pc tres lent à éxecuterRésolu/Fermé

Question

Bonjour,

Mon pc devient tres lent à éxécuter , j'ai fait un scan avc mon amivirus il a détecté 7 virus , je l'ai supprimes mais le problème perciste toujours , 

j'attends votre aide pour une  désinfection je vous remercie d'avance , 


-Avira AntiVir Personal
Report file date: jeudi 27 août 2009  09:26

Scanning for 1664654 virus strains and unwanted programs.

Licensee        : Avira AntiVir Personal - FREE Antivirus
Serial number   : 0000149996-ADJIE-0000001
Platform        : Windows XP
Windows version : (Service Pack 2)  [5.1.2600]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : RI-8FE4E3DEDF50

Version information:
BUILD.DAT       : 9.0.0.407     17961 Bytes  29/07/2009 10:34:00
AVSCAN.EXE      : 9.0.3.7      466689 Bytes  27/08/2009 08:23:15
AVSCAN.DLL      : 9.0.3.0       40705 Bytes  27/02/2009 10:58:24
LUKE.DLL        : 9.0.3.2      209665 Bytes  20/02/2009 11:35:49
LUKERES.DLL     : 9.0.2.0       12033 Bytes  27/02/2009 10:58:52
ANTIVIR0.VDF    : 7.1.0.0    15603712 Bytes  27/10/2008 12:30:36
ANTIVIR1.VDF    : 7.1.4.132   5707264 Bytes  24/06/2009 08:23:15
ANTIVIR2.VDF    : 7.1.5.146   3087360 Bytes  21/08/2009 08:23:15
ANTIVIR3.VDF    : 7.1.5.169    183296 Bytes  27/08/2009 08:23:15
Engineversion   : 8.2.1.7  
AEVDF.DLL       : 8.1.1.1      106868 Bytes  30/04/2009 11:52:04
AESCRIPT.DLL    : 8.1.2.26     463227 Bytes  27/08/2009 08:23:15
AESCN.DLL       : 8.1.2.4      127348 Bytes  27/08/2009 08:23:15
AERDL.DLL       : 8.1.2.4      430452 Bytes  27/08/2009 08:23:15
AEPACK.DLL      : 8.1.3.18     401783 Bytes  27/05/2009 16:07:20
AEOFFICE.DLL    : 8.1.0.38     196987 Bytes  27/08/2009 08:23:15
AEHEUR.DLL      : 8.1.0.155   1921400 Bytes  27/08/2009 08:23:15
AEHELP.DLL      : 8.1.6.0      233846 Bytes  27/08/2009 08:23:15
AEGEN.DLL       : 8.1.1.59     356725 Bytes  27/08/2009 08:23:15
AEEMU.DLL       : 8.1.0.9      393588 Bytes  09/10/2008 14:32:40
AECORE.DLL      : 8.1.7.6      184694 Bytes  27/08/2009 08:23:15
AEBB.DLL        : 8.1.0.3       53618 Bytes  09/10/2008 14:32:40
AVWINLL.DLL     : 9.0.0.3       18177 Bytes  12/12/2008 08:47:59
AVPREF.DLL      : 9.0.0.1       43777 Bytes  05/12/2008 10:32:15
AVREP.DLL       : 8.0.0.3      155905 Bytes  20/01/2009 14:34:28
AVREG.DLL       : 9.0.0.0       36609 Bytes  05/12/2008 10:32:09
AVARKT.DLL      : 9.0.0.3      292609 Bytes  24/03/2009 15:05:41
AVEVTLOG.DLL    : 9.0.0.7      167169 Bytes  30/01/2009 10:37:08
SQLITE3.DLL     : 3.6.1.0      326401 Bytes  28/01/2009 15:03:49
SMTPLIB.DLL     : 9.2.0.25      28417 Bytes  02/02/2009 08:21:33
NETNT.DLL       : 9.0.0.0       11521 Bytes  05/12/2008 10:32:10
RCIMAGE.DLL     : 9.0.0.25    2438913 Bytes  15/05/2009 15:39:58
RCTEXT.DLL      : 9.0.37.0      86785 Bytes  17/04/2009 10:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, E:, F:, 
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Optimised scan......................: on
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: jeudi 27 août 2009  09:26

Starting search for hidden objects.
'47614' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'E_SM1MT2.EXE' - '1' Module(s) have been scanned
Scan process 'SystranServer.exe' - '1' Module(s) have been scanned
Scan process 'EXCEL.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'eEBSvc.exe' - '1' Module(s) have been scanned
Scan process 'MMManager.exe' - '1' Module(s) have been scanned
Scan process 'RocketDock.exe' - '1' Module(s) have been scanned
Scan process 'EDICT.EXE' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'Athan.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'VTTrayp.exe' - '1' Module(s) have been scanned
Scan process 'VTTimer.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
32 processes with 32 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!
Boot sector 'D:\'
    [INFO]      No virus was found!
Boot sector 'E:\'
    [INFO]      No virus was found!
Boot sector 'F:\'
    [INFO]      No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '49' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
    [NOTE]      This file is a Windows system file.
    [NOTE]      This file cannot be opened for scanning.
C:\Documents and Settings\rza\Bureau\sandra\Driver_Checker_2.7.3.rar
  [0] Archive type: RAR
    --> Keygen\keygen.exe
      [DETECTION] Is the TR/Agent.85504.T Trojan
C:\Documents and Settings\rza\Bureau\sandra\Driver_Checker_2.7.3_Portable.rar
  [0] Archive type: RAR
    --> Keygen\keygen.exe
      [DETECTION] Is the TR/Agent.85504.T Trojan
C:\Documents and Settings\rza\Bureau\sandra\WDM_R216.exe
  [0] Archive type: CAB SFX (self extracting)
    [WARNING]   No further files can be extracted from this archive. The archive will be closed
    --> \data1.cab
      [WARNING]   No further files can be extracted from this archive. The archive will be closed
C:\Documents and Settings\rza\Bureau\sandra\drivers\sis\SIS2\WDM_R216.exe
  [0] Archive type: CAB SFX (self extracting)
    [WARNING]   No further files can be extracted from this archive. The archive will be closed
    --> \data1.cab
      [WARNING]   No further files can be extracted from this archive. The archive will be closed
C:\Program Files\Folder Lock\Locker\mam09\ali\Internet Download Manager(5.15 Build 3 All Language)\Keygen.exe
    [DETECTION] Is the TR/Agent.57344.CG Trojan
C:\Program Files\Telecatalog\pdf\ex\60144_FR.pdf
  [0] Archive type: PDF Stream
    [DETECTION] Contains recognition pattern of the HTML/Malicious.PDF.Gen HTML script virus
C:\System Volume Information\_restore{7B959479-25D9-4AA5-8298-8FABB7D15268}\RP52\A0016063.exe
  [0] Archive type: RAR SFX (self extracting)
    [DETECTION] Contains recognition pattern of the APPL/PrcView.E application
Begin scan in 'D:\'
D:\System Volume Information\_restore{7B959479-25D9-4AA5-8298-8FABB7D15268}\RP104\A0025524.exe
    [DETECTION] Contains code of the W32/Sality.Y Windows virus
Begin scan in 'E:\'
E:\System Volume Information\_restore{7B959479-25D9-4AA5-8298-8FABB7D15268}\RP104\A0025525.exe
    [DETECTION] Contains code of the W32/Sality.Y Windows virus
Begin scan in 'F:\'

Beginning disinfection:
C:\Documents and Settings\rza\Bureau\sandra\Driver_Checker_2.7.3.rar
    [NOTE]      The file was moved to '4aff5bfe.qua'!
C:\Documents and Settings\rza\Bureau\sandra\Driver_Checker_2.7.3_Portable.rar
    [NOTE]      The file was moved to '4968d21f.qua'!
C:\Program Files\Folder Lock\Locker\mam09\ali\Internet Download Manager(5.15 Build 3 All Language)\Keygen.exe
    [DETECTION] Is the TR/Agent.57344.CG Trojan
    [NOTE]      The file was moved to '4b0f5bf1.qua'!
C:\Program Files\Telecatalog\pdf\ex\60144_FR.pdf
    [DETECTION] Contains recognition pattern of the HTML/Malicious.PDF.Gen HTML script virus
    [NOTE]      The file was moved to '4ac75bbd.qua'!
C:\System Volume Information\_restore{7B959479-25D9-4AA5-8298-8FABB7D15268}\RP52\A0016063.exe
    [DETECTION] Contains recognition pattern of the APPL/PrcView.E application
    [NOTE]      The file was moved to '4ac65bbd.qua'!
D:\System Volume Information\_restore{7B959479-25D9-4AA5-8298-8FABB7D15268}\RP104\A0025524.exe
    [DETECTION] Contains code of the W32/Sality.Y Windows virus
    [NOTE]      The file was moved to '49609446.qua'!
E:\System Volume Information\_restore{7B959479-25D9-4AA5-8298-8FABB7D15268}\RP104\A0025525.exe
    [DETECTION] Contains code of the W32/Sality.Y Windows virus
    [NOTE]      The file was moved to '4ac65bc0.qua'!


End of the scan: jeudi 27 août 2009  11:10
Used time:  1:42:48 Hour(s)

The scan has been done completely.

