmNationsForever\unins000.exe"
Total Immersion Racing-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C2FE0127-0F86-43C7-824E-AA78E6B5F4F3}\setup.exe"
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Wanadoo Messager-->C:\PROGRA~1\WANADO~1\UNWISE.EXE C:\PROGRA~1\WANADO~1\INSTALL.LOG
Windows Defender-->MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Internet Explorer 8-->"C:\windows\ie8\spuninst\spuninst.exe"
Windows Live Mail-->MsiExec.exe /I{C514C594-23AA-4F13-A070-DB8BDB27594F}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
WinZip-->"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall
Wolfenstein - Enemy Territory-->C:\PROGRA~1\WOLFEN~1\Uninstall\Unwise.exe /u C:\PROGRA~1\WOLFEN~1\Uninstall\Install.log
XviD MPEG-4 Video Codec-->"C:\Program Files\XviD\unins000.exe"
Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY-->MsiExec.exe /I{3571656A-575D-4CED-809D-5547587121FF}
Zattoo 3.3.1 Beta-->C:\Program Files\Zattoo\uninst.exe
ZTE ZXDSL852-->"C:\Program Files\ZTE Corporation\ZXDSL852\setup.exe" -u

======Hosts File======

127.0.0.1 localhost
0.0.0.0 safeweb.norton.com

Securitycenter WMI appears to be broken

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 3 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0304
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Réponse 109 / 167

sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 463
27 mai 2009 à 22:54

Bon ... y a un blême ... !

fais ceci stp :

1- Avoir accès aux fichiers cachés :

Va dans Menu Démarrer->Poste de travail->Outils->Options des dossiers...->Affichage
* "Afficher les fichiers et dossiers cachés" ---> coché
* "Masquer les extensions des fichiers dont le type est connu" ---> décoché
* "masquer les fichiers du système" ---> décoché
-> valide la modif ( "appliquer" puis "ok" ).
( tu remetteras les paramètres de départ une fois la désinfection terminée , pas avant ... )

2- Rends toi sur ce site :

https://www.virustotal.com/gui/

Copies ce qui suit et colles le dans l'espace pour la recherche ( ou clique sur "parcourir" et va jusqu'au fichier demandé ) :
C:\windows\system32\_004471_.tmp.dll

Clique sur Send File ( = " Envoyer le fichier " ).

Un rapport va s'élaborer ligne à ligne.

Attends bien la fin ... Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta prochaine réponse ...

( Si VirusTotal indique que le fichier a déjà été analysé, clique sur le bouton Ré-analyse le fichier maintenant )

Fais de même pour :
C:\windows\system32\SET47C.tmp
C:\windows\system32\SET30C.tmp

Poste moi donc ces 3 rapports ( surtout le début avec le listing des AV , et en précisant bien au début de chacuns à quel fichier ils correspondent ) et attends la suite ...

Réponse 110 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 23:03

Bon voici le rapport de C:\windows\system32\_004471_.tmp.dll
Rapport virustotal:

Fichier _004471_.tmp.dll reçu le 2009.05.27 20:59:55 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 0/40 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 43 et 62 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.27 -
AhnLab-V3 5.0.0.2 2009.05.27 -
AntiVir 7.9.0.168 2009.05.27 -
Antiy-AVL 2.0.3.1 2009.05.27 -
Authentium 5.1.2.4 2009.05.27 -
Avast 4.8.1335.0 2009.05.27 -
AVG 8.5.0.339 2009.05.27 -
BitDefender 7.2 2009.05.27 -
CAT-QuickHeal 10.00 2009.05.27 -
ClamAV 0.94.1 2009.05.27 -
Comodo 1207 2009.05.27 -
DrWeb 5.0.0.12182 2009.05.27 -
eSafe 7.0.17.0 2009.05.27 -
eTrust-Vet 31.6.6524 2009.05.27 -
F-Prot 4.4.4.56 2009.05.27 -
F-Secure 8.0.14470.0 2009.05.27 -
Fortinet 3.117.0.0 2009.05.27 -
GData 19 2009.05.27 -
Ikarus T3.1.1.57.0 2009.05.27 -
K7AntiVirus 7.10.746 2009.05.27 -
Kaspersky 7.0.0.125 2009.05.27 -
McAfee 5628 2009.05.27 -
McAfee+Artemis 5628 2009.05.27 -
McAfee-GW-Edition 6.7.6 2009.05.27 -
Microsoft 1.4701 2009.05.27 -
NOD32 4109 2009.05.27 -
Norman 6.01.05 2009.05.27 -
nProtect 2009.1.8.0 2009.05.27 -
Panda 10.0.0.14 2009.05.27 -
PCTools 4.4.2.0 2009.05.21 -
Prevx 3.0 2009.05.27 -
Rising 21.31.21.00 2009.05.27 -
Sophos 4.42.0 2009.05.27 -
Sunbelt 3.2.1858.2 2009.05.27 -
Symantec 1.4.4.12 2009.05.27 -
TheHacker 6.3.4.3.332 2009.05.26 -
TrendMicro 8.950.0.1092 2009.05.27 -
VBA32 3.12.10.6 2009.05.27 -
ViRobot 2009.5.27.1757 2009.05.27 -
VirusBuster 4.6.5.0 2009.05.27 -
Information additionnelle
File size: 382464 bytes
MD5...: 87424817f82cf6a7f55dac01a20111a3
SHA1..: bbe771d21c83518736a80f43cbf5179e30806b52
SHA256: 5a18da0c724dba1cd1234d518ef29ae2f3eb15bddd5323bb29f54e2e176be8bd
ssdeep: 6144:f7G7IefSg/cyXePG3TtboCihAGEL4SUjNDPaMXnud6sXUbE2ugi53jHjiHj
MbN9w:f7G7IefSg0yQuTtbogGEL4SUZaMXnBlF
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x46135
timedatestamp.....: 0x41109609 (Wed Aug 04 07:53:45 2004)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x512cc 0x51400 6.54 4fa38c06ebf2d197c4f0fb461dc71f85
.data 0x53000 0x47c4 0x400 2.88 3530aaabe4031d3ab2b32fb5d003d89d
.rsrc 0x58000 0x492c 0x4a00 5.75 7d5ae70f16b482bac923d7366156d229
.reloc 0x5d000 0x6dac 0x6e00 6.26 a2f9e36c6848604891fab43ccd243c6e

