Ugrent besoin d'aide
Fermé
machi-ana
-
23 sept. 2009 à 19:34
fix200 Messages postés 3243 Date d'inscription dimanche 28 décembre 2008 Statut Contributeur sécurité Dernière intervention 7 février 2011 - 27 oct. 2009 à 18:57
fix200 Messages postés 3243 Date d'inscription dimanche 28 décembre 2008 Statut Contributeur sécurité Dernière intervention 7 février 2011 - 27 oct. 2009 à 18:57
126 réponses
Re :
ben j'ai poster la demande avant que je ne post ici comme j'ai pas u de reponse j'en ai poster sur se forum et se matin une reponse vien d'etre posté!! voila tout voici le lien :
http://www.aidoforum.com/forum/sujet-31204.html
pour se lien >> ▶ Glisse maintenant le fichier CFScript.txt dans Moi.exe comme ceci
sa ne fonctionne pas!
ben j'ai poster la demande avant que je ne post ici comme j'ai pas u de reponse j'en ai poster sur se forum et se matin une reponse vien d'etre posté!! voila tout voici le lien :
http://www.aidoforum.com/forum/sujet-31204.html
pour se lien >> ▶ Glisse maintenant le fichier CFScript.txt dans Moi.exe comme ceci
sa ne fonctionne pas!
fix200
Messages postés
3243
Date d'inscription
dimanche 28 décembre 2008
Statut
Contributeur sécurité
Dernière intervention
7 février 2011
158
25 sept. 2009 à 16:58
25 sept. 2009 à 16:58
Comment ça ? tu as regardé l image donnée ?
je ne peux pas voir l'immage sa ecrit errur...ect
Cannot find "http://sd-1.archive-host.com/membres/up/116615172019703188/CFscript2.gif" DNS Error - Server cannot be found
Cannot find "http://sd-1.archive-host.com/membres/up/116615172019703188/CFscript2.gif" DNS Error - Server cannot be found
fix200
Messages postés
3243
Date d'inscription
dimanche 28 décembre 2008
Statut
Contributeur sécurité
Dernière intervention
7 février 2011
158
25 sept. 2009 à 17:03
25 sept. 2009 à 17:03
OK , ben tout simplement tu glisse l'icône du CFScript sur Moi.exe , c'est facile ! ;)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Re voici le rapport combofix
ComboFix 09-09-24.01 - mohamed 25/09/2009 17:08.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1622 [GMT 2:00]
Lancé depuis: c:\documents and settings\mohamed\Bureau\moi.exe
Commutateurs utilisés :: c:\documents and settings\mohamed\Bureau\CFScript.txt
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FILE ::
"c:\docume~1\mohamed\LOCALS~1\Temp\cfwo.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\cjpooh.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\fkax.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\nstj.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\obeh.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\spfa.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\vbqur.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winbbfsod.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winfnky.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winkafa.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winkeaply.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winllkt.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winsbbtt.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winvhvms.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\yebdnp.exe"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Symantec
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Settings.LiveUpdate
c:\program files\Fichiers communs\Symantec Shared
c:\program files\pdfforge Toolbar\SearchSettings.dll
c:\program files\Symantec
c:\program files\Symantec\LiveUpdate\LuResult.txt
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-08-25 au 2009-09-25 ))))))))))))))))))))))))))))))))))))
.
2009-09-25 14:10 . 2009-09-25 14:10 -------- d-----w- c:\documents and settings\mohamed\Application Data\pdfforge
2009-09-25 14:10 . 2009-09-25 14:10 -------- d-----w- c:\documents and settings\mohamed\Application Data\Search Settings
2009-09-25 14:03 . 2009-09-25 14:03 -------- d-----w- c:\documents and settings\mohamed\Application Data\~LM00001.tmp
2009-09-25 13:32 . 2009-09-25 15:12 -------- d-----w- c:\program files\pdfforge Toolbar
2009-09-25 13:30 . 2001-10-28 14:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2009-09-25 13:30 . 1998-07-12 23:08 119568 ----a-w- c:\windows\system32\VB6FR.DLL
2009-09-25 13:30 . 1998-07-12 23:08 59904 ----a-w- c:\windows\system32\MSCC2FR.DLL
2009-09-25 13:30 . 1998-07-12 23:08 141312 ----a-w- c:\windows\system32\MSCMCFR.DLL
2009-09-25 13:30 . 1998-07-05 22:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2009-09-25 13:30 . 2009-09-25 13:33 -------- d-----w- c:\program files\PDFCreator
2009-09-25 01:38 . 2009-09-25 13:33 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Easy CD-DA Extractor