   5009 Scanned directories
 326831 Files were scanned
      7 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      7 Files were moved to quarantine
      0 Files were renamed
      1 Files cannot be scanned
 326823 Files not concerned
   2001 Archives were scanned
      5 Warnings
      8 Notes
  47614 Objects were scanned with rootkit scan
      0 Hidden objects were found

@+++

Albator · Answer

bonjours,

Le rapport montre une trace de virut  dans la restauration du Sytème "à ne pas utiliser" 
>>>>> (Contains code of the W32/Sality.Y Windows virus ), . 

Cette infection est ce qu'il y a de plus virulent.

Sauvegarder immédiatement vos données personnelles sur >>>>> CD de préférence !
Ne redémarrer pas votre pc et n'ouvrez la connexion Internet que pour vérifier les message de ce sujet.  L'infection "pourrait" ce déployer davantage.

Suivez les procédure/logiciels de désinfections suivantes : http://www.commentcamarche.net/faq/sujet-16138-comment-supprimer-virut

késketudis · Answer

Bonjour,
Je te conseille de faire scanner ton ordi par l'antivirus en ligne www.secuser.com. Il va falloir peut-être désactiver ton antivirus.
A+

Albator · Answer

@ késketudis.. 
La page de procédure proposée, utilise les fix les plus efficacement adapté pour cette super infection.

figman · Answer

Salut ,

impossible de demarrer en mode sans echec pour un scan  Dr Web CureIt

figman · Answer

re,

le lien de AVPTOOL pour le telecharger  ne fonctionne pas et le pc infecte ne redemarre pas en mode sans echec , 

y a t'il d'autre solution  svp ???

Destrio5 · Answer

Bonjour,

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

figman · Answer

Salut , 


d'accord je vais le faire dimanche lors de la reprise du boulot par ce que c'est mon pc de bureau ,


Merci , 

ps : je n'aime  pas formater désolé , j'ai des dossiers et fichier précieux dedans ,

Bonne nuit tout l'monde ,

figman · Answer

Salut, 


impossible d'executer  RSIT.exe  je double clique dessus mais ça fonctionne pas , 

@+++

Destrio5 · Answer

--> Télécharge OTL (de OldTimer) sur ton Bureau.
--> Double-clique sur OTL pour le lancer.
(Sous Vista, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)
--> Une fenêtre apparaît. Dans la section Output en haut de cette fenêtre, coche Minimal Output.
--> Coche également les cases à côté de LOP Check et Purity Check.
--> Enfin, clique sur le bouton Run Scan. Le scan ne prendra pas beaucoup de temps.
--> Une fois l'analyse terminée, deux fenêtres vont s'ouvrir dans le Bloc-notes : OTL.txt et Extras.txt. Ils se trouvent au même endroit que OTL (donc par défaut sur le Bureau).

Pour me transmettre les rapports :
--> Clique sur ce lien : http://www.cijoint.fr/
--> Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
--> Clique sur Ouvrir.
--> Clique sur Cliquez ici pour déposer le fichier.
--> Un lien de cette forme, hxxp://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt, est ajouté dans la page.
--> Copie ce lien dans ta réponse.

figman · Answer

bonjour ,


voilà les deux rapports de OTL

http://www.cijoint.fr/cjlink.php?file=cj200908/cij7PqWiSP.txt
http://www.cijoint.fr/cjlink.php?file=cj200908/cijyusBCrw.txt

@+++

Destrio5 · Answer

--> Télécharge UsbFix (de Chiquitine29 & C_XX) sur ton Bureau.

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix sur ton Bureau.
(Sous Vista, il faut cliquer droit sur le raccourci UsbFix et choisir Exécuter en tant qu'administrateur)

--> Choisis l'option 1 (Recherche).

--> Laisse travailler l'outil.

--> Poste le rapport UsbFix.txt.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.

figman · Answer

re ,


le lien de usbfix ne fonctionne pas ,

@+++

Destrio5 · Answer

Lien provisoire :
http://destrio5.free.fr/Telechargement_CCM/UsbFix.exe

figman · Answer

voilà le rapport ,


############################## | UsbFix V6.019 |

User : rza (Administrateurs) # RI-8FE4E3DEDF50
Update on 19/08/09 by Chiquitine29 & C_XX
Start at: 14:42:24 | 31/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

              Intel(R) Pentium(R) D CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.30 [ Enabled | (!) Outdated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 29,29 Go (5,45 Go free) # NTFS
D:\ -> Disque fixe local # 29,29 Go (24,47 Go free) # NTFS
E:\ -> Disque fixe local # 29,29 Go (26,63 Go free) # NTFS
F:\ -> Disque fixe local # 23,9 Go (23,84 Go free) # NTFS
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 3,73 Go (3,67 Go free) [AHLAME] # FAT32
I:\ -> Disque amovible # 982,05 Mo (964,61 Mo free) [MAMOUD BR] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Documents and Settings\rza\Application Data\Map Maker\MMManager.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\Systran\4_0\Premium\SYSTRA~1.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

Présent ! C:\Recycler\S-1-5-21-602162358-362288127-725345543-1003\Dc11\Nircmd.com  

################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |

Présent ! HKLM\software\microsoft\security center "AntiVirusOverride" ( 0x1 )  
Présent ! HKLM\software\microsoft\security center "FirewallOverride" ( 0x1 )  
Présent ! HKLM\software\microsoft\security center "UacDisableNotify" ( 0x1 )  
Présent ! HKLM\software\microsoft\security center\Svc "AntiVirusDisableNotify" ( 0x1 )  
Présent ! HKLM\software\microsoft\security center\Svc "AntiVirusOverride" ( 0x1 )  
Présent ! HKLM\software\microsoft\security center\Svc "FirewallDisableNotify" ( 0x1 )  
Présent ! HKLM\software\microsoft\security center\Svc "FirewallOverride" ( 0x1 )  
Présent ! HKLM\software\microsoft\security center\Svc "UacDisableNotify" ( 0x1 )  
Présent ! HKLM\software\microsoft\security center\Svc "UpdatesDisableNotify" ( 0x1 )  

################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{8ba43f53-8bd8-11de-aaf6-00192129faf6}
shEll\AutOplay\cOmManD =dhubsr.pif 
shEll\AutoRun\command =dhubsr.pif 
shEll\exPlore\CoMMand =dhubsr.pif 
shEll\opEn\cOmmaNd =dhubsr.pif 

HKCU\..\..\Explorer\MountPoints2\{d6884e78-6ae9-11de-aacd-00192129faf6}
SHElL\AUtoplaY\cOmMAnd =H:\wgufe.pif 
SHElL\AutoRun\command =H:\wgufe.pif 
SHElL\eXPlore\cOMmaNd =H:\wgufe.pif 
SHElL\open\coMMand =H:\wgufe.pif 

################## | Cracks / Keygens / Serials |

"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\Setup.exe"  
11/08/2000 03:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\DOSYSTEM\restrmbr.exe"  
30/03/2001 13:39 |Size : 41038 |Crc32 : c1c40b4c |Md5 : 6e712a1b4ddb46918d9461a209e46db3  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\setup.exe"  
16/09/2002 02:28 |Size : 217088 |Crc32 : 0dbf293d |Md5 : ff6e6e5ff0ba6c8f6444217e33d46538  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\setup.exe"  
15/09/2002 22:01 |Size : 217088 |Crc32 : 175c1856 |Md5 : 4bcbd459621a41ffbcdaa89a6fe881f5  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\RESCUEME\Setup.exe"  
11/08/2000 03:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\setup.exe"  
16/09/2002 17:40 |Size : 217088 |Crc32 : 10871ada |Md5 : a2b0c046755a6c4b050c7b2a48d83914  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\Setup.exe"  
11/08/2000 05:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\DOSYSTEM\restrmbr.exe"  
30/03/2001 15:39 |Size : 41038 |Crc32 : c1c40b4c |Md5 : 6e712a1b4ddb46918d9461a209e46db3  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\setup.exe"  
16/09/2002 04:28 |Size : 217088 |Crc32 : 0dbf293d |Md5 : ff6e6e5ff0ba6c8f6444217e33d46538  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\setup.exe"  
16/09/2002 00:01 |Size : 217088 |Crc32 : 175c1856 |Md5 : 4bcbd459621a41ffbcdaa89a6fe881f5  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\RESCUEME\Setup.exe"  
11/08/2000 05:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settings\rza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\setup.exe"  
16/09/2002 19:40 |Size : 217088 |Crc32 : 10871ada |Md5 : a2b0c046755a6c4b050c7b2a48d83914  
 
"C:\Documents and Settings\rza\Bureau\sandra\SiSoftware Sandra Engineer 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 
"C:\Documents and Settings\rza\Bureau\sandra\SiSoftware Sandra Enterprise 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 
"C:\Documents and Settings\rza\Bureau\sandra\SiSoftware Sandra Pro Business 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 

################## | ! Fin du rapport # UsbFix V6.019 ! |

Destrio5 · Answer

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix présent sur ton Bureau.

--> Choisis l'option 2 (Suppression).

--> Ton Bureau disparaîtra et le PC redémarrera.

--> Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.

--> Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

figman · Answer

re ,


############################## | UsbFix V6.019 |

User : rza (Administrateurs) # RI-8FE4E3DEDF50
Update on 19/08/09 by Chiquitine29 & C_XX
Start at: 15:08:50 | 31/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

              Intel(R) Pentium(R) D CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.30 [ Enabled | (!) Outdated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 29,29 Go (5,42 Go free) # NTFS
D:\ -> Disque fixe local # 29,29 Go (24,47 Go free) # NTFS
E:\ -> Disque fixe local # 29,29 Go (26,63 Go free) # NTFS
F:\ -> Disque fixe local # 23,9 Go (23,84 Go free) # NTFS
G:\ -> Disque CD-ROM
I:\ -> Disque amovible # 982,05 Mo (964,6 Mo free) [MAMOUD BR] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Avira\AntiVir Desktop\avwsc.exe

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\Recycler\S-1-5-21-602162358-362288127-725345543-1003\Dc11\Nircmd.com 

################## | Autres |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |

# HKLM\software\microsoft\security center "AntiVirusOverride" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center "FirewallOverride" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center "UacDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "AntiVirusDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "AntiVirusOverride" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "FirewallDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "FirewallOverride" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "UacDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "UpdatesDisableNotify" # -> Reset sucessfully !  

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{8ba43f53-8bd8-11de-aaf6-00192129faf6}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{d6884e78-6ae9-11de-aacd-00192129faf6}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[22/05/2007 23:21|--a------|0] -> C:\AUTOEXEC.BAT 
[29/03/2009 14:00|---hs----|212] -> C:\boot.ini 
[07/09/2002 01:00|-rahs----|4952] -> C:\Bootfont.bin 
[22/05/2007 23:21|--a------|0] -> C:\CONFIG.SYS 
[23/04/2009 14:31|--a------|157] -> C:\home.htm 
[22/05/2007 23:21|-rahs----|0] -> C:\IO.SYS 
[22/05/2007 23:21|-rahs----|0] -> C:\MSDOS.SYS 
[04/08/2004 03:38|-rahs----|47564] -> C:\NTDETECT.COM 
[04/08/2004 03:59|-rahs----|251712] -> C:
tldr 
[?|?|?] -> C:\pagefile.sys 
[31/08/2009 15:14|--a------|3646] -> C:\UsbFix.txt 
[14/05/2008 11:24|--a------|441856] -> D:\Nomenclature des installations ALTUMET.xls 
[03/03/2008 11:35|--a------|326817792] -> D:\Prison.Break.S3E01.avi 
[04/03/2008 11:45|--a------|326561792] -> D:\Prison.Break.S3E02.avi 
[14/12/2007 02:10|--a------|360916650] -> D:\Prison.Break.S3E03.avi 
[20/12/2007 17:14|--a------|367511336] -> D:\Prison.Break.S3E04.avi 
[10/01/2008 21:39|--a------|365582436] -> D:\Prison.Break.S3E05.avi 
[17/01/2008 04:54|--a------|364630792] -> D:\Prison.Break.S3E06.avi 
[24/01/2008 03:47|--a------|364536006] -> D:\Prison.Break.S3E07.avi 
[31/01/2008 06:51|--a------|367391072] -> D:\Prison.Break.S3E08.avi 
[10/04/2008 20:25|--a------|366467072] -> D:\Prison.Break.S3E09.avi 
[11/04/2008 16:46|--a------|375739386] -> D:\Prison.Break.S3E10.avi 
[20/04/2008 00:44|--a------|348993536] -> D:\Prison.Break.S3E11.avi 
[18/04/2008 22:51|--a------|377353200] -> D:\Prison.Break.S3E12.avi 
[18/04/2008 22:08|--a------|377575902] -> D:\Prison.Break.S3E13.avi 
[15/04/2008 12:58|--a------|275] -> D:\Raccourci vers Disque local (C).lnk 
[03/09/2008 14:06|--a------|355328] -> E:\arret annuel 2008.xls 
[16/01/2008 12:48|--a------|1110] -> E:\globdata.ini 
[16/01/2008 12:48|--a------|843] -> E:\install.ini 
[16/01/2008 12:52|--a------|97296] -> E:\install.res.1036.dll 
[24/12/2008 18:29|--a------|2539400] -> E:\mbam-setup.exe 
[16/02/2009 11:40|--a------|883032] -> E:av.zip 
[20/04/2008 12:08|--a------|277396] -> E:\Uninst.isu 
[16/01/2008 12:48|--a------|5686] -> E:\vcredist.bmp 
[16/01/2008 12:58|--a------|1442522] -> E:\VC_RED.cab 
[16/01/2008 13:00|--a------|233984] -> E:\VC_RED.MSI 
[30/08/2009 18:57|--a------|15882224] -> I:\drweb-cureit.exe 
[31/08/2009 14:22|--a------|1215494] -> I:\cij0xQSUgM.zip 
[30/08/2009 21:31|--a------|55087] -> I:\sujet-16138-comment-supprimer-virut.htm 
[30/08/2009 22:08|--a------|514048] -> I:\OTL.exe 
[30/08/2009 22:12|--a------|108636] -> I:\affich-14100283-pc-tres-lent-a-executer.htm 
[31/08/2009 10:50|--a------|67908] -> I:\OTL.Txt 
[31/08/2009 10:51|--a------|23808] -> I:\Extras.Txt 
[31/08/2009 14:45|--a------|10140] -> I:\UsbFix.txt 

################## | Cracks / Keygens / Serials |

"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\Setup.exe"  
11/08/2000 03:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\DOSYSTEMestrmbr.exe"  
30/03/2001 13:39 |Size : 41038 |Crc32 : c1c40b4c |Md5 : 6e712a1b4ddb46918d9461a209e46db3  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\setup.exe"  
16/09/2002 02:28 |Size : 217088 |Crc32 : 0dbf293d |Md5 : ff6e6e5ff0ba6c8f6444217e33d46538  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\setup.exe"  
15/09/2002 22:01 |Size : 217088 |Crc32 : 175c1856 |Md5 : 4bcbd459621a41ffbcdaa89a6fe881f5  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\RESCUEME\Setup.exe"  
11/08/2000 03:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\setup.exe"  
16/09/2002 17:40 |Size : 217088 |Crc32 : 10871ada |Md5 : a2b0c046755a6c4b050c7b2a48d83914  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\Setup.exe"  
11/08/2000 05:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\DOSYSTEMestrmbr.exe"  
30/03/2001 15:39 |Size : 41038 |Crc32 : c1c40b4c |Md5 : 6e712a1b4ddb46918d9461a209e46db3  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\setup.exe"  
16/09/2002 04:28 |Size : 217088 |Crc32 : 0dbf293d |Md5 : ff6e6e5ff0ba6c8f6444217e33d46538  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\setup.exe"  
16/09/2002 00:01 |Size : 217088 |Crc32 : 175c1856 |Md5 : 4bcbd459621a41ffbcdaa89a6fe881f5  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\RESCUEME\Setup.exe"  
11/08/2000 05:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\setup.exe"  
16/09/2002 19:40 |Size : 217088 |Crc32 : 10871ada |Md5 : a2b0c046755a6c4b050c7b2a48d83914  
 
"C:\Documents and Settingsza\Bureau\sandra\SiSoftware Sandra Engineer 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 
"C:\Documents and Settingsza\Bureau\sandra\SiSoftware Sandra Enterprise 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 
"C:\Documents and Settingsza\Bureau\sandra\SiSoftware Sandra Pro Business 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 

################## | Upload | 

Veuillez envoyer le fichier : C:\DOCUME~1za\Bureau\UsbFix_Upload_Me_RI-8FE4E3DEDF50.zip : https://www.androidworld.fr/ 
Merci pour votre contribution .

figman · Answer

re ,


############################## | UsbFix V6.019 |

User : rza (Administrateurs) # RI-8FE4E3DEDF50
Update on 19/08/09 by Chiquitine29 & C_XX
Start at: 15:08:50 | 31/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

              Intel(R) Pentium(R) D CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.30 [ Enabled | (!) Outdated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 29,29 Go (5,42 Go free) # NTFS
D:\ -> Disque fixe local # 29,29 Go (24,47 Go free) # NTFS
E:\ -> Disque fixe local # 29,29 Go (26,63 Go free) # NTFS
F:\ -> Disque fixe local # 23,9 Go (23,84 Go free) # NTFS
G:\ -> Disque CD-ROM
I:\ -> Disque amovible # 982,05 Mo (964,6 Mo free) [MAMOUD BR] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Avira\AntiVir Desktop\avwsc.exe

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\Recycler\S-1-5-21-602162358-362288127-725345543-1003\Dc11\Nircmd.com 

################## | Autres |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |

# HKLM\software\microsoft\security center "AntiVirusOverride" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center "FirewallOverride" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center "UacDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "AntiVirusDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "AntiVirusOverride" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "FirewallDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "FirewallOverride" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "UacDisableNotify" # -> Reset sucessfully !  
# HKLM\software\microsoft\security center\Svc "UpdatesDisableNotify" # -> Reset sucessfully !  