( 18 imports )
> msvcrt.dll: _vsnwprintf, qsort, _purecall, wcsncpy, isalpha, _wcsnicmp, _ftol, __CxxFrameHandler, _CxxThrowException, _except_handler3, wcscmp, wcstok, wcschr, _wcsdup, _onexit, __dllonexit, _terminate@@YAXXZ, __1type_info@@UAE@XZ, _adjust_fdiv, _initterm, _vsnprintf, _memicmp, swscanf, _wcsicmp, memmove, sscanf, wcsncmp, wcsstr, free, malloc, wcslen
> ntdll.dll: NtRaiseException, VerSetConditionMask, NtQueryInformationThread, RtlLengthSecurityDescriptor, RtlCreateHeap, RtlNtStatusToDosError, NtQueryInformationFile, NtSetInformationFile
> ADVAPI32.dll: QueryServiceConfigW, StartTraceW, EnableTrace, ControlTraceW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceEvent, RegCreateKeyExW, RegSetValueExW, AllocateAndInitializeSid, FreeSid, CopySid, GetSidSubAuthorityCount, GetSidSubAuthority, MapGenericMask, OpenProcessToken, LogonUserW, CreateProcessAsUserW, GetLengthSid, RegOpenKeyExW, GetSecurityDescriptorOwner, GetSecurityDescriptorGroup, GetSecurityDescriptorDacl, GetSecurityDescriptorSacl, GetSecurityDescriptorControl, SetNamedSecurityInfoW, DuplicateTokenEx, LookupPrivilegeValueW, AdjustTokenPrivileges, GetSecurityInfo, ConvertSidToStringSidW, ConvertStringSidToSidW, RevertToSelf, IsTokenRestricted, EqualSid, CloseServiceHandle, OpenServiceW, ChangeServiceConfig2W, CreateServiceW, OpenSCManagerW, RegisterServiceCtrlHandlerExW, SetServiceStatus, ChangeServiceConfigW, RegCloseKey, RegQueryValueExW, RegOpenKeyW, SetSecurityDescriptorDacl, SetEntriesInAclW, SetThreadToken, ImpersonateLoggedOnUser, GetTokenInformation, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, OpenThreadToken, ImpersonateSelf, AccessCheck, MakeSelfRelativeSD, MakeAbsoluteSD, CheckTokenMembership, RegisterEventSourceW, DeregisterEventSource, ReportEventW, LookupAccountSidW
> CRYPT32.dll: CryptProtectData, CryptUnprotectData
> iphlpapi.dll: GetBestInterface, GetIfEntry, GetIfTable
> KERNEL32.dll: UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetFileSize, GetWindowsDirectoryW, GetSystemTime, MultiByteToWideChar, GetExitCodeProcess, GetTimeZoneInformation, LocalFileTimeToFileTime, GetLocalTime, SleepEx, CancelIo, SetFilePointer, GetVolumeInformationW, SetFileAttributesW, InterlockedExchange, LoadLibraryA, lstrlenW, RaiseException, GetFileAttributesW, GetFileInformationByHandle, GetVolumePathNameW, GlobalMemoryStatus, QueryPerformanceFrequency, CreateDirectoryW, OutputDebugStringW, QueueUserWorkItem, GetDriveTypeW, GetTempFileNameW, GetVolumeNameForVolumeMountPointW, GetLastError, GetProcAddress, GetVersionExW, LoadLibraryExW, GetSystemDirectoryW, SetLastError, FreeLibrary, Sleep, LoadLibraryW, InterlockedDecrement, InterlockedIncrement, CloseHandle, WaitForSingleObject, OpenEventW, DisableThreadLibraryCalls, SetEvent, GetModuleFileNameW, CreateEventW, GetSystemTimeAsFileTime, LockResource, LoadResource, FindResourceW, ExpandEnvironmentStringsW, InterlockedCompareExchange, HeapAlloc, HeapFree, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, LocalFree, GetCurrentThread, LocalAlloc, GlobalFree, EnterCriticalSection, LeaveCriticalSection, SetThreadPriority, GetThreadPriority, DuplicateHandle, ResetEvent, InitializeCriticalSection, DeleteCriticalSection, UnregisterWait, SetWaitableTimer, CancelWaitableTimer, RegisterWaitForSingleObject, WideCharToMultiByte, VerifyVersionInfoW, InitializeCriticalSectionAndSpinCount, FormatMessageW, lstrcmpiW, GetLongPathNameW, CreateFileW, SetEndOfFile, SetFilePointerEx, GetFileSizeEx, FlushFileBuffers, WriteFile, ReadFile, CopyFileW, CreateWaitableTimerW, MoveFileExW, DeleteFileW, GetFileAttributesExW, SetFileTime, BindIoCompletionCallback, GetFileTime, GetFileType, SystemTimeToFileTime, TlsSetValue, ReleaseMutex, ReleaseSemaphore, TlsGetValue, WaitForMultipleObjects, CreateSemaphoreW, TlsFree, WaitForMultipleObjectsEx, CreateMutexW, TlsAlloc, GetExitCodeThread, CreateThread, GetFullPathNameW
> MPR.dll: WNetGetConnectionW
> ole32.dll: CoTaskMemFree, CoRegisterClassObject, CoRevokeClassObject, StringFromGUID2, CoImpersonateClient, CoInitializeEx, CoInitializeSecurity, CoTaskMemAlloc, CoCreateGuid, IIDFromString, StringFromIID, CoCreateInstance, CoUninitialize
> OLEAUT32.dll: -, -, -, -
> RPCRT4.dll: RpcBindingFree, RpcBindingSetAuthInfoExW, RpcBindingFromStringBindingW, NdrClientCall2, UuidCreate
> SHFOLDER.dll: SHGetFolderPathW
> SHLWAPI.dll: UrlCombineW
> USER32.dll: DestroyWindow, UnregisterClassW, LoadStringW, DefWindowProcW, GetWindowLongW, PeekMessageW, DispatchMessageW, TranslateMessage, MsgWaitForMultipleObjectsEx, SetWindowLongW, CreateWindowExW, RegisterClassExW, UnregisterDeviceNotification, RegisterDeviceNotificationW, PostMessageW
> USERENV.dll: DestroyEnvironmentBlock, CreateEnvironmentBlock
> VERSION.dll: GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
> WS2_32.dll: -, -, WSASocketW, -, -, -, WSAIoctl, -
> WTSAPI32.dll: WTSQuerySessionInformationW, WTSEnumerateSessionsW, WTSFreeMemory
> WINHTTP.dll: WinHttpQueryDataAvailable, WinHttpSetCredentials, WinHttpReadData, WinHttpOpenRequest, WinHttpQueryAuthSchemes, WinHttpConnect, WinHttpWriteData, WinHttpSetOption, WinHttpCrackUrl, WinHttpSendRequest, WinHttpReceiveResponse, WinHttpGetProxyForUrl, WinHttpGetIEProxyConfigForCurrentUser, WinHttpAddRequestHeaders, WinHttpCloseHandle, WinHttpOpen, WinHttpQueryHeaders, WinHttpSetStatusCallback

( 17 exports )
__0CNestedImpersonation@@QAE@AAVTokenHandle@@@Z, __0CNestedImpersonation@@QAE@PAX@Z, __0CNestedImpersonation@@QAE@XZ, __0PROXY_SETTINGS_CONTAINER@@QAE@PBGPBUPROXY_SETTINGS@@@Z, _BITSAlloc@@YGPAXI@Z, _BITSFree@@YGXPAX@Z, _BytesRemainingInCurrentRange@CRangeCollection@@QAE_KXZ, _CalculateBytesTotal@CRangeCollection@@IAE_NXZ, _Find@CCredentialsContainer@@QBEJW4__MIDL_IBackgroundCopyJob2_0001@@W4__MIDL_IBackgroundCopyJob2_0002@@PAPAU__MIDL_IBackgroundCopyJob2_0005@@@Z, _FindInterfaceIndex@@YGKPBG@Z, _GetSubRanges@CRangeCollection@@QAEJ_K0KIPAPAV1@@Z, _HostFromProxyDescription@@YG_AV_$auto_ptr@G@std@@PAG@Z, _s_EmptyString@_$GenericStringHandle@G@@0UStringData@1@A, BITSServiceMain, DllRegisterServer, DllUnregisterServer, ServiceMain
PDFiD.: -
RDS...: NSRL Reference Data Set

( Microsoft )

> MSDN Disc 2439.8: qmgr.dll
> MSDN Disc 2439.7: qmgr.dll
> MSDN Disc 2439.6: qmgr.dll

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier

Réponse 111 / 167

sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 463
27 mai 2009 à 23:05

continue ...

Réponse 112 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 23:14

Je poste maitenant le fichier C:\windows\system32\SET47C.tmp
Rapport virus total:

Fichier SET47C.tmp reçu le 2009.05.27 21:09:36 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 0/40 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 43 et 62 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.27 -
AhnLab-V3 5.0.0.2 2009.05.27 -
AntiVir 7.9.0.168 2009.05.27 -
Antiy-AVL 2.0.3.1 2009.05.27 -
Authentium 5.1.2.4 2009.05.27 -
Avast 4.8.1335.0 2009.05.27 -
AVG 8.5.0.339 2009.05.27 -
BitDefender 7.2 2009.05.27 -
CAT-QuickHeal 10.00 2009.05.27 -
ClamAV 0.94.1 2009.05.27 -
Comodo 1207 2009.05.27 -
DrWeb 5.0.0.12182 2009.05.27 -
eSafe 7.0.17.0 2009.05.27 -
eTrust-Vet 31.6.6524 2009.05.27 -
F-Prot 4.4.4.56 2009.05.27 -
F-Secure 8.0.14470.0 2009.05.27 -
Fortinet 3.117.0.0 2009.05.27 -
GData 19 2009.05.27 -
Ikarus T3.1.1.57.0 2009.05.27 -
K7AntiVirus 7.10.746 2009.05.27 -
Kaspersky 7.0.0.125 2009.05.27 -
McAfee 5628 2009.05.27 -
McAfee+Artemis 5628 2009.05.27 -
McAfee-GW-Edition 6.7.6 2009.05.27 -
Microsoft 1.4701 2009.05.27 -
NOD32 4109 2009.05.27 -
Norman 6.01.05 2009.05.27 -
nProtect 2009.1.8.0 2009.05.27 -
Panda 10.0.0.14 2009.05.27 -
PCTools 4.4.2.0 2009.05.21 -
Prevx 3.0 2009.05.27 -
Rising 21.31.21.00 2009.05.27 -
Sophos 4.42.0 2009.05.27 -
Sunbelt 3.2.1858.2 2009.05.27 -
Symantec 1.4.4.12 2009.05.27 -
TheHacker 6.3.4.3.332 2009.05.26 -
TrendMicro 8.950.0.1092 2009.05.27 -
VBA32 3.12.10.6 2009.05.27 -
ViRobot 2009.5.27.1757 2009.05.27 -
VirusBuster 4.6.5.0 2009.05.27 -
Information additionnelle
File size: 424960 bytes
MD5...: 3b206db81eb6a74f04716bd5627fd6e3
SHA1..: 70f486c45f80d2dab7ad8dc3307689faa1816c9a
SHA256: 35b13e0ef79a5f9b6b1716d6e04b3bf17f79b5814cb1c51c3e12125c0073be3c
ssdeep: 6144:Y1WBzbqZlFzWfcMjzKst6KYNVhg6uLFFC6xFLgREyfqhQCThbMSM39W2b3:
YcBTdAVoC6xCRENpYHE
PEiD..: -
TrID..: File type identification
DirectShow filter (58.3%)
Windows OCX File (35.7%)
Win32 Executable Generic (2.4%)
Win32 Dynamic Link Library (generic) (2.1%)
Generic Win/DOS Executable (0.5%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x213ba
timedatestamp.....: 0x4802c210 (Mon Apr 14 02:31:44 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x5d8a7 0x5da00 7.15 253efdb2c346e2e4bd3559dad034ca77
.data 0x5f000 0x1a2c 0x1800 6.57 e946531843caa682bb9183ad3b9b79f3
.rsrc 0x61000 0x4b60 0x4c00 5.05 3585d1eb911f7edf6e0ddbbe680a49fe
.reloc 0x66000 0x3924 0x3a00 6.74 2f7cdf096c0b9c79f0ffe4ca7e2015b8