2009-09-25 01:38 . 2009-09-25 01:40 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-25 01:37 . 2009-09-25 01:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Easy CD-DA Extractor
2009-09-25 01:36 . 2009-09-25 01:36 -------- d-----w- c:\windows\Easy CD-DA Extractor 12.0.1
2009-09-25 01:36 . 2009-09-25 01:37 -------- d-----w- c:\program files\Easy CD-DA Extractor 12
2009-09-24 23:25 . 2009-09-24 23:25 -------- d-----w- C:\rsit
2009-09-24 22:30 . 2009-09-24 22:30 -------- d-----w- c:\documents and settings\mohamed\Application Data\Malwarebytes
2009-09-24 22:30 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-24 22:30 . 2009-09-24 22:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-24 22:30 . 2009-09-24 22:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-24 22:30 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-24 20:13 . 2009-09-24 20:13 -------- d-----w- C:\_OTM
2009-09-24 18:25 . 2009-09-24 18:25 -------- d-----w- c:\program files\Microsoft Works
2009-09-24 18:25 . 2009-09-24 18:25 -------- d-----w- c:\program files\MSBuild
2009-09-24 18:24 . 2009-09-24 18:24 -------- d-----w- c:\program files\Microsoft.NET
2009-09-24 18:22 . 2009-09-24 18:22 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-09-24 18:21 . 2009-09-24 18:25 -------- d-----w- c:\windows\SHELLNEW
2009-09-24 18:21 . 2009-09-24 18:21 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Microsoft Help
2009-09-24 18:21 . 2009-09-24 18:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-24 18:19 . 2009-09-24 18:19 -------- d-----r- C:\MSOCache
2009-09-24 16:56 . 2009-09-24 16:56 -------- d-----w- C:\Intel
2009-09-24 16:56 . 2009-09-24 16:56 -------- d-----w- c:\documents and settings\mohamed\Application Data\InstallShield
2009-09-24 16:30 . 2009-09-24 16:30 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-09-24 15:45 . 2009-09-24 23:25 -------- d-----w- c:\program files\trend micro
2009-09-24 14:15 . 2009-09-24 14:15 -------- d-----w- c:\program files\Stardock
2009-09-24 13:35 . 2006-08-23 09:24 526184 ----a-w- c:\windows\system32\XceedCry.dll
2009-09-24 13:35 . 2003-12-15 09:23 279392 ----a-w- c:\windows\system32\XceedFtp.dll
2009-09-24 13:34 . 2009-09-24 13:48 -------- d-----w- c:\program files\LMSOFT Web Creator Pro 4
2009-09-23 20:14 . 2009-09-24 15:22 -------- d-----w- C:\UsbFix
2009-09-23 18:01 . 2007-03-21 18:39 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2009-09-23 18:01 . 2007-03-21 18:33 503808 ----a-w- c:\windows\system32\MSVCP71.DLL
2009-09-23 18:01 . 2007-03-21 18:33 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2009-09-23 17:48 . 2001-08-23 15:47 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2009-09-23 17:48 . 2001-08-23 15:47 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2009-09-23 17:48 . 2001-08-23 15:47 8192 -c--a-w- c:\windows\system32\dllcache\kbdkor.dll
2009-09-23 17:48 . 2001-08-23 15:47 8192 ----a-w- c:\windows\system32\kbdkor.dll
2009-09-23 17:48 . 2001-08-17 20:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101c.dll
2009-09-23 17:48 . 2001-08-17 20:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101b.dll
2009-09-23 17:48 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101c.dll
2009-09-23 17:48 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101b.dll
2009-09-23 17:48 . 2001-08-17 20:55 5632 -c--a-w- c:\windows\system32\dllcache\kbd103.dll
2009-09-23 17:48 . 2001-08-17 20:55 5632 ----a-w- c:\windows\system32\kbd103.dll
2009-09-23 17:48 . 2008-04-13 17:31 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2009-09-23 17:48 . 2008-04-13 17:31 6144 ----a-w- c:\windows\system32\kbd106.dll
2009-09-23 14:47 . 2009-09-23 14:47 -------- d-----w- c:\program files\Adobe Media Player
2009-09-23 14:24 . 2009-09-23 14:24 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
2009-09-23 14:23 . 2009-09-23 14:23 -------- d-----w- c:\documents and settings\mohamed\Application Data\ViGlance
2009-09-23 14:23 . 2009-09-23 14:23 -------- d-----w- c:\program files\ViGlance
2009-09-23 14:20 . 2009-09-23 14:20 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-09-23 14:20 . 2009-09-23 14:20 -------- d-----w- c:\documents and settings\mohamed\Application Data\DAEMON Tools
2009-09-23 14:12 . 2009-09-23 14:12 -------- d-----w- c:\program files\Fichiers communs\Corel
2009-09-23 14:12 . 2009-09-23 14:12 -------- d-----w- c:\program files\Corel
2009-09-23 00:57 . 2009-09-23 00:57 -------- d-----w- c:\windows\ie8updates
2009-09-23 00:57 . 2009-09-23 00:57 -------- d-----w- c:\program files\MSXML 4.0
2009-09-23 00:47 . 2009-09-23 00:47 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Installer4108