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{8ba43f53-8bd8-11de-aaf6-00192129faf6}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{d6884e78-6ae9-11de-aacd-00192129faf6}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[22/05/2007 23:21|--a------|0] -> C:\AUTOEXEC.BAT 
[29/03/2009 14:00|---hs----|212] -> C:\boot.ini 
[07/09/2002 01:00|-rahs----|4952] -> C:\Bootfont.bin 
[22/05/2007 23:21|--a------|0] -> C:\CONFIG.SYS 
[23/04/2009 14:31|--a------|157] -> C:\home.htm 
[22/05/2007 23:21|-rahs----|0] -> C:\IO.SYS 
[22/05/2007 23:21|-rahs----|0] -> C:\MSDOS.SYS 
[04/08/2004 03:38|-rahs----|47564] -> C:\NTDETECT.COM 
[04/08/2004 03:59|-rahs----|251712] -> C:
tldr 
[?|?|?] -> C:\pagefile.sys 
[31/08/2009 15:14|--a------|3646] -> C:\UsbFix.txt 
[14/05/2008 11:24|--a------|441856] -> D:\Nomenclature des installations ALTUMET.xls 
[03/03/2008 11:35|--a------|326817792] -> D:\Prison.Break.S3E01.avi 
[04/03/2008 11:45|--a------|326561792] -> D:\Prison.Break.S3E02.avi 
[14/12/2007 02:10|--a------|360916650] -> D:\Prison.Break.S3E03.avi 
[20/12/2007 17:14|--a------|367511336] -> D:\Prison.Break.S3E04.avi 
[10/01/2008 21:39|--a------|365582436] -> D:\Prison.Break.S3E05.avi 
[17/01/2008 04:54|--a------|364630792] -> D:\Prison.Break.S3E06.avi 
[24/01/2008 03:47|--a------|364536006] -> D:\Prison.Break.S3E07.avi 
[31/01/2008 06:51|--a------|367391072] -> D:\Prison.Break.S3E08.avi 
[10/04/2008 20:25|--a------|366467072] -> D:\Prison.Break.S3E09.avi 
[11/04/2008 16:46|--a------|375739386] -> D:\Prison.Break.S3E10.avi 
[20/04/2008 00:44|--a------|348993536] -> D:\Prison.Break.S3E11.avi 
[18/04/2008 22:51|--a------|377353200] -> D:\Prison.Break.S3E12.avi 
[18/04/2008 22:08|--a------|377575902] -> D:\Prison.Break.S3E13.avi 
[15/04/2008 12:58|--a------|275] -> D:\Raccourci vers Disque local (C).lnk 
[03/09/2008 14:06|--a------|355328] -> E:\arret annuel 2008.xls 
[16/01/2008 12:48|--a------|1110] -> E:\globdata.ini 
[16/01/2008 12:48|--a------|843] -> E:\install.ini 
[16/01/2008 12:52|--a------|97296] -> E:\install.res.1036.dll 
[24/12/2008 18:29|--a------|2539400] -> E:\mbam-setup.exe 
[16/02/2009 11:40|--a------|883032] -> E:av.zip 
[20/04/2008 12:08|--a------|277396] -> E:\Uninst.isu 
[16/01/2008 12:48|--a------|5686] -> E:\vcredist.bmp 
[16/01/2008 12:58|--a------|1442522] -> E:\VC_RED.cab 
[16/01/2008 13:00|--a------|233984] -> E:\VC_RED.MSI 
[30/08/2009 18:57|--a------|15882224] -> I:\drweb-cureit.exe 
[31/08/2009 14:22|--a------|1215494] -> I:\cij0xQSUgM.zip 
[30/08/2009 21:31|--a------|55087] -> I:\sujet-16138-comment-supprimer-virut.htm 
[30/08/2009 22:08|--a------|514048] -> I:\OTL.exe 
[30/08/2009 22:12|--a------|108636] -> I:\affich-14100283-pc-tres-lent-a-executer.htm 
[31/08/2009 10:50|--a------|67908] -> I:\OTL.Txt 
[31/08/2009 10:51|--a------|23808] -> I:\Extras.Txt 
[31/08/2009 14:45|--a------|10140] -> I:\UsbFix.txt 

################## | Cracks / Keygens / Serials |

"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\Setup.exe"  
11/08/2000 03:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\DOSYSTEMestrmbr.exe"  
30/03/2001 13:39 |Size : 41038 |Crc32 : c1c40b4c |Md5 : 6e712a1b4ddb46918d9461a209e46db3  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\setup.exe"  
16/09/2002 02:28 |Size : 217088 |Crc32 : 0dbf293d |Md5 : ff6e6e5ff0ba6c8f6444217e33d46538  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\setup.exe"  
15/09/2002 22:01 |Size : 217088 |Crc32 : 175c1856 |Md5 : 4bcbd459621a41ffbcdaa89a6fe881f5  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\RESCUEME\Setup.exe"  
11/08/2000 03:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsia.exe"  
11/03/2002 08:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsiw.exe"  
11/03/2002 09:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\desinfection\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\setup.exe"  
16/09/2002 17:40 |Size : 217088 |Crc32 : 10871ada |Md5 : a2b0c046755a6c4b050c7b2a48d83914  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\Setup.exe"  
11/08/2000 05:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Rescueme\DOSYSTEMestrmbr.exe"  
30/03/2001 15:39 |Size : 41038 |Crc32 : c1c40b4c |Md5 : 6e712a1b4ddb46918d9461a209e46db3  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\BTMagic\Setup\setup.exe"  
16/09/2002 04:28 |Size : 217088 |Crc32 : 0dbf293d |Md5 : ff6e6e5ff0ba6c8f6444217e33d46538  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\DKeeper\setup.exe"  
16/09/2002 00:01 |Size : 217088 |Crc32 : 175c1856 |Md5 : 4bcbd459621a41ffbcdaa89a6fe881f5  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\RESCUEME\Setup.exe"  
11/08/2000 05:22 |Size : 54272 |Crc32 : 15a22d1a |Md5 : d765793f5d803673d1b4b5586e8fd66c  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsia.exe"  
11/03/2002 10:45 |Size : 1708856 |Crc32 : 3ccaccf9 |Md5 : 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\instmsiw.exe"  
11/03/2002 11:06 |Size : 1822520 |Crc32 : be716ace |Md5 : 61a5fb191ae2ae876db31dcce75e4183  
 
"C:\Documents and Settingsza\Bureau\1\MAMOUD br (J)\Partition Magic 8.0 + serial\Partition Magic 8.0 + serial\Setup\setup.exe"  
16/09/2002 19:40 |Size : 217088 |Crc32 : 10871ada |Md5 : a2b0c046755a6c4b050c7b2a48d83914  
 
"C:\Documents and Settingsza\Bureau\sandra\SiSoftware Sandra Engineer 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 
"C:\Documents and Settingsza\Bureau\sandra\SiSoftware Sandra Enterprise 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 
"C:\Documents and Settingsza\Bureau\sandra\SiSoftware Sandra Pro Business 2009.5.15.97 Multilanguage\keygen.exe"  
28/04/2009 09:45 |Size : 188928 |Crc32 : e1efc413 |Md5 : 72aca1ea6d8261fdf8392d5374044b9e  
 

################## | Upload | 

Veuillez envoyer le fichier : C:\DOCUME~1za\Bureau\UsbFix_Upload_Me_RI-8FE4E3DEDF50.zip : https://www.androidworld.fr/ 
Merci pour votre contribution .

Destrio5 · Answer

--> Désinstalle UsbFix.

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

figman · Answer

bonjour , 


ComboFix 09-08-31.03 - rza 01/09/2009  8:52.12.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.959.692 [GMT 1:00]
Running from: I:\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\154c770.msi
c:\windows\system32\sfcfiles.dll

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DAC970NT
-------\Service_dac970nt


(((((((((((((((((((((((((   Files Created from 2009-08-01 to 2009-09-01  )))))))))))))))))))))))))))))))
.

2009-08-27 09:07 . 2009-08-27 09:20	3942047	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-27 09:03 . 2009-08-03 12:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-27 09:03 . 2009-08-03 12:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-26 13:45 . 2009-08-26 13:47	1962544	----a-w-	c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-08-26 13:45 . 2009-08-26 14:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\NOS
2009-08-23 13:51 . 2009-08-27 12:05	--------	d-----w-	c:\documents and settingsza\DoctorWeb
2009-08-18 09:21 . 2009-08-18 09:21	--------	d-----w-	c:\program files\WinDriver Ghost
2009-08-17 14:34 . 2009-08-17 14:34	--------	d--h--w-	c:\windows\PIF
2009-08-16 08:45 . 2009-08-16 08:45	--------	d-----w-	c:\windows\system32\LogFiles
2009-08-12 09:48 . 2009-08-12 09:48	--------	d-----w-	c:\windows\Sun
2009-08-11 07:12 . 2009-08-11 07:12	--------	d-----w-	c:\program files\Lavalys
2009-08-09 13:41 . 2004-08-04 04:54	25600	----a-w-	c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-08-06 12:05 . 2009-08-06 12:05	--------	d-----w-	c:\documents and settingsza\Local Settings\Application Data\Microsoft Help
2009-08-06 12:05 . 2009-08-06 12:06	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-04 13:50 . 2009-08-04 13:50	766	----a-r-	c:\documents and settingsza\Application Data\Microsoft\Installer\{9B1473BA-7B0E-4373-A8E2-AED09D9019C4}\_18be6784.exe
2009-08-04 13:50 . 2009-08-04 13:50	1078	----a-r-	c:\documents and settingsza\Application Data\Microsoft\Installer\{9B1473BA-7B0E-4373-A8E2-AED09D9019C4}\_294823.exe
2009-08-04 12:58 . 2009-08-04 13:50	--------	d-----w-	c:\program files\JPEG PC Camera
2009-08-03 10:29 . 2001-08-23 16:04	12288	-c--a-w-	c:\windows\system32\dllcache\mouhid.sys
2009-08-03 10:29 . 2001-08-23 16:04	12288	----a-w-	c:\windows\system32\drivers\mouhid.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-27 08:52 . 2009-06-04 07:40	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-27 08:23 . 2009-05-03 07:48	55656	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-08-24 12:39 . 2008-08-18 09:35	--------	d-----w-	c:\program files\Winamp
2009-08-20 07:01 . 2002-09-07 00:00	67720	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-20 07:01 . 2002-09-07 00:00	452334	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-11 07:07 . 2009-06-04 08:28	--------	d-----w-	c:\program files\VS Revo Group
2009-08-09 06:52 . 2007-05-23 13:43	63584	----a-w-	c:\documents and settingsza\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-23 07:22 . 2009-07-23 07:22	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-07-23 07:22 . 2009-05-03 07:48	--------	d-----w-	c:\program files\Avira
2009-06-18 08:38 . 2008-02-06 07:17	63584	----a-w-	c:\documents and settings\mamoud\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-10 07:10 . 2009-06-08 06:58	117760	----a-w-	c:\documents and settingsza\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"E07FDXRC_1355250"="c:\program files\Microsoft Encarta\Microsoft Encarta 2007 - Collection\EDICT.EXE" [2006-06-13 351000]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2001-04-30 10752]
"Athan"="c:\program files\Athan\Athan.exe" [2005-03-05 700416]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2005-03-07 53248]
"VTTrayp"="VTtrayp.exe" - c:\windows\system32\VTTrayp.exe [2006-07-10 176128]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32	scupgrd.exe" [2004-08-04 44544]