( 11 imports )
> ADVAPI32.dll: RegDeleteKeyW, LsaStorePrivateData, LsaRetrievePrivateData, LsaFreeMemory, LsaOpenPolicy, LsaNtStatusToWinError, CheckTokenMembership, GetLengthSid, InitializeAcl, AddAccessAllowedAce, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, AllocateAndInitializeSid, FreeSid, CryptGenKey, CryptExportKey, GetCurrentHwProfileW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, ConvertStringSecurityDescriptorToSecurityDescriptorA, SetFileSecurityA, LsaClose, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegSetValueExW, RegQueryInfoKeyW, RegDeleteValueW, RegEnumValueW, RegEnumKeyExW, CryptReleaseContext, CryptDestroyKey, CryptDestroyHash, CryptVerifySignatureW, CryptHashData, CryptCreateHash, CryptEncrypt, CryptDecrypt, RegQueryValueExW, CryptImportKey, CryptDeriveKey, CryptAcquireContextW
> CRYPT32.dll: CertVerifySubjectCertificateContext, CertGetIssuerCertificateFromStore, CertFreeCertificateContext, CertDuplicateCertificateContext, CertCreateCertificateContext, CertCloseStore, CryptImportPublicKeyInfoEx, CertFindExtension, CryptExportPublicKeyInfo, CryptEncodeObject, CertEnumCertificatesInStore, CertOpenStore, CryptSignCertificate, CertComparePublicKeyInfo
> KERNEL32.dll: GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, LocalFree, WideCharToMultiByte, GetACP, lstrcpynA, GetSystemDirectoryW, CloseHandle, WriteFile, SetFilePointer, CreateFileW, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetFileSize, HeapFree, GetProcessHeap, lstrcmpiA, HeapAlloc, GetTickCount, QueryPerformanceCounter, GetShortPathNameW, LoadLibraryExW, GetLastError, FindResourceW, LoadResource, SizeofResource, lstrlenA, DisableThreadLibraryCalls, LoadLibraryW, GetProcAddress, FreeLibrary, GetModuleFileNameW, lstrcatW, HeapDestroy, EnterCriticalSection, LeaveCriticalSection, lstrcpynW, lstrcmpiW, InterlockedDecrement, InterlockedIncrement, DeleteCriticalSection, CopyFileW, SetLastError, FileTimeToSystemTime, GetVersionExW, HeapReAlloc, HeapCreate, InitializeCriticalSection, LocalAlloc, lstrcpyW, lstrlenW, MultiByteToWideChar, OpenMutexW, CreateMutexW, DebugBreak, ReleaseMutex, ReadFile, GetProcessAffinityMask, SetThreadAffinityMask, ResumeThread, GetExitCodeThread, GetSystemInfo, lstrcatA, LoadLibraryA, lstrcmpA, GetLogicalDriveStringsA, GetDriveTypeA, GetVolumeInformationW, GlobalMemoryStatus, lstrcpyA, Sleep, FindResourceExW, LockResource, CreateFileA, GetSystemDirectoryA, CreateThread, GetSystemDefaultLCID, CreateEventW, SystemTimeToFileTime, SetEvent, WaitForSingleObject, GetSystemTime, lstrcmpW, InitializeCriticalSectionAndSpinCount, VirtualProtect, ExitProcess, CreateEventA, TlsSetValue, TlsGetValue, VirtualAlloc, TlsAlloc, VirtualFree, TlsFree
> msvcrt.dll: strchr, _purecall, __2@YAPAXI@Z, realloc, free, malloc, _snprintf, isspace, strncmp, wcstombs, sprintf, _snwprintf, _initterm, _adjust_fdiv, __CxxFrameHandler, sscanf, wcslen, memmove, atof, _ftol, _strnicmp, atol, wcsncpy, ceil, _wtol, wcstok, _wcsicmp, _itow, _wtoi, wcsncat, wcsncmp, _wcsupr, _CIpow, wcscpy, wcschr, __3@YAXPAX@Z, _except_handler3
> ntdll.dll: NtClose, NtQuerySystemInformation, RtlTimeToTimeFields, NtLockProductActivationKeys, NtMapViewOfSection, NtOpenSection, RtlInitUnicodeString, NtUnmapViewOfSection
> ole32.dll: CoTaskMemFree, CoTaskMemRealloc, CoUninitialize, CoInitializeEx, StringFromGUID2, CoCreateInstance, CoTaskMemAlloc, CoCreateGuid
> OLEAUT32.dll: -, -, -, -, -, -, -
> RPCRT4.dll: UuidCreate
> SETUPAPI.dll: SetupDiGetClassDevsW, SetupDiGetDeviceRegistryPropertyW, SetupDiEnumDeviceInfo, SetupDiDestroyDeviceInfoList
> USER32.dll: wsprintfA, GetSystemMetrics, GetDesktopWindow, CharNextW, SetTimer, KillTimer, wsprintfW
> WININET.dll: InternetReadFile, InternetConnectA, InternetQueryOptionW, InternetErrorDlg, InternetCloseHandle, InternetAutodial, InternetSetOptionA, HttpSendRequestW, InternetOpenA, HttpOpenRequestA, InternetAutodialHangup, HttpQueryInfoW, InternetGetConnectedState

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
PDFiD.: -
RDS...: NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier

Réponse 113 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 23:21

Je poste maintenant le rapport du fichier C:\windows\system32\SET30C.tmp
Rapport virustotal:

Fichier SET30C.tmp reçu le 2009.05.27 21:16:11 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 0/40 (0%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 43 et 62 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.27 -
AhnLab-V3 5.0.0.2 2009.05.27 -
AntiVir 7.9.0.168 2009.05.27 -
Antiy-AVL 2.0.3.1 2009.05.27 -
Authentium 5.1.2.4 2009.05.27 -
Avast 4.8.1335.0 2009.05.27 -
AVG 8.5.0.339 2009.05.27 -
BitDefender 7.2 2009.05.27 -
CAT-QuickHeal 10.00 2009.05.27 -
ClamAV 0.94.1 2009.05.27 -
Comodo 1207 2009.05.27 -
DrWeb 5.0.0.12182 2009.05.27 -
eSafe 7.0.17.0 2009.05.27 -
eTrust-Vet 31.6.6524 2009.05.27 -
F-Prot 4.4.4.56 2009.05.27 -
F-Secure 8.0.14470.0 2009.05.27 -
Fortinet 3.117.0.0 2009.05.27 -
GData 19 2009.05.27 -
Ikarus T3.1.1.57.0 2009.05.27 -
K7AntiVirus 7.10.746 2009.05.27 -
Kaspersky 7.0.0.125 2009.05.27 -
McAfee 5628 2009.05.27 -
McAfee+Artemis 5628 2009.05.27 -
McAfee-GW-Edition 6.7.6 2009.05.27 -
Microsoft 1.4701 2009.05.27 -
NOD32 4109 2009.05.27 -
Norman 6.01.05 2009.05.27 -
nProtect 2009.1.8.0 2009.05.27 -
Panda 10.0.0.14 2009.05.27 -
PCTools 4.4.2.0 2009.05.21 -
Prevx 3.0 2009.05.27 -
Rising 21.31.21.00 2009.05.27 -
Sophos 4.42.0 2009.05.27 -
Sunbelt 3.2.1858.2 2009.05.27 -
Symantec 1.4.4.12 2009.05.27 -
TheHacker 6.3.4.3.332 2009.05.26 -
TrendMicro 8.950.0.1092 2009.05.27 -
VBA32 3.12.10.6 2009.05.27 -
ViRobot 2009.5.27.1757 2009.05.27 -
VirusBuster 4.6.5.0 2009.05.27 -
Information additionnelle
File size: 424960 bytes
MD5...: 3b206db81eb6a74f04716bd5627fd6e3
SHA1..: 70f486c45f80d2dab7ad8dc3307689faa1816c9a
SHA256: 35b13e0ef79a5f9b6b1716d6e04b3bf17f79b5814cb1c51c3e12125c0073be3c
ssdeep: 6144:Y1WBzbqZlFzWfcMjzKst6KYNVhg6uLFFC6xFLgREyfqhQCThbMSM39W2b3:
YcBTdAVoC6xCRENpYHE
PEiD..: -
TrID..: File type identification
DirectShow filter (58.3%)
Windows OCX File (35.7%)
Win32 Executable Generic (2.4%)
Win32 Dynamic Link Library (generic) (2.1%)
Generic Win/DOS Executable (0.5%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x213ba
timedatestamp.....: 0x4802c210 (Mon Apr 14 02:31:44 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x5d8a7 0x5da00 7.15 253efdb2c346e2e4bd3559dad034ca77
.data 0x5f000 0x1a2c 0x1800 6.57 e946531843caa682bb9183ad3b9b79f3
.rsrc 0x61000 0x4b60 0x4c00 5.05 3585d1eb911f7edf6e0ddbbe680a49fe
.reloc 0x66000 0x3924 0x3a00 6.74 2f7cdf096c0b9c79f0ffe4ca7e2015b8

( 11 imports )
> ADVAPI32.dll: RegDeleteKeyW, LsaStorePrivateData, LsaRetrievePrivateData, LsaFreeMemory, LsaOpenPolicy, LsaNtStatusToWinError, CheckTokenMembership, GetLengthSid, InitializeAcl, AddAccessAllowedAce, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, AllocateAndInitializeSid, FreeSid, CryptGenKey, CryptExportKey, GetCurrentHwProfileW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, ConvertStringSecurityDescriptorToSecurityDescriptorA, SetFileSecurityA, LsaClose, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, RegSetValueExW, RegQueryInfoKeyW, RegDeleteValueW, RegEnumValueW, RegEnumKeyExW, CryptReleaseContext, CryptDestroyKey, CryptDestroyHash, CryptVerifySignatureW, CryptHashData, CryptCreateHash, CryptEncrypt, CryptDecrypt, RegQueryValueExW, CryptImportKey, CryptDeriveKey, CryptAcquireContextW
> CRYPT32.dll: CertVerifySubjectCertificateContext, CertGetIssuerCertificateFromStore, CertFreeCertificateContext, CertDuplicateCertificateContext, CertCreateCertificateContext, CertCloseStore, CryptImportPublicKeyInfoEx, CertFindExtension, CryptExportPublicKeyInfo, CryptEncodeObject, CertEnumCertificatesInStore, CertOpenStore, CryptSignCertificate, CertComparePublicKeyInfo
> KERNEL32.dll: GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, LocalFree, WideCharToMultiByte, GetACP, lstrcpynA, GetSystemDirectoryW, CloseHandle, WriteFile, SetFilePointer, CreateFileW, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetFileSize, HeapFree, GetProcessHeap, lstrcmpiA, HeapAlloc, GetTickCount, QueryPerformanceCounter, GetShortPathNameW, LoadLibraryExW, GetLastError, FindResourceW, LoadResource, SizeofResource, lstrlenA, DisableThreadLibraryCalls, LoadLibraryW, GetProcAddress, FreeLibrary, GetModuleFileNameW, lstrcatW, HeapDestroy, EnterCriticalSection, LeaveCriticalSection, lstrcpynW, lstrcmpiW, InterlockedDecrement, InterlockedIncrement, DeleteCriticalSection, CopyFileW, SetLastError, FileTimeToSystemTime, GetVersionExW, HeapReAlloc, HeapCreate, InitializeCriticalSection, LocalAlloc, lstrcpyW, lstrlenW, MultiByteToWideChar, OpenMutexW, CreateMutexW, DebugBreak, ReleaseMutex, ReadFile, GetProcessAffinityMask, SetThreadAffinityMask, ResumeThread, GetExitCodeThread, GetSystemInfo, lstrcatA, LoadLibraryA, lstrcmpA, GetLogicalDriveStringsA, GetDriveTypeA, GetVolumeInformationW, GlobalMemoryStatus, lstrcpyA, Sleep, FindResourceExW, LockResource, CreateFileA, GetSystemDirectoryA, CreateThread, GetSystemDefaultLCID, CreateEventW, SystemTimeToFileTime, SetEvent, WaitForSingleObject, GetSystemTime, lstrcmpW, InitializeCriticalSectionAndSpinCount, VirtualProtect, ExitProcess, CreateEventA, TlsSetValue, TlsGetValue, VirtualAlloc, TlsAlloc, VirtualFree, TlsFree
> msvcrt.dll: strchr, _purecall, __2@YAPAXI@Z, realloc, free, malloc, _snprintf, isspace, strncmp, wcstombs, sprintf, _snwprintf, _initterm, _adjust_fdiv, __CxxFrameHandler, sscanf, wcslen, memmove, atof, _ftol, _strnicmp, atol, wcsncpy, ceil, _wtol, wcstok, _wcsicmp, _itow, _wtoi, wcsncat, wcsncmp, _wcsupr, _CIpow, wcscpy, wcschr, __3@YAXPAX@Z, _except_handler3
> ntdll.dll: NtClose, NtQuerySystemInformation, RtlTimeToTimeFields, NtLockProductActivationKeys, NtMapViewOfSection, NtOpenSection, RtlInitUnicodeString, NtUnmapViewOfSection
> ole32.dll: CoTaskMemFree, CoTaskMemRealloc, CoUninitialize, CoInitializeEx, StringFromGUID2, CoCreateInstance, CoTaskMemAlloc, CoCreateGuid
> OLEAUT32.dll: -, -, -, -, -, -, -
> RPCRT4.dll: UuidCreate
> SETUPAPI.dll: SetupDiGetClassDevsW, SetupDiGetDeviceRegistryPropertyW, SetupDiEnumDeviceInfo, SetupDiDestroyDeviceInfoList
> USER32.dll: wsprintfA, GetSystemMetrics, GetDesktopWindow, CharNextW, SetTimer, KillTimer, wsprintfW
> WININET.dll: InternetReadFile, InternetConnectA, InternetQueryOptionW, InternetErrorDlg, InternetCloseHandle, InternetAutodial, InternetSetOptionA, HttpSendRequestW, InternetOpenA, HttpOpenRequestA, InternetAutodialHangup, HttpQueryInfoW, InternetGetConnectedState

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
PDFiD.: -
RDS...: NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier

Réponse 114 / 167

sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 463
27 mai 2009 à 23:22

Rien pour VT ... mais ce n'est pas bon signe pour autant ...

fais ceci stp :

Télécharge ComboFix (par sUBs) sur ton Bureau (et pas ailleurs !):

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

--------------------------------- [ ! ATTENTION ! ] ------------------------------------------
!! Déconnecte toi,ferme tes applications en cours ( ainsi que ton navigateur ) et DESACTIVE TOUTES TES DEFENSES (anti-virus, guarde anti spy-ware, pare-feu) le temps de la manipe :
en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
--->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
Tuto ( aide ) ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Note : pour XP, bien installer la Console de Récupération de Windows comme il est indiqué dans le tuto ci-dessus ...
--------------------------------------------------------------------------------------------

Ensuite :
double-clique sur l'icône "combofix.exe" pour lancer l'outil .

Appuie sur la touche Y (Yes) pour démarrer le scan .

Notes importantes :
-> n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi .
-> Il se peut que le PC redémarre de lui même ( pour finaliser le nettoyage ) , laisse le faire .
-> Si l'outil t'anonce ceci : "combofix a détecté la présence de rootkit et a besoin de faire redémarer votre machine", tu acceptes ...
-> si un message d'erreur windows apparait à un momment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! sinon pas de rapport ... )

Le rapport sera crée ici : C:\Combofix.txt

Réactive bien tes défenses .

Poste le rapport Combofix pour analyse ...

Réponse 115 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
27 mai 2009 à 23:49

Bon le programme semble s'etre réalisé correctement.
SEULMENT LORS DU REDEMARRAGE MON FOND D'ECRAN SE CHANGE DEVANT MES YEUX ET ME REMET UN ANCIEN QUE J'AVAIS MIS IL Y A QUELQUE TEMPS EST-CE NORMAL ET PUIS6JE MAITENANT REMETTRE MON FOND D4ECRAN HABITUEL?( dsl pour les maj)
Alors voici le rapport ( regarde quand meme ce que j'ai écris plus haut stp)

Rapport:

ComboFix 09-05-26.05 - Florian 27/05/2009 23:35.1 - NTFSx86
Lancé depuis: c:\documents and settings\Florian\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\DinerDash.1.0.0.58
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\accessories\cup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\accessories\customer_cup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\accessories\heart.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\accessories\menu_down.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\accessories\menu_up.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\accessories\plates.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\accessories\ticket.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\accessories\tray.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\music\mainmenumusic.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_bring_check_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_deliver_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_deliver_order_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_diner.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_food_ready_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_gain_heart_1.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_get_drinks_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_party_arrive_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_pencil_write_2.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_pickup_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_rollover_1.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\audio\sfx\sfx_seat_people_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\choosedifficulty.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\credits.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\flo_lose.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\flo_win.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\help1.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\help2.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\highscores.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\levelintro.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\levelintro_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\levelover.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\levelover_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\mainmenu.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\popup.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\popup_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\upgradegrid.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\upgradetitle.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\backgrounds\upsell.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\arrowleft_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\arrowleft_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\arrowright_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\arrowright_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\back_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\back_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\backchalk.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\backchalkup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\backtomenu_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\backtomenu_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\cancel.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\cancelup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\career.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\career_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\close.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\closeup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\continue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\continueover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\credits_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\credits_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\download_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\download_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\easy.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\easy_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\endlessshift.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\endlessshift_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\hard.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\hard_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\help.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\help_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\highscores.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\highscores_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\instructions_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\instructions_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\letsplay.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\letsplayover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\medium.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\medium_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\moreinfo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\moreinfoup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\off.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\off_on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\on_on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\pause.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\pauseover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\quit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\quitgame.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\quitgameover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\quitover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\resumegame.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\resumegameover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\submit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\submitup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\tryagain.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\tryagainover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\upgrade_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\upgrade_up.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\viewglobal.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\viewglobalup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\viewhighscore.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\viewhighscoreon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\viewlocal.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\buttons\viewlocalup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\comics\webcomic.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\config\career.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\config\customer.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\config\endless.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\config\global.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\config\powerups.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\cook\cook.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\cook\cook.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\cook\stove.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\cursor\arrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\cursor\click.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\cursor\click2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\cursor\grab.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\cursor\open.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\blue\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\blue\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\blue\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\green\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\green\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\green\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\purple\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\purple\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\purple\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\red\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\red\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\red\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\yellow\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\yellow\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\old_male\yellow\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\blue\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\blue\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\blue\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\green\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\green\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\green\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\purple\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\purple\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\purple\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\red\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\red\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\red\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\yellow\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\yellow\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\customers\young_female\yellow\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\flo\idle.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\flo\idle.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\flo\lower.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\flo\lower.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\flo\upper.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\flo\upper.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\fonts\arial.mvec
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\fonts\komikaaxis.mvec
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\chair.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\chair.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\dirt2top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\dirt4top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\dishcart.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\dishcart.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\drinkstation_off.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\drinkstation_on1.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\drinkstation_on2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\ticketstation.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\furniture\ticketstation.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\arrowdown.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\arrowdownon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\arrowleft.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\arrowlefton.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\arrowright.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\arrowrighton.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\arrowup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\arrowupon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\p1icon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\textedit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\hiscore\title.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_1.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_1_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_1_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_1_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_2.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_2_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_2_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_2_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_2_d.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_3.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_3_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_3_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_3_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\endless_1_3_d.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\fifth_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\first_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\fourth_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\layouts\second_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\playfirst_logo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\background.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\food\food1.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\food\food1.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\food\food2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\food\food2.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\food\food3.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\food\food3.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\frames\upgrade_0001.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\tables\2top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\tables\2top.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\tables\4top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\tables\4top.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\diner\upgrades.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\restaurants\tableshadow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\choosedifficulty.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\chooseplayer.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\chooserestaurant.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\credits.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\game.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\gothighscore.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\help.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\help2.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\hiscore.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\hiscoreinfo.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\hiscoresubmit.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\levelintro.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\levelover.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\loading.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\mainloop.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\mainmenu.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\ok.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\pause.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\style.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\tutorialintro.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\upgrade.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\upsell.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\webcomic.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\scripts\yesno.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\splash\gamelabsplash.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\splash\playfirst_logo.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\strings.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\angersmoke.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\angersmoke.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\chairflags.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\chairflags.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\check.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\checkmark.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\clock.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\closed.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\closingtime.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\coinflip.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\coinflip.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\dollar.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\doodles\coffee.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\doodles\tables.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\doodles\wallpaper.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\expert.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\expertscore.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\foodpoof.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\foodpoof.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\fork_timer.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\goalcompleted.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\heartgrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\heartgrow.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\jar.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\jar.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\level.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\level_career.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\score.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\sound.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\staroff.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\staron.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\tablenumber.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\tablenumberup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\traynumber.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\tutorial_character.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\tutorialarrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\tutorialbox.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgradeanim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgradeanim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgrades\drinks.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgrades\maitred.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgrades\oven.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgrades\select.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgrades\shoes.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgrades\stereo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\assets\ui\upgrades\table.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.58\dinerdash.exe
c:\windows\system32\_004373_.tmp.dll
c:\windows\system32\_004374_.tmp.dll
c:\windows\system32\_004375_.tmp.dll
c:\windows\system32\_004376_.tmp.dll
c:\windows\system32\_004383_.tmp.dll
c:\windows\system32\_004384_.tmp.dll
c:\windows\system32\_004385_.tmp.dll
c:\windows\system32\_004386_.tmp.dll
c:\windows\system32\_004387_.tmp.dll
c:\windows\system32\_004388_.tmp.dll
c:\windows\system32\_004389_.tmp.dll
c:\windows\system32\_004390_.tmp.dll
c:\windows\system32\_004391_.tmp.dll
c:\windows\system32\_004392_.tmp.dll
c:\windows\system32\_004393_.tmp.dll
c:\windows\system32\_004394_.tmp.dll
c:\windows\system32\_004395_.tmp.dll
c:\windows\system32\_004396_.tmp.dll
c:\windows\system32\_004397_.tmp.dll
c:\windows\system32\_004399_.tmp.dll
c:\windows\system32\_004402_.tmp.dll
c:\windows\system32\_004403_.tmp.dll
c:\windows\system32\_004407_.tmp.dll
c:\windows\system32\_004408_.tmp.dll
c:\windows\system32\_004409_.tmp.dll
c:\windows\system32\_004410_.tmp.dll
c:\windows\system32\_004411_.tmp.dll
c:\windows\system32\_004412_.tmp.dll
c:\windows\system32\_004413_.tmp.dll
c:\windows\system32\_004415_.tmp.dll
c:\windows\system32\_004416_.tmp.dll
c:\windows\system32\_004417_.tmp.dll
c:\windows\system32\_004418_.tmp.dll
c:\windows\system32\_004419_.tmp.dll
c:\windows\system32\_004420_.tmp.dll
c:\windows\system32\_004421_.tmp.dll
c:\windows\system32\_004422_.tmp.dll
c:\windows\system32\_004423_.tmp.dll
c:\windows\system32\_004424_.tmp.dll
c:\windows\system32\_004425_.tmp.dll
c:\windows\system32\_004426_.tmp.dll
c:\windows\system32\_004429_.tmp.dll
c:\windows\system32\_004430_.tmp.dll
c:\windows\system32\_004431_.tmp.dll
c:\windows\system32\_004433_.tmp.dll
c:\windows\system32\_004434_.tmp.dll
c:\windows\system32\_004435_.tmp.dll
c:\windows\system32\_004436_.tmp.dll
c:\windows\system32\_004438_.tmp.dll
c:\windows\system32\_004441_.tmp.dll
c:\windows\system32\_004442_.tmp.dll
c:\windows\system32\_004446_.tmp.dll
c:\windows\system32\_004447_.tmp.dll
c:\windows\system32\_004449_.tmp.dll
c:\windows\system32\_004452_.tmp.dll
c:\windows\system32\_004454_.tmp.dll
c:\windows\system32\_004455_.tmp.dll
c:\windows\system32\_004456_.tmp.dll
c:\windows\system32\_004457_.tmp.dll
c:\windows\system32\_004460_.tmp.dll
c:\windows\system32\_004461_.tmp.dll
c:\windows\system32\_004462_.tmp.dll
c:\windows\system32\_004463_.tmp.dll
c:\windows\system32\_004464_.tmp.dll
c:\windows\system32\_004469_.tmp.dll
c:\windows\system32\_004471_.tmp.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-27 au 2009-05-27 ))))))))))))))))))))))))))))))))))))
.