c:\documents and settingsza\Menu D&#8218;marrer\Programmes\D&#8218;marrage\
SunClock5.lnk - c:\documents and settingsza\Application Data\Map Maker\MMManager.exe [2008-1-20 95744]

c:\documents and settings\All Users\Menu D&#8218;marrer\Programmes\D&#8218;marrage\
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_S01C00.EXE [2009-6-14 57344]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\WINDOWS\system32\usmt\migwiz.exe"=
"c:\Documents and Settings\mamoud\Local Settings\Application Data\Skype\Phone\Skype.exe"=
"c:\Program Files\Java\jre6\launch4j-tmp\frd.exe"=
"c:\program files\avira\antivir desktop\avcenter.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3970:TCP"= 3970:TCP:locar

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"= %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"= %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
"c:\WINDOWS\system32\usmt\migwiz.exe"= c:\windows\system32\usmt\migwiz.exe:*:Enabled:Assistant Transfert de fichiers et de paramètres
"c:\Documents and Settings\mamoud\Local Settings\Application Data\Skype\Phone\Skype.exe"= c:\documents and settings\mamoud\Local Settings\Application Data\Skype\Phone\Skype.exe:*:Disabled:Skype
"c:\Program Files\Java\jre6\launch4j-tmp\frd.exe"= c:\program files\Java\jre6\launch4j-tmp\frd.exe:*:Enabled:Java(TM) Platform SE binary
"c:\program files\avira\antivir desktop\avcenter.exe"= c:\program files\avira\antivir desktop\avcenter.exe:*:Enabled:ipsec

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\GloballyOpenPorts\List]
"3970:TCP"= 3970:TCP:*:Enabled:locar

R0 AFPAnsi;Alfa File Protector Ansi;c:\windows\system32\drivers\AFPAnsi.sys [03/05/2009 08:39 43936]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [23/05/2007 14:44 17920]
R1 SuperMounter;SuperMounter;c:\windows\system32\drivers\supermounter.sys [03/05/2009 08:39 11264]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [23/07/2009 08:22 108289]
S1 SASDIFSV;SASDIFSV;\??\c:\documents and settingsza\Bureau\SUPERAntiSpyware\SASDIFSV.SYS --> c:\documents and settingsza\Bureau\SUPERAntiSpyware\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\c:\documents and settingsza\Bureau\SUPERAntiSpyware\SASKUTIL.sys --> c:\documents and settingsza\Bureau\SUPERAntiSpyware\SASKUTIL.sys [?]
S2 angzxq;suduc;c:\windows\system32\svchost.exe -k netsvcs [04/08/2004 05:55 14336]
S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;c:\windows\system32\drivers\cam1690.sys [05/01/2007 13:45 123264]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Corporate Edition\kerneld.wnt [11/08/2009 08:12 26736]
S3 SASENUM;SASENUM;\??\c:\documents and settingsza\Bureau\SUPERAntiSpyware\SASENUM.SYS --> c:\documents and settingsza\Bureau\SUPERAntiSpyware\SASENUM.SYS [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService
Alerter
LmHosts

.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MSMSGS - c:\program files\Messenger\msmsgs.exe
HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe


.
------- Supplementary Scan -------
.
mWindow Title = 
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-01 09:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{3DA165B6-CC41-11d2-BDC6-00C04F79EC6B}\ProgID]
@Denied: (A) (Everyone)
@="{871CACD5-1EA0-477C-A9E2-3060E2FE5B77}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{3DA165B6-CC41-11d2-BDC6-00C04F79EC6B}\Version]
@Denied: (A) (Everyone)
@="{871CACD5-1EA0-477C-A9E2-3060E2FE5B77}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{8D8763AB-E93B-4812-964E-F04E0008FD50}\Version]
@Denied: (A) (Everyone)
@="{8D8763AB-E93B-4812-964E-F04E0008FD50}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\WINDOWS\system32\Macromed\Flash\Flash10c.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\WINDOWS\system32\Macromed\Flash\Flash10c.ocx, 1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\WINDOWS\system32\Macromed\Flash\Flash10c.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\WINDOWS\system32\Macromed\Flash\Flash10c.ocx, 1"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""

[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3708)
c:\program files\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Fichiers communs\EPSON\EBAPI\eEBSvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-09-01  9:15 - machine was rebooted
ComboFix-quarantined-files.txt  2009-09-01 08:15

Pre-Run: 5 902 602 240 octets libres
Post-Run: 5 802 405 888 octets libres

227

figman · Answer

Salut ,

après six jours d'attentes , aucune suite ????

Destrio5 · Answer

Le PC est toujours lent ?

figman · Answer

je l'ai formater , par ce que il était bloqué complétement il démarrait  même pas , mais quand j'ai fait un scan avec nod 32 il a détecté toujours des virus, 
en ce qui concerne la lenteur , il est mieux qu'avant

Destrio5 · Answer

Tu l'as formaté quand ?

figman · Answer

je l'ai formater hier

Destrio5 · Answer

--> Fais un scan avec Kaspersky Online Scanner et poste le rapport.

Utilisateur anonyme · Answer

_______*#####* 
____*##########* 
__*############## 
__################ 
_##################_________**####* 
__##################_____*########## 
__##################___*############# 
___#################*_###############* 
____#################################* 
______############################### 
_______#############################* __________ 
________*##########################__________ 
__________######################## 
___________*####################* 
____________*################## 
_____________*############### 
_______________############# 
________________########## 
________________*#######* 
_________________###### 
__________________#### 
__________________### 
___________________#

Destrio5 · Answer

C'est joli ;)

figman · Answer

Bonjour ,


le pc n'est pas connecte au net ,


@+++

Destrio5 · Answer

Pourquoi ça ?

figman · Answer

par ce que y a pas d'internet c'est le pc de mon bureau

Destrio5 · Answer

Réessaie cette manip' :
https://forums.commentcamarche.net/forum/affich-14100283-pc-tres-lent-a-executer#8

figman · Answer

salut ,



info.txt logfile of random's system information tool 1.06 2009-09-09 08:35:08

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.65-->"E:\7-Zip\Uninstall.exe"
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
DirectX Drivers-->C:\Program Files\directx\setup\dxsetup.exe
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
Guide de référence LQ590 LQ2090-->C:\Program Files\EPSON\TPMANUAL\LQ590 LQ2090\REF_G\DOCUNINS.EXE
Malwarebytes' Anti-Malware-->"E:\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
VIA Platform Device Manager-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} 

======Security center information======

AV: ESET NOD32 Antivirus 4.0

======System event log======

Computer Name: MAMOUD-9E8F6FC1
Event Code: 3260
Message: Cet ordinateur a correctement été joint au workgroup 'MAMOUD'.

Record Number: 5
Source Name: Workstation
Time Written: 20090901142022.000000+120
Event Type: Informations
User: 

Computer Name: MAMOUD-9E8F6FC1
Event Code: 6011
Message: Le nom NetBIOS et le nom de l'hôte DNS de cet ordinateur ont été modifiés de MACHINENAME vers MAMOUD-9E8F6FC1.

Record Number: 4
Source Name: EventLog
Time Written: 20090901141628.000000+120
Event Type: Informations
User: 

Computer Name: MACHINENAME
Event Code: 2
Message: Pendant la validation de \Device\Serial0 en tant que port série, une FIFO a été détectée. La FIFO sera utilisée.