2009-05-26 20:14 . 2005-01-07 16:07 138752 ------w c:\windows\system32\drivers\hdaudbus.sys
2009-05-26 20:13 . 2004-08-05 12:00 82432 ----a-w c:\windows\system32\dllcache\msdtcstp.dll
2009-05-26 20:12 . 2004-08-05 12:00 32256 ----a-w c:\windows\system32\dllcache\wpabaln.exe
2009-05-26 20:02 . 2009-05-26 20:02 -------- d-----w c:\program files\CCleaner
2009-05-25 16:46 . 2009-05-26 20:26 -------- d-----w c:\windows\l2schemas
2009-05-25 16:46 . 2009-05-26 20:27 -------- d-----w c:\windows\system32\fr
2009-05-25 16:46 . 2009-05-26 20:27 -------- d-----w c:\windows\system32\bits
2009-05-25 16:33 . 2004-08-05 12:00 71040 ------w c:\windows\system32\drivers\_004363_.tmp.dll
2009-05-25 15:59 . 2009-05-27 21:38 -------- d-----w c:\windows\system32\CatRoot2
2009-05-25 15:38 . 2009-05-25 15:38 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-25 15:28 . 2009-05-06 18:06 4784464 ----a-w c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{3452C51F-A6B4-47DD-A8C1-D45BFF03F3C6}\mpengine.dll
2009-05-25 05:49 . 2009-05-25 05:49 -------- d-----w c:\program files\YourWare Solutions
2009-05-24 12:31 . 2009-05-27 16:56 -------- d-----w c:\program files\Fichiers communs\Adobe
2009-05-24 12:23 . 2009-05-24 12:23 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-24 12:23 . 2009-05-24 12:23 -------- d-----w c:\program files\Java
2009-05-24 12:22 . 2009-05-24 12:22 152576 ----a-w c:\documents and settings\Florian\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-24 08:28 . 2009-05-24 08:28 -------- d-----w c:\windows\system32\Kaspersky Lab
2009-05-24 07:40 . 2009-05-24 07:40 -------- d-----w C:\logs
2009-05-23 16:13 . 2009-05-23 16:13 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2009-05-21 09:05 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-21 09:05 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-21 09:05 . 2009-05-21 09:25 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-21 08:38 . 2009-05-21 08:38 -------- d-----w c:\documents and settings\Florian\Application Data\Malwarebytes
2009-05-20 21:35 . 2009-05-20 21:35 -------- d-----w C:\autorun.MSNFix
2009-05-20 13:59 . 2009-05-27 20:17 -------- d-----w c:\program files\Trend Micro
2009-05-17 09:54 . 2009-05-17 09:54 -------- d-----w c:\documents and settings\Vincent\Application Data\id Software
2009-05-16 19:40 . 2009-05-17 17:48 334912 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\baseq3\cgamex86.dll
2009-05-16 19:40 . 2009-05-17 15:22 441408 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\baseq3\qagamex86.dll
2009-05-16 19:40 . 2009-05-16 19:40 57344 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbags.dll
2009-05-16 19:40 . 2009-05-16 19:40 874660 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbcls.dll
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-----w c:\documents and settings\Florian\Local Settings\Application Data\PunkBuster
2009-05-16 19:40 . 2009-05-17 17:48 171072 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\baseq3\uix86.dll
2009-05-16 19:40 . 2009-05-17 17:48 874660 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbcl.dll
2009-05-16 19:40 . 2009-05-17 17:48 57344 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbag.dll
2009-05-16 19:40 . 2009-05-17 17:48 479232 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbsv.dll
2009-05-16 19:40 . 2009-05-17 17:48 2669632 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\baseq3\quakelive.dll
2009-05-16 19:37 . 2009-05-16 19:37 -------- d-----w c:\documents and settings\Florian\Application Data\id Software
2009-05-16 19:35 . 2009-05-17 17:49 138944 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-05-16 19:35 . 2009-05-16 19:35 22328 ----a-w c:\documents and settings\Florian\Application Data\PnkBstrK.sys
2009-05-16 19:35 . 2009-05-17 17:48 189784 ----a-w c:\windows\system32\PnkBstrB.exe
2009-05-16 19:35 . 2009-05-16 19:55 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-05-16 19:35 . 2009-05-16 19:35 2246144 ----a-w c:\windows\system32\pbsvc.exe
2009-05-16 19:35 . 2009-05-16 19:35 -------- d-----w c:\documents and settings\All Users\Application Data\id Software
2009-05-14 20:01 . 2009-05-14 20:01 -------- d-----w c:\program files\MSECache
2009-05-13 16:46 . 2009-05-13 16:49 -------- d-----w c:\program files\Wolfenstein - Enemy Territory
2009-05-12 18:03 . 2009-05-12 18:03 -------- d-----w c:\documents and settings\Florian\dwhelper
2009-05-12 15:34 . 2009-05-12 15:34 -------- d-----w c:\documents and settings\Florian\Application Data\FMZilla
2009-05-12 15:34 . 2009-05-15 15:51 -------- d-----w c:\program files\Free Music Zilla
2009-05-11 13:31 . 2009-05-11 13:31 -------- d-----w c:\documents and settings\Florian\Application Data\IndexEducation
2009-05-11 13:30 . 2009-05-11 13:30 -------- d-----w C:\ProfNOTE 2008
2009-05-03 13:42 . 2009-05-03 13:42 -------- d-----w c:\documents and settings\EDITH\Application Data\vlc
2009-05-01 11:49 . 2009-05-01 11:49 -------- d-----w c:\documents and settings\Vincent\Application Data\InstallShield
2009-05-01 10:45 . 2009-05-01 10:45 -------- d-----w c:\documents and settings\Florian\Application Data\Megaupload
2009-05-01 10:43 . 2009-05-01 10:43 -------- d-----w c:\program files\Megaupload
2009-05-01 10:43 . 2009-05-01 10:43 -------- d-----w c:\documents and settings\Florian\Application Data\InstallShield
2009-04-29 15:27 . 2009-04-29 15:44 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 20:07 . 2006-12-08 17:42 -------- d-----w c:\program files\Samsung
2009-05-27 19:11 . 2009-02-23 09:36 -------- d-----w c:\program files\Orbitdownloader
2009-05-26 17:36 . 2003-12-31 23:56 -------- d-----w c:\program files\IncrediMail
2009-05-25 20:10 . 2009-01-28 18:37 1 ----a-w c:\documents and settings\Florian\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-05-24 12:01 . 2006-12-04 08:48 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-21 18:58 . 2006-12-03 10:36 94208 ----a-w c:\windows\DUMP5285.tmp
2009-05-21 08:26 . 2006-12-04 12:25 82136 ----a-w c:\documents and settings\Florian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-20 21:32 . 2009-02-23 09:36 -------- d-----w c:\documents and settings\Florian\Application Data\Orbit
2009-05-20 11:13 . 2009-02-24 08:29 -------- d-----w c:\documents and settings\EDITH\Application Data\Orbit
2009-05-17 09:58 . 2009-03-08 15:40 -------- d-----w c:\documents and settings\Vincent\Application Data\Orbit
2009-05-16 08:08 . 2007-06-01 10:29 82136 ----a-w c:\documents and settings\Vincent\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-15 19:45 . 2006-12-09 09:58 82136 -c--a-w c:\documents and settings\EDITH\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-06 18:06 . 2009-04-18 08:06 4784464 ----a-w c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2009-04-29 15:27 . 2003-12-31 23:47 -------- d-----w c:\program files\Lavasoft
2009-04-29 13:26 . 2009-01-20 19:58 1 ----a-w c:\documents and settings\Vincent\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-04-22 10:05 . 2009-04-11 19:53 -------- d-----w c:\program files\Shareaza Turbo Booster
2009-04-18 08:04 . 2009-04-18 08:04 -------- d-----w c:\program files\Windows Defender
2009-04-14 15:30 . 2009-04-14 15:30 625728 ----a-w c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
2009-04-13 10:30 . 2006-12-04 18:44 -------- d-----w c:\program files\Warcraft III
2009-04-10 19:32 . 2009-04-10 19:32 -------- d-----w c:\program files\RayV
2009-04-06 20:36 . 2009-04-06 20:36 -------- d-----w c:\documents and settings\Florian\Application Data\vlc
2009-04-06 17:07 . 2009-01-26 15:46 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-01 19:28 . 2009-03-08 15:30 1 ----a-w c:\documents and settings\EDITH\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-04-01 12:28 . 2009-04-01 12:28 15240 ----a-w c:\documents and settings\Florian\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll
2009-03-29 17:04 . 2008-06-03 17:03 -------- d-----w c:\program files\eMule
2009-03-06 14:46 . 2004-08-05 12:00 286208 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:13 . 2004-08-05 12:00 826368 ----a-w c:\windows\system32\wininet.dll
2006-05-03 10:06 . 2009-03-13 19:21 163328 --sh--r c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-03-13 19:21 31232 --sh--r c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-03-13 19:21 216064 --sh--r c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-23 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-03-31 251264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-06-13 668328]
"lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-06-13 16040]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2008-06-13 320168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\EDITH\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\documents and settings\Vincent\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Hyperappel de l'Encyclopédie Universelle Larousse.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Hyperappel de l'Encyclopédie Universelle Larousse.lnk
backup=c:\windows\pss\Hyperappel de l'Encyclopédie Universelle Larousse.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxamon.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Free Music Zilla\\FMZilla.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

R2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe [2008-02-28 98984]
R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys [2005-05-20 131072]
R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys [2005-05-20 618112]
R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNW.sys [2005-05-20 52736]
R3 CrystalSysInfo;CrystalSysInfo;c:\program files\MediaCoder\SysInfo.sys [x]
R3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe [2008-02-28 594600]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - Aavmker4
*Deregistered* - AFD
*Deregistered* - Alerter
*Deregistered* - ALG
*Deregistered* - Apple Mobile Device
*Deregistered* - Arp1394
*Deregistered* - aswFsBlk
*Deregistered* - aswMon2
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi
*Deregistered* - aswUpdSv
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - avast! Antivirus
*Deregistered* - avast! Mail Scanner
*Deregistered* - avast! Web Scanner
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Bonjour Service
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - lxdx_device
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PCIIde
*Deregistered* - PnkBstrA
*Deregistered* - PnkBstrB
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RecAgent
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SLService
*Deregistered* - SlWdmSup
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - WinDefend
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
Contenu du dossier 'Tâches planifiées'

2009-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-05-27 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2009-05-27 c:\windows\Tasks\User_Feed_Synchronization-{8219B8D7-AC4D-4176-A514-870E86BABDD3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 16:36]

2009-05-27 c:\windows\Tasks\User_Feed_Synchronization-{98B1D8D9-0D5A-4F75-BEDD-011E3305E90B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 16:36]
.
- - - - ORPHELINS SUPPRIMES - - - -

SafeBoot-procexp90.Sys

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: {1D6E056F-D1BB-40F6-88E4-11EE98056FD2} - hxxp://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} - file:///C:/Documents%20and%20Settings/Florian/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash2_fr.1.0.0.70.cab
DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - file:///C:/Documents%20and%20Settings/Florian/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash.1.0.0.98.cab
FF - ProfilePath - c:\documents and settings\Florian\Application Data\Mozilla\Firefox\Profiles\cw3bs99w.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.orange.fr/
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar_fs&search=
FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\documents and settings\Florian\Application Data\Mozilla\Firefox\Profiles\cw3bs99w.default\extensions\OberonGameHost@OberonGames.com\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nprayvplugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-27 23:40
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1292428093-682003330-725345543-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040AC1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(608)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3024)
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\slserv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Lexmark 3600-4600 Series\lxdxmsdmon.exe
c:\program files\IncrediMail\bin\ImApp.exe
c:\windows\system32\wscntfy.exe
c:\program files\IncrediMail\bin\ImNotfy.exe
.
**************************************************************************
.
Heure de fin: 2009-05-27 23:45 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-27 21:45

Avant-CF: 110 908 420 096 octets libres
Après-CF: 110 785 490 944 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /fastdetect

Current=5 Default=5 Failed=4 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
742 --- E O F --- 2009-05-27 16:01

Réponse 116 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
28 mai 2009 à 00:12

Bon je vais aller me coucher et je te dit a demain.
Encore merci pour ton aide.

Réponse 117 / 167

sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 463
28 mai 2009 à 00:14

Pas de prb pour ton fond d'écran .... remets celui que tu veux ...

la suite :

1-Créer un doc texte sur ton bureau :
pointe ta souris sur ton bureau , clique droit : va dans "nouveau" et choisis "document texte" .

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de créer :

File::
c:\windows\system32\drivers\_004363_.tmp.dll

Puis va dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valide ...

2-Nettoyage :

!! Déconnecte toi, ferme toutes tes applications et désactive TOUTES TES DEFENSES ( tu les réactiveras après ) !!

--->Sur ton bureau, fais glisser avec ta souris le fichier CFScript sur l'icône de ComboFix.exe .

(Regarde ici : http://img.photobucket.com/albums/v666/sUBs/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide.

Puis patiente le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)

!! Ne touches à rien tant que le scan n'est pas terminé !!

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : poste le accompagné d' un nouveau rapport RSIT pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )

Réponse 118 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
28 mai 2009 à 17:52

Bon j'ai fait ce que tu m'a demandé cependant on ne m'a pas demander d'appuyer sur la touche "1" ca a marké " recheche de fichiers infectés et ca n'a pas redémarré le PC.
Voila je poste le rapport:

ComboFix 09-05-26.05 - Florian 28/05/2009 17:44.2 - NTFSx86
Lancé depuis: c:\documents and settings\Florian\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\Florian\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-04-28 au 2009-05-28 ))))))))))))))))))))))))))))))))))))
.

2009-05-28 15:34 . 2009-05-06 18:06 4784464 ----a-w c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{DF230557-59BC-4C1C-91AE-E549BF74CD74}\mpengine.dll
2009-05-27 20:17 . 2009-05-27 20:17 -------- d-----w C:\rsit
2009-05-26 20:13 . 2004-08-05 12:00 82432 ----a-w c:\windows\system32\dllcache\msdtcstp.dll
2009-05-26 20:12 . 2004-08-05 12:00 32256 ----a-w c:\windows\system32\dllcache\wpabaln.exe
2009-05-26 20:02 . 2009-05-26 20:02 -------- d-----w c:\program files\CCleaner
2009-05-25 16:46 . 2009-05-26 20:26 -------- d-----w c:\windows\l2schemas
2009-05-25 16:46 . 2009-05-26 20:27 -------- d-----w c:\windows\system32\fr
2009-05-25 16:46 . 2009-05-26 20:27 -------- d-----w c:\windows\system32\bits
2009-05-25 16:33 . 2004-08-05 12:00 71040 ------w c:\windows\system32\drivers\_004363_.tmp.dll
2009-05-25 15:59 . 2009-05-28 15:43 -------- d-----w c:\windows\system32\CatRoot2
2009-05-25 15:38 . 2009-05-25 15:38 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-25 05:49 . 2009-05-25 05:49 -------- d-----w c:\program files\YourWare Solutions
2009-05-24 12:31 . 2009-05-27 16:56 -------- d-----w c:\program files\Fichiers communs\Adobe
2009-05-24 12:23 . 2009-05-24 12:23 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-24 12:23 . 2009-05-24 12:23 -------- d-----w c:\program files\Java
2009-05-24 12:22 . 2009-05-24 12:22 152576 ----a-w c:\documents and settings\Florian\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-24 08:28 . 2009-05-24 08:28 -------- d-----w c:\windows\system32\Kaspersky Lab
2009-05-24 07:40 . 2009-05-24 07:40 -------- d-----w C:\logs
2009-05-23 16:13 . 2009-05-23 16:13 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2009-05-21 09:05 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-21 09:05 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-21 09:05 . 2009-05-21 09:25 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-21 08:38 . 2009-05-21 08:38 -------- d-----w c:\documents and settings\Florian\Application Data\Malwarebytes
2009-05-20 21:35 . 2009-05-20 21:35 -------- d-----w C:\autorun.MSNFix
2009-05-20 13:59 . 2009-05-27 20:17 -------- d-----w c:\program files\Trend Micro
2009-05-17 09:54 . 2009-05-17 09:54 -------- d-----w c:\documents and settings\Vincent\Application Data\id Software
2009-05-16 19:40 . 2009-05-17 17:48 334912 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\baseq3\cgamex86.dll
2009-05-16 19:40 . 2009-05-17 15:22 441408 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\baseq3\qagamex86.dll
2009-05-16 19:40 . 2009-05-16 19:40 57344 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbags.dll
2009-05-16 19:40 . 2009-05-16 19:40 874660 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbcls.dll
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-----w c:\documents and settings\Florian\Local Settings\Application Data\PunkBuster
2009-05-16 19:40 . 2009-05-17 17:48 171072 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\baseq3\uix86.dll
2009-05-16 19:40 . 2009-05-17 17:48 874660 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbcl.dll
2009-05-16 19:40 . 2009-05-17 17:48 57344 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbag.dll
2009-05-16 19:40 . 2009-05-17 17:48 479232 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\pb\pbsv.dll
2009-05-16 19:40 . 2009-05-17 17:48 2669632 ----a-w c:\documents and settings\Florian\Application Data\id Software\quakelive\home\baseq3\quakelive.dll
2009-05-16 19:37 . 2009-05-16 19:37 -------- d-----w c:\documents and settings\Florian\Application Data\id Software
2009-05-16 19:35 . 2009-05-17 17:49 138944 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-05-16 19:35 . 2009-05-16 19:35 22328 ----a-w c:\documents and settings\Florian\Application Data\PnkBstrK.sys
2009-05-16 19:35 . 2009-05-17 17:48 189784 ----a-w c:\windows\system32\PnkBstrB.exe
2009-05-16 19:35 . 2009-05-16 19:55 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-05-16 19:35 . 2009-05-16 19:35 2246144 ----a-w c:\windows\system32\pbsvc.exe
2009-05-16 19:35 . 2009-05-16 19:35 -------- d-----w c:\documents and settings\All Users\Application Data\id Software
2009-05-14 20:01 . 2009-05-14 20:01 -------- d-----w c:\program files\MSECache
2009-05-13 16:46 . 2009-05-13 16:49 -------- d-----w c:\program files\Wolfenstein - Enemy Territory
2009-05-12 18:03 . 2009-05-12 18:03 -------- d-----w c:\documents and settings\Florian\dwhelper
2009-05-12 15:34 . 2009-05-12 15:34 -------- d-----w c:\documents and settings\Florian\Application Data\FMZilla
2009-05-12 15:34 . 2009-05-15 15:51 -------- d-----w c:\program files\Free Music Zilla
2009-05-11 13:31 . 2009-05-11 13:31 -------- d-----w c:\documents and settings\Florian\Application Data\IndexEducation
2009-05-11 13:30 . 2009-05-11 13:30 -------- d-----w C:\ProfNOTE 2008
2009-05-03 13:42 . 2009-05-03 13:42 -------- d-----w c:\documents and settings\EDITH\Application Data\vlc
2009-05-01 11:49 . 2009-05-01 11:49 -------- d-----w c:\documents and settings\Vincent\Application Data\InstallShield
2009-05-01 10:45 . 2009-05-01 10:45 -------- d-----w c:\documents and settings\Florian\Application Data\Megaupload
2009-05-01 10:43 . 2009-05-01 10:43 -------- d-----w c:\program files\Megaupload
2009-05-01 10:43 . 2009-05-01 10:43 -------- d-----w c:\documents and settings\Florian\Application Data\InstallShield
2009-04-29 15:27 . 2009-04-29 15:44 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 20:07 . 2006-12-08 17:42 -------- d-----w c:\program files\Samsung
2009-05-27 19:11 . 2009-02-23 09:36 -------- d-----w c:\program files\Orbitdownloader
2009-05-26 17:36 . 2003-12-31 23:56 -------- d-----w c:\program files\IncrediMail
2009-05-25 20:10 . 2009-01-28 18:37 1 ----a-w c:\documents and settings\Florian\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-05-24 12:01 . 2006-12-04 08:48 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-21 18:58 . 2006-12-03 10:36 94208 ----a-w c:\windows\DUMP5285.tmp
2009-05-21 08:26 . 2006-12-04 12:25 82136 ----a-w c:\documents and settings\Florian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-20 21:32 . 2009-02-23 09:36 -------- d-----w c:\documents and settings\Florian\Application Data\Orbit
2009-05-20 11:13 . 2009-02-24 08:29 -------- d-----w c:\documents and settings\EDITH\Application Data\Orbit
2009-05-17 09:58 . 2009-03-08 15:40 -------- d-----w c:\documents and settings\Vincent\Application Data\Orbit
2009-05-16 08:08 . 2007-06-01 10:29 82136 ----a-w c:\documents and settings\Vincent\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-15 19:45 . 2006-12-09 09:58 82136 -c--a-w c:\documents and settings\EDITH\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-06 18:06 . 2009-04-18 08:06 4784464 ----a-w c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2009-04-29 15:27 . 2003-12-31 23:47 -------- d-----w c:\program files\Lavasoft
2009-04-29 13:26 . 2009-01-20 19:58 1 ----a-w c:\documents and settings\Vincent\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-04-22 10:05 . 2009-04-11 19:53 -------- d-----w c:\program files\Shareaza Turbo Booster
2009-04-18 08:04 . 2009-04-18 08:04 -------- d-----w c:\program files\Windows Defender
2009-04-14 15:30 . 2009-04-14 15:30 625728 ----a-w c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
2009-04-13 10:30 . 2006-12-04 18:44 -------- d-----w c:\program files\Warcraft III
2009-04-10 19:32 . 2009-04-10 19:32 -------- d-----w c:\program files\RayV
2009-04-06 20:36 . 2009-04-06 20:36 -------- d-----w c:\documents and settings\Florian\Application Data\vlc
2009-04-06 17:07 . 2009-01-26 15:46 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-01 19:28 . 2009-03-08 15:30 1 ----a-w c:\documents and settings\EDITH\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-04-01 12:28 . 2009-04-01 12:28 15240 ----a-w c:\documents and settings\Florian\Application Data\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll
2009-03-29 17:04 . 2008-06-03 17:03 -------- d-----w c:\program files\eMule
2009-03-06 14:46 . 2004-08-05 12:00 286208 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:13 . 2004-08-05 12:00 826368 ----a-w c:\windows\system32\wininet.dll
2006-05-03 10:06 . 2009-03-13 19:21 163328 --sh--r c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-03-13 19:21 31232 --sh--r c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-03-13 19:21 216064 --sh--r c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-27_21.41.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-28 15:29 . 2009-05-28 15:29 16384 c:\windows\Temp\Perflib_Perfdata_564.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-23 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-03-31 251264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-06-13 668328]
"lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-06-13 16040]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2008-06-13 320168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\EDITH\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\documents and settings\Vincent\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Hyperappel de l'Encyclopédie Universelle Larousse.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Hyperappel de l'Encyclopédie Universelle Larousse.lnk
backup=c:\windows\pss\Hyperappel de l'Encyclopédie Universelle Larousse.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxamon.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\Free Music Zilla\\FMZilla.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