Record Number: 3
Source Name: Serial
Time Written: 20090901151023.000000+120
Event Type: Informations
User: 

Computer Name: MACHINENAME
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20090901151002.000000+120
Event Type: Informations
User: 

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090901151002.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: MAMOUD-9E8F6FC1
Event Code: 1000
Message: Les compteurs de performances pour le service MSDTC (MSDTC) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090901142446.000000+120
Event Type: Informations
User: 

Computer Name: MAMOUD-9E8F6FC1
Event Code: 1000
Message: Les compteurs de performances pour le service TermService (Services Terminal Server) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090901142444.000000+120
Event Type: Informations
User: 

Computer Name: MAMOUD-9E8F6FC1
Event Code: 1000
Message: Les compteurs de performances pour le service RemoteAccess (Routage et accès distant) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090901141704.000000+120
Event Type: Informations
User: 

Computer Name: MAMOUD-9E8F6FC1
Event Code: 1000
Message: Les compteurs de performances pour le service PSched (PSched) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090901141638.000000+120
Event Type: Informations
User: 

Computer Name: MAMOUD-9E8F6FC1
Event Code: 1000
Message: Les compteurs de performances pour le service RSVP (QoS RSVP) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090901141637.000000+120
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=0605
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------


Logfile of random's system information tool 1.06 (written by random/random)
Run by mamoud at 2009-09-09 08:35:05
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 26 GB (87%) free of 30 GB
Total RAM: 959 MB (75% free)

HijackThis download failed

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"EPSON Product Rappel concernant l'enregistrement"=C:\WINDOWS\Temp\RegModule.exe [2003-09-17 221184]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-02-06 2021400]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d318f72d-9852-11de-a090-00192129faf6}]
shell\AUtoplaY\command - H:\wgufe.pif
shell\AutoRun\command - H:\wgufe.pif
shell\eXPlore\command - H:\wgufe.pif
shell\open\command - H:\wgufe.pif


======List of files/folders created in the last 1 months======

2009-09-09 08:35:07 ----D---- C:\Program Files	rend micro
2009-09-09 08:35:05 ----D---- C:sit
2009-09-08 11:33:04 ----D---- C:\Program Files\directx
2009-09-08 11:33:04 ----A---- C:\WINDOWS\system32\gchand.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drm8f.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drm32f.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drm24f.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drm16f.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drgbxf.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drgbf.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg8x.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg8f.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg56x.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg55x.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg32x.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg32f.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg24x.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg24f.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drg16f.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3drampf.dll
2009-09-08 11:33:03 ----A---- C:\WINDOWS\system32\d3dhalf.dll
2009-09-08 11:33:02 ----A---- C:\WINDOWS\system32\ddraw16.dll
2009-09-08 11:33:02 ----A---- C:\WINDOWS\system32\ddhelp.exe
2009-09-08 11:29:46 ----D---- C:\Documents and Settings\mamoud\Application Data\Adobe
2009-09-08 08:41:00 ----D---- C:\Program Files\ESET
2009-09-08 08:41:00 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2009-09-03 09:01:22 ----D---- C:\Program Files\Fichiers communs\EPSON
2009-09-03 09:01:22 ----A---- C:\WINDOWS\system32\EEBUtil.dll
2009-09-03 09:01:22 ----A---- C:\WINDOWS\system32\EEBSDKIF.dll
2009-09-03 09:01:22 ----A---- C:\WINDOWS\system32\EEBDSCVR.dll
2009-09-03 09:01:22 ----A---- C:\WINDOWS\system32\EEBAPI.dll
2009-09-03 09:01:22 ----A---- C:\WINDOWS\system32\EBAPI.dll
2009-09-03 08:58:57 ----D---- C:\Program Files\EPSON
2009-09-03 08:58:57 ----A---- C:\WINDOWS\system32\ECBTEG.DLL
2009-09-03 08:58:57 ----A---- C:\WINDOWS\system32\EBPMON2.DLL
2009-09-03 08:58:56 ----A---- C:\WINDOWS\EPSTPLOG.TXT
2009-09-03 08:58:56 ----A---- C:\WINDOWS\EPSTPLOG.BAK
2009-09-03 08:58:46 ----A---- C:\WINDOWS\CDELQ5902090E.ini
2009-09-03 08:58:26 ----A---- C:\WINDOWS\epsswt_log.txt
2009-09-03 08:55:45 ----D---- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
2009-09-02 09:05:59 ----D---- C:\Program Files\InstallShield Installation Information
2009-09-02 09:05:06 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-09-02 09:04:50 ----D---- C:\Program Files\VIA
2009-09-02 09:04:49 ----N---- C:\WINDOWS\system32\difxapi.dll
2009-09-02 09:04:11 ----D---- C:\WINDOWS\system32\Tools
2009-09-02 09:04:05 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-09-02 08:30:56 ----D---- C:\Program Files\CCleaner
2009-09-02 08:29:40 ----D---- C:\Documents and Settings\mamoud\Application Data\Malwarebytes
2009-09-02 08:29:28 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-09-02 08:28:16 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-09-02 08:28:10 ----D---- C:\Program Files\Fichiers communs\Adobe
2009-09-01 16:16:24 ----A---- C:\WINDOWS\system32\h323log.txt
2009-09-01 15:13:39 ----A---- C:\WINDOWS\system32\usbui.dll
2009-09-01 15:12:32 ----SHD---- C:\WINDOWS\Installer
2009-09-01 15:12:32 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-09-01 15:12:31 ----D---- C:\Program Files\Fichiers communs\ODBC
2009-09-01 15:12:31 ----A---- C:\WINDOWS\ODBCINST.INI
2009-09-01 15:12:29 ----D---- C:\Program Files\Fichiers communs\SpeechEngines
2009-09-01 15:12:28 ----RD---- C:\Program Files
2009-09-01 15:12:28 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-09-01 15:12:28 ----D---- C:\Program Files\Fichiers communs
2009-09-01 15:12:25 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-09-01 15:12:25 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-09-01 15:12:25 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-09-01 15:12:24 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-09-01 15:12:23 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-09-01 15:12:23 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-09-01 15:12:23 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-09-01 15:12:23 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-09-01 15:12:23 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-09-01 15:12:22 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-09-01 15:12:22 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-09-01 15:12:21 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-09-01 15:12:21 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-09-01 15:12:21 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-09-01 15:12:21 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-09-01 15:12:21 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-09-01 15:12:20 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-09-01 15:12:18 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-09-01 15:12:18 ----A---- C:\WINDOWS\system32\irclass.dll
2009-09-01 15:12:18 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-09-01 15:12:18 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-09-01 15:12:17 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-09-01 15:12:16 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-09-01 15:12:15 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-09-01 15:12:15 ----A---- C:\WINDOWS\system32\batt.dll
2009-09-01 15:12:15 ----A---- C:\WINDOWS\NOTEPAD.EXE
2009-09-01 15:12:14 ----A---- C:\WINDOWS\system32\storprop.dll
2009-09-01 15:12:07 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-09-01 15:10:25 ----RA---- C:\WINDOWS\SET8.tmp
2009-09-01 15:10:23 ----RA---- C:\WINDOWS\SET4.tmp
2009-09-01 15:10:22 ----RA---- C:\WINDOWS\SET3.tmp
2009-09-01 15:10:18 ----D---- C:\WINDOWS\system32\CatRoot2
2009-09-01 15:10:18 ----D---- C:\WINDOWS\system32\CatRoot
2009-09-01 15:10:12 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-09-01 15:09:59 ----A---- C:\WINDOWS\setuplog.txt
2009-09-01 15:09:56 ----SHD---- C:\System Volume Information
2009-09-01 15:09:56 ----D---- C:\Documents and Settings
2009-09-01 15:09:10 ----SH---- C:\boot.ini
2009-09-01 15:05:53 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-09-01 15:05:53 ----RSD---- C:\WINDOWS\Fonts
2009-09-01 15:05:53 ----RD---- C:\WINDOWS\Web
2009-09-01 15:05:53 ----HD---- C:\WINDOWS\inf
2009-09-01 15:05:53 ----D---- C:\WINDOWS\WinSxS
2009-09-01 15:05:53 ----D---- C:\WINDOWS	wain_32
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Temp
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\wins
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\wbem
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\usmt
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\spool
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\ShellExt
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\Setup
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32as
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\oobe
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32
pp
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\mui
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\inetsrv
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\IME
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\icsxml
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\ias
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\export
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\drivers
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\dhcp
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\config
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\3com_dmi
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\3076
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\2052
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1054
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1042
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1041
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1037
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1036
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1033
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1031
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1028
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32\1025
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system32
2009-09-01 15:05:53 ----D---- C:\WINDOWS\system
2009-09-01 15:05:53 ----D---- C:\WINDOWS\security
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Resources
2009-09-01 15:05:53 ----D---- C:\WINDOWSepair
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Provisioning
2009-09-01 15:05:53 ----D---- C:\WINDOWS\PeerNet
2009-09-01 15:05:53 ----D---- C:\WINDOWS\pchealth
2009-09-01 15:05:53 ----D---- C:\WINDOWS\mui
2009-09-01 15:05:53 ----D---- C:\WINDOWS\msapps
2009-09-01 15:05:53 ----D---- C:\WINDOWS\msagent
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Media
2009-09-01 15:05:53 ----D---- C:\WINDOWS\java
2009-09-01 15:05:53 ----D---- C:\WINDOWS\ime
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Help
2009-09-01 15:05:53 ----D---- C:\WINDOWS\ehome
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Driver Cache
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Debug
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Cursors
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Connection Wizard
2009-09-01 15:05:53 ----D---- C:\WINDOWS\Config
2009-09-01 15:05:53 ----D---- C:\WINDOWS\AppPatch
2009-09-01 15:05:53 ----D---- C:\WINDOWS\addins
2009-09-01 15:05:53 ----D---- C:\WINDOWS
2009-09-01 14:47:36 ----A---- C:\WINDOWS\ODBC.INI
2009-09-01 14:47:32 ----A---- C:\WINDOWS\system32\mdimon.dll
2009-09-01 14:46:31 ----D---- C:\Program Files\Fichiers communs\DESIGNER
2009-09-01 14:46:30 ----D---- C:\Program Files\Microsoft Works
2009-09-01 14:46:25 ----D---- C:\Program Files\Microsoft Visual Studio
2009-09-01 14:46:21 ----D---- C:\WINDOWS\SHELLNEW
2009-09-01 14:46:15 ----D---- C:\Program Files\Microsoft Office
2009-09-01 14:44:53 ----RHD---- C:\MSOCache
2009-09-01 14:33:52 ----SHD---- C:\RECYCLER
2009-09-01 14:32:37 ----D---- C:\Documents and Settings\mamoud\Application Data\Identities
2009-09-01 14:32:35 ----HD---- C:\Program Files\Uninstall Information
2009-09-01 14:32:25 ----SD---- C:\Documents and Settings\mamoud\Application Data\Microsoft
2009-09-01 14:32:25 ----ASH---- C:\Documents and Settings\mamoud\Application Data\desktop.ini
2009-09-01 14:31:00 ----D---- C:\WINDOWS\SoftwareDistribution
2009-09-01 14:30:59 ----D---- C:\WINDOWS\Prefetch
2009-09-01 14:30:58 ----SD---- C:\WINDOWS\system32\Microsoft
2009-09-01 14:30:58 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-09-01 14:28:05 ----D---- C:\WINDOWS\system32\xircom
2009-09-01 14:28:05 ----D---- C:\Program Files\xerox
2009-09-01 14:28:05 ----D---- C:\Program Files\microsoft frontpage
2009-09-01 14:27:43 ----A---- C:\WINDOWS\control.ini
2009-09-01 14:27:43 ----A---- C:\AUTOEXEC.BAT
2009-09-01 14:27:34 ----A---- C:\WINDOWS\OEWABLog.txt
2009-09-01 14:27:32 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-09-01 14:26:48 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-09-01 14:26:48 ----RD---- C:\WINDOWS\Offline Web Pages
2009-09-01 14:26:47 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-09-01 14:26:42 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-09-01 14:26:38 ----HD---- C:\Program Files\WindowsUpdate
2009-09-01 14:26:35 ----D---- C:\Program Files\Services en ligne
2009-09-01 14:26:21 ----D---- C:\WINDOWS\system32\DirectX
2009-09-01 14:26:03 ----A---- C:\WINDOWS\system32\atrace.dll
2009-09-01 14:26:02 ----A---- C:\WINDOWS\system32\desktop.ini
2009-09-01 14:26:02 ----A---- C:\WINDOWS\desktop.ini
2009-09-01 14:25:57 ----A---- C:\WINDOWS\system32
mevtmsg.dll
2009-09-01 14:25:56 ----A---- C:\WINDOWS\system32\acctres.dll
2009-09-01 14:25:55 ----D---- C:\Program Files\Fichiers communs\Services
2009-09-01 14:25:53 ----SD---- C:\WINDOWS\Tasks
2009-09-01 14:25:53 ----D---- C:\Program Files\Fichiers communs\MSSoap
2009-09-01 14:25:53 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-09-01 14:25:50 ----D---- C:\WINDOWS\srchasst
2009-09-01 14:25:49 ----D---- C:\WINDOWS\system32\Macromed
2009-09-01 14:25:47 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-09-01 14:25:47 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-09-01 14:25:47 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-09-01 14:25:47 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-09-01 14:25:46 ----A---- C:\WINDOWS\system32\wups.dll
2009-09-01 14:25:46 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-09-01 14:25:46 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-09-01 14:25:46 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-09-01 14:25:46 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-09-01 14:25:46 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-09-01 14:25:46 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-09-01 14:25:45 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-09-01 14:25:45 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-09-01 14:25:43 ----D---- C:\Program Files\Movie Maker
2009-09-01 14:25:40 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-09-01 14:25:40 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-09-01 14:25:40 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-09-01 14:25:40 ----A---- C:\WINDOWS\system32acpldlg.dll
2009-09-01 14:25:37 ----D---- C:\WINDOWS\system32\Restore
2009-09-01 14:25:37 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-09-01 14:25:37 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-09-01 14:25:37 ----A---- C:\WINDOWS\system32\srclient.dll
2009-09-01 14:25:37 ----A---- C:\WINDOWS\system32\fltMc.exe
2009-09-01 14:25:37 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-09-01 14:25:36 ----A---- C:\WINDOWS\system32
mmkcert.dll
2009-09-01 14:25:36 ----A---- C:\WINDOWS\system32\msconf.dll
2009-09-01 14:25:36 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-09-01 14:25:36 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-09-01 14:25:36 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-09-01 14:25:36 ----A---- C:\WINDOWS\system32\ils.dll
2009-09-01 14:25:34 ----D---- C:\Program Files\NetMeeting
2009-09-01 14:25:34 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-09-01 14:25:34 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-09-01 14:25:33 ----A---- C:\WINDOWS\system32\inetres.dll
2009-09-01 14:25:33 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-09-01 14:25:31 ----D---- C:\Program Files\Outlook Express
2009-09-01 14:25:31 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-09-01 14:25:31 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-09-01 14:25:31 ----A---- C:\WINDOWS\system32\mstask.dll
2009-09-01 14:25:31 ----A---- C:\WINDOWS\system32\isign32.dll
2009-09-01 14:25:31 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-09-01 14:25:31 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-09-01 14:25:31 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-09-01 14:25:26 ----D---- C:\Program Files\Internet Explorer
2009-09-01 14:25:26 ----D---- C:\Program Files\Fichiers communs\System
2009-09-01 14:24:56 ----D---- C:\Program Files\ComPlus Applications
2009-09-01 14:24:54 ----A---- C:\WINDOWS\vbaddin.ini
2009-09-01 14:24:54 ----A---- C:\WINDOWS\vb.ini
2009-09-01 14:24:50 ----D---- C:\WINDOWS\Registration
2009-09-01 14:24:44 ----D---- C:\Program Files\Windows Media Player
2009-09-01 14:24:44 ----D---- C:\Program Files\Online Services
2009-09-01 14:24:39 ----D---- C:\Program Files\Messenger
2009-09-01 14:24:36 ----D---- C:\Program Files\MSN Gaming Zone
2009-09-01 14:24:36 ----A---- C:\WINDOWS\system32\write.exe
2009-09-01 14:24:29 ----A---- C:\WINDOWS\system32\winchat.exe
2009-09-01 14:24:29 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-09-01 14:24:29 ----A---- C:\WINDOWS\system32\hticons.dll
2009-09-01 14:24:29 ----A---- C:\WINDOWS\system32\avwav.dll
2009-09-01 14:24:29 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-09-01 14:24:29 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-09-01 14:24:24 ----A---- C:\WINDOWS\system32\getuname.dll
2009-09-01 14:24:23 ----A---- C:\WINDOWS\system32\winmine.exe
2009-09-01 14:24:23 ----A---- C:\WINDOWS\system32\sol.exe
2009-09-01 14:24:23 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-09-01 14:24:23 ----A---- C:\WINDOWS\system32\charmap.exe
2009-09-01 14:24:23 ----A---- C:\WINDOWS\system32\calc.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32	sshutdn.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32	slabels.ini
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32	skill.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32	sdiscon.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32	scon.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32\shadow.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32winsta.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32eset.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32egini.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32dpcfgex.dll
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32\msg.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32\logoff.exe
2009-09-01 14:24:22 ----A---- C:\WINDOWS\system32\freecell.exe
2009-09-01 14:24:21 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-09-01 14:24:21 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-09-01 14:24:21 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-09-01 14:24:21 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-09-01 14:24:21 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-09-01 14:24:21 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-09-01 14:24:21 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-09-01 14:24:21 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-09-01 14:24:20 ----A---- C:\WINDOWS\system32\stclient.dll
2009-09-01 14:24:20 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-09-01 14:24:16 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-09-01 14:20:40 ----D---- C:\Program Files\MSN
2009-09-01 14:20:39 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-09-01 14:20:39 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-09-01 14:20:39 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-09-01 14:20:39 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-09-01 14:20:38 ----D---- C:\Program Files\Windows NT
2009-09-01 14:20:38 ----A---- C:\WINDOWS\system32\spider.exe
2009-09-01 14:20:38 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-09-01 14:20:38 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32	scupgrd.exe
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32	scfgwmi.dll
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32	ermsrv.dll
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32emotepg.dll
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32dshost.exe
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32dsaddin.exe
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32dchost.dll
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-09-01 14:20:37 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-09-01 14:20:36 ----D---- C:\WINDOWS\system32\MsDtc
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32dpwsx.dll
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32dpsnd.dll
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32dpclip.exe
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-09-01 14:20:36 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-09-01 14:20:35 ----D---- C:\WINDOWS\system32\Com
2009-09-01 14:20:35 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-09-01 14:20:35 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-09-01 14:20:35 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-09-01 14:20:35 ----A---- C:\WINDOWS\system32\colbact.dll
2009-09-01 14:20:35 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-09-01 14:20:35 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-09-01 14:20:34 ----A---- C:\WINDOWS\system32\comuid.dll
2009-09-01 14:20:34 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-09-01 14:20:34 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-09-01 14:20:34 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-09-01 14:20:34 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-09-01 14:20:29 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-09-01 14:20:29 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-09-01 14:20:29 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-09-01 14:20:29 ----A---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2009-09-01 15:12:27 ----A---- C:\WINDOWS\system.ini
2009-09-01 14:27:43 ----A---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-02-06 93336]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
R2 EpsonBidirectionalService;EpsonBidirectionalService; C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe [2002-01-29 77824]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-02-06 20680]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

Destrio5 · Answer

Je vois une infection.