R2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe [2008-02-28 98984]
R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys [2005-05-20 131072]
R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys [2005-05-20 618112]
R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNW.sys [2005-05-20 52736]
R3 CrystalSysInfo;CrystalSysInfo;c:\program files\MediaCoder\SysInfo.sys [x]
R3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe [2008-02-28 594600]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - Aavmker4
*Deregistered* - AFD
*Deregistered* - Alerter
*Deregistered* - ALG
*Deregistered* - Apple Mobile Device
*Deregistered* - Arp1394
*Deregistered* - aswFsBlk
*Deregistered* - aswMon2
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi
*Deregistered* - aswUpdSv
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - avast! Antivirus
*Deregistered* - avast! Mail Scanner
*Deregistered* - avast! Web Scanner
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Bonjour Service
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - lxdx_device
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PCIIde
*Deregistered* - PnkBstrA
*Deregistered* - PnkBstrB
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RecAgent
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SLService
*Deregistered* - SlWdmSup
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - WinDefend
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
Contenu du dossier 'Tâches planifiées'

2009-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-05-28 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2009-05-28 c:\windows\Tasks\User_Feed_Synchronization-{8219B8D7-AC4D-4176-A514-870E86BABDD3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 16:36]

2009-05-28 c:\windows\Tasks\User_Feed_Synchronization-{98B1D8D9-0D5A-4F75-BEDD-011E3305E90B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 16:36]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: {1D6E056F-D1BB-40F6-88E4-11EE98056FD2} - hxxp://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} - file:///C:/Documents%20and%20Settings/Florian/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash2_fr.1.0.0.70.cab
DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} - file:///C:/Documents%20and%20Settings/Florian/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash.1.0.0.98.cab
FF - ProfilePath - c:\documents and settings\Florian\Application Data\Mozilla\Firefox\Profiles\cw3bs99w.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.orange.fr/
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar_fs&search=
FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\documents and settings\Florian\Application Data\Mozilla\Firefox\Profiles\cw3bs99w.default\extensions\OberonGameHost@OberonGames.com\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nprayvplugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-28 17:46
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1292428093-682003330-725345543-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040AC1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(596)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2352)
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2009-05-28 17:47
ComboFix-quarantined-files.txt 2009-05-28 15:47
ComboFix2.txt 2009-05-27 21:45

Avant-CF: 110 763 319 296 octets libres
Après-CF: 110 743 007 232 octets libres

Current=5 Default=5 Failed=4 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
361 --- E O F --- 2009-05-28 15:34

Réponse 119 / 167

flo-91 Messages postés 5646 Date d'inscription mardi 19 mai 2009 Statut Contributeur sécurité Dernière intervention 31 octobre 2019 1 118
28 mai 2009 à 17:54

Voici maintenant le rapport nouveau rapport de RSIT.
Rapport RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Florian at 2009-05-28 17:53:17
WIN_XP Service Pack 2
System drive C: has 106 GB (69%) free of 153 GB
Total RAM: 511 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:53:28, on 28/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system32\spoolsv.exe
C:\windows\system32\Ati2evxx.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\windows\system32\lxdxcoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\system32\PnkBstrA.exe
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
C:\windows\system32\PnkBstrB.exe
C:\Program Files\Lexmark 3600-4600 Series\lxdxMsdMon.exe
C:\windows\system32\slserv.exe
C:\windows\system32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\windows\system32\ctfmon.exe
C:\windows\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Documents and Settings\Florian\Bureau\RSIT.exe
C:\Program Files\trend micro\Florian.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O3 - Toolbar: Lexmark Barre d'outils - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [lxdxmon.exe] "C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe"
O4 - HKLM\..\Run: [lxdxamon] "C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-21-1292428093-682003330-725345543-1005\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-1292428093-682003330-725345543-1005\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-1292428093-682003330-725345543-1005\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1292428093-682003330-725345543-1005\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c (User '?')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User '?')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://intranet.eps-etampes.fr
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {1D6E056F-D1BB-40F6-88E4-11EE98056FD2} (Oberon ActiveX Game Host) - http://jeuxenligne.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5392B545-31A5-4724-BEF3-4FED1D56FDAC} (CPlayFirstDinerDash2_frControl Object) - file:///C:/Documents%20and%20Settings/Florian/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash2_fr.1.0.0.70.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - file:///C:/Documents%20and%20Settings/Florian/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/DinerDash.1.0.0.98.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxdxCATSCustConnectService - Lexmark International, Inc. - C:\windows\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe
O23 - Service: lxdx_device - - C:\windows\system32\lxdxcoms.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\windows\system32\PnkBstrB.exe
O23 - Service: SmartLinkService (SLService) - - C:\windows\SYSTEM32\slserv.exe

Réponse 120 / 167

sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 463
28 mai 2009 à 18:58

re,

tu as du faire un erreur quelque part

On va essayer autrement :

Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau.

http://oldtimer.geekstogo.com/OTMoveIt3.exe

! Déconnecte toi et ferme toutes tes applications en cours !

Double clique sur "OTMoveIt3.exe" pour ouvrir le prg .
Puis copie ce qui se trouve en citation ci-dessous,

:processes
explorer.exe

:Services

:Reg

:Files
C:\windows\system32\drivers\_004363_.tmp.dll

:Commands
[purity]
[emptytemp]
[Reboot]

et colle le dans le cadre de gauche de OTMoveIt3 :
Paste Instructions for items to be moved.
(ne touche à rien d'autre !)

-> clique sur MoveIt! pour lancer la suppression.
-> laisse travailler l'outil ...

-> une fois finis , un petite fenêtre s'ouvre : clique sur " Yes " .

Ton PC va redémarrer de lui même pour finir la suppression ...

Lors du redémarrage , si on te demande d'autoriser l'exécution d' OTMoveIt , accepte ( pour que l'outil finisse son boulot ... ).

-->Poste le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"
( " xxxx2008_xxxxxx.log " où les "x" correspondent au jour et à l'heure de l'utilisation ).

Rotkit Win32

167 réponses

Discussions similaires

Newsletters