--> Télécharge UsbFix (de Chiquitine29 & C_XX) sur ton Bureau.

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix sur ton Bureau.
(Sous Vista, il faut cliquer droit sur le raccourci UsbFix et choisir Exécuter en tant qu'administrateur)

--> Choisis l'option 1 (Recherche).

--> Laisse travailler l'outil.

--> Poste le rapport UsbFix.txt.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.

figman · Answer

ça marche pas le lien de usbfix

figman · Answer

voilà je l'avais deja dans ma clé usb , 



############################## | UsbFix V6.019 |

User : mamoud (Administrateurs) # MAMOUD-9E8F6FC1
Update on 19/08/09 by Chiquitine29 & C_XX
Start at: 15:08:53 | 09/09/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

              Intel(R) Pentium(R) D CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : ESET NOD32 Antivirus 4.0 4.0 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 29,29 Go (25,39 Go free) # NTFS
D:\ -> Disque fixe local # 29,29 Go (26,08 Go free) # NTFS
E:\ -> Disque fixe local # 29,29 Go (26,4 Go free) # NTFS
F:\ -> Disque fixe local # 23,9 Go (23,84 Go free) # NTFS
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 982,05 Mo (853,43 Mo free) [MAMOUD BR] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{d318f72d-9852-11de-a090-00192129faf6}
SHElL\AUtoplaY\cOmMAnd =H:\wgufe.pif 
SHElL\AutoRun\command =H:\wgufe.pif 
SHElL\eXPlore\cOMmaNd =H:\wgufe.pif 
SHElL\open\coMMand =H:\wgufe.pif 

################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # UsbFix V6.019 ! |

Destrio5 · Answer

http://pagesperso-orange.fr/nostools/cariboost_files/UsbFix.exe

figman · Answer

je refait un scan usbfix ???

Destrio5 · Answer

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix présent sur ton Bureau.

--> Choisis l'option 2 (Suppression).

--> Ton Bureau disparaîtra et le PC redémarrera.

--> Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.

--> Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

figman · Answer

Salut , 




############################## | UsbFix V6.019 |

User : mamoud (Administrateurs) # MAMOUD-9E8F6FC1
Update on 19/08/09 by Chiquitine29 & C_XX
Start at: 12:26:38 | 10/09/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

              Intel(R) Pentium(R) D CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Enabled
AV : ESET NOD32 Antivirus 4.0 4.0 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 29,29 Go (25,37 Go free) # NTFS
D:\ -> Disque fixe local # 29,29 Go (26,08 Go free) # NTFS
E:\ -> Disque fixe local # 29,29 Go (26,4 Go free) # NTFS
F:\ -> Disque fixe local # 23,9 Go (23,84 Go free) # NTFS
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 982,05 Mo (852,12 Mo free) [MAMOUD BR] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe

################## | Fichiers # Dossiers infectieux |


################## | Autres |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{d318f72d-9852-11de-a090-00192129faf6}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[01/09/2009 14:27|--a------|0] -> C:\AUTOEXEC.BAT 
[01/09/2009 14:16|---hs----|212] -> C:\boot.ini 
[07/09/2002 02:00|-rahs----|4952] -> C:\Bootfont.bin 
[01/09/2009 14:27|--a------|0] -> C:\CONFIG.SYS 
[01/09/2009 14:27|-rahs----|0] -> C:\IO.SYS 
[01/09/2009 14:27|-rahs----|0] -> C:\MSDOS.SYS 
[04/08/2004 04:38|-rahs----|47564] -> C:\NTDETECT.COM 
[04/08/2004 04:59|-rahs----|251712] -> C:
tldr 
[?|?|?] -> C:\pagefile.sys 
[10/09/2009 12:27|--a------|2492] -> C:\UsbFix.txt 
[07/09/2009 09:49|--a------|143872] -> D:\397A4000 
[02/09/2009 06:26|--a------|939956] -> D:\7z465.exe 
[26/06/2009 12:17|--a------|26897264] -> D:\AdbeRdr910_fr_FR.exe 
[02/09/2009 07:09|--a------|30143928] -> D:\avira_antivir_personal_fr.exe 
[01/09/2009 22:51|--a------|3293088] -> D:\ccsetup223.exe 
[03/09/2009 08:51|--a------|27648] -> D:\COMMANDE IPN POUR N Machine atis rpulement.doc 
[03/09/2009 14:30|--a------|141824] -> D:\E N A C T 2008.xls 
[07/09/2009 10:29|--a------|144384] -> D:\EENACT20008.xls 
[13/04/2009 07:46|--a------|260608] -> D:\H DES PANNES 2009.xls 
[21/03/2009 12:14|--a------|524288] -> D:\High.doc 
[27/05/2008 08:14|--a------|28672] -> D:\imputation des installations altumet.xls 
[10/06/2009 09:06|--a------|821248] -> D:\LISTING DES INSTALLATIONS ET SOUS ENSEMBLES EXERCICE 2009.doc 
[01/09/2009 22:39|--a------|3942048] -> D:\mbam_setup.exe 
[14/05/2008 12:24|--a------|441856] -> D:\Nomenclature des installations ALTUMET.xls 
[26/05/2008 14:43|--a------|27648] -> D:
ote d'information.doc 
[12/10/2008 10:42|--a------|20992] -> D:\Note d'interime mois d'octobre.doc 
[20/09/2008 11:24|--a------|22016] -> D:\Note pompe graco.doc 
[07/05/2009 12:01|--a------|10752] -> D:\Nouveau Document Microsoft Word (3).doc 
[05/05/2009 10:16|--a------|10752] -> D:\Nouveau Document Microsoft Word.doc 
[25/06/2009 10:38|--a------|113664] -> D:\P E ARRET ANNUEL 2009finale.xls 
[17/08/2009 09:16|--a------|1687040] -> D:\PANNES 2009.xls 
[07/10/2008 13:43|--a------|383488] -> D:\PLAN D'ACTION ENACT 2008.doc 
[17/06/2009 13:51|--a------|105984] -> D:\PLANNING ARRET ANNUEL 2009 PAR SPECIALITE ET PAR EQUIPE.doc 
[15/01/2008 10:50|--a------|90112] -> D:\PLANNING PREVENTF 2008.doc 
[15/04/2008 13:58|--a------|275] -> D:\Raccourci vers Disque local (C).lnk 
[03/09/2008 15:06|--a------|355328] -> E:\arret annuel 2008.xls 
[16/01/2008 13:48|--a------|1110] -> E:\globdata.ini 
[16/01/2008 13:48|--a------|843] -> E:\install.ini 
[16/01/2008 13:52|--a------|97296] -> E:\install.res.1036.dll 
[24/12/2008 19:29|--a------|2539400] -> E:\mbam-setup.exe 
[16/02/2009 12:40|--a------|883032] -> E:av.zip 
[20/04/2008 13:08|--a------|277396] -> E:\Uninst.isu 
[16/01/2008 13:48|--a------|5686] -> E:\vcredist.bmp 
[16/01/2008 13:58|--a------|1442522] -> E:\VC_RED.cab 
[16/01/2008 14:00|--a------|233984] -> E:\VC_RED.MSI 
[03/09/2009 14:30|--a------|141824] -> H:\E N A C T 2008.xls 
[26/06/2009 12:17|--a------|26897264] -> H:\AdbeRdr910_fr_FR.exe 
[27/12/2008 22:24|--a------|1850504] -> H:\TeamViewer_Setup_fr.exe 
[01/09/2009 22:39|--a------|3942048] -> H:\mbam_setup.exe 
[01/09/2009 22:51|--a------|3293088] -> H:\ccsetup223.exe 
[02/09/2009 06:26|--a------|939956] -> H:\7z465.exe 
[02/09/2009 07:09|--a------|30143928] -> H:\avira_antivir_personal_fr.exe 
[30/08/2009 18:57|--a------|15882224] -> H:\drweb-cureit.exe 
[08/09/2009 00:25|--a------|31185408] -> H:
od32_nod32_4.0.417_francais_21922.msi 
[08/09/2009 11:13|--a------|17220728] -> H:\launch.exe 
[09/09/2009 06:24|--a------|781909] -> H:\RSIT.exe 
[03/09/2009 09:40|--a------|1215796] -> H:\cij0xQSUgM.zip 
[09/09/2009 15:09|--a------|2219] -> H:\UsbFix.txt 
[09/09/2009 19:05|--a------|1400503] -> H:\UsbFix.exe 

################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # UsbFix V6.019 ! |

Destrio5 · Answer

Plus de souci avec le PC ?

figman · Answer

we bien sur puisque il est formater donc , c'est regler en principe  

merci ,

Pc tres lent à éxecuter

41 réponses

Newsletters