2009-09-23 00:45 . 2009-09-23 00:45 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Installer5520
2009-09-22 23:48 . 2009-09-22 23:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems
2009-09-22 23:47 . 2009-09-22 23:47 -------- d-----w- c:\program files\Fichiers communs\Adobe Systems Shared
2009-09-22 23:24 . 2009-09-22 23:24 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-09-22 23:16 . 2008-06-14 17:33 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-09-22 23:16 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\drivers\bthport.sys
2009-09-22 23:10 . 2009-09-22 23:10 -------- d-----w- c:\program files\QuickTime
2009-09-22 23:10 . 2007-02-20 14:04 190696 ----a-w- c:\windows\system32\NPSWF32_FlashUtil.exe
2009-09-22 23:10 . 2007-02-20 14:04 2463976 ----a-w- c:\windows\system32\NPSWF32.dll
2009-09-22 23:09 . 2009-09-22 23:09 -------- d-----w- c:\program files\Bonjour
2009-09-22 23:02 . 2009-09-22 23:02 -------- d-----w- c:\program files\Fichiers communs\Macrovision Shared
2009-09-22 22:59 . 2009-07-03 16:57 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-22 22:59 . 2009-07-03 16:57 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-22 22:59 . 2009-07-03 16:57 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-09-22 22:59 . 2009-07-03 16:57 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-09-22 22:59 . 2009-07-03 16:57 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-09-22 22:58 . 2009-09-24 14:30 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Adobe
2009-09-22 22:57 . 2009-09-22 22:57 -------- d-----w- c:\windows\system32\Adobe
2009-09-22 22:57 . 2001-11-14 18:19 16384 ----a-w- c:\windows\system32\FileOps.exe
2009-09-22 22:54 . 2009-09-22 22:54 -------- d-----w- c:\windows\Adobe Illustrator CS
2009-09-22 22:13 . 2009-09-22 22:18 -------- d-----w- c:\documents and settings\mohamed\Application Data\Mumble
2009-09-22 22:13 . 2009-09-22 22:13 -------- d-----w- c:\program files\Mumble
2009-09-22 21:50 . 2009-02-09 11:24 2191104 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-09-22 21:50 . 2009-02-09 11:23 2147328 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-09-22 21:50 . 2009-02-09 11:23 2025984 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-09-22 21:41 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-09-22 21:09 . 2009-09-23 16:22 -------- d--h--w- c:\windows\$hf_mig$
2009-09-22 16:39 . 2007-04-27 02:37 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-09-22 14:35 . 2009-09-22 14:35 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-09-22 00:42 . 2009-09-22 00:42 -------- d-sh--w- c:\documents and settings\mohamed\IECompatCache
2009-09-22 00:42 . 2009-09-22 00:42 -------- d-sh--w- c:\documents and settings\mohamed\PrivacIE
2009-09-22 00:35 . 2009-09-22 00:35 -------- d-sh--w- c:\documents and settings\mohamed\IETldCache
2009-09-22 00:33 . 2009-09-22 00:33 568 ---ha-w- C:\aaw7boot.cmd
2009-09-21 23:53 . 2009-09-21 23:57 -------- dc-h--w- c:\windows\ie8
2009-09-21 23:51 . 2009-09-24 19:06 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-21 23:47 . 2009-09-25 00:53 -------- d-----w- C:\Downloads
2009-09-21 23:16 . 2009-09-22 16:59 -------- dc----w- c:\windows\system32\DRVSTORE
2009-09-21 23:10 . 2009-09-22 16:59 -------- d-----w- c:\program files\Lavasoft
2009-09-21 23:10 . 2009-09-22 16:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-09-21 23:00 . 2009-09-21 23:00 -------- d-sh--w- c:\documents and settings\mohamed\UserData
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-25 15:02 . 2009-09-21 21:24 -------- d-----w- c:\documents and settings\mohamed\Application Data\Free Download Manager
2009-09-24 18:31 . 2009-09-21 21:15 68856 ----a-w- c:\documents and settings\mohamed\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-24 16:56 . 2009-09-21 19:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-24 16:56 . 2009-09-21 19:34 -------- d-----w- c:\program files\Intel
2009-09-24 14:37 . 2009-09-21 20:50 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-24 13:45 . 2007-04-27 02:37 71488 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-24 13:45 . 2007-04-27 02:37 458648 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-21 23:05 . 2009-09-21 21:34 -------- d-----w- c:\program files\Java
2009-09-21 21:39 . 2009-09-21 21:39 -------- d-----w- c:\program files\Microsoft
2009-09-21 21:39 . 2009-09-21 21:39 -------- d-----w- c:\program files\Windows Live
2009-09-21 21:39 . 2009-09-21 21:39 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-21 21:24 . 2009-09-21 21:24 -------- d-----w- c:\program files\Free Download Manager
2009-09-21 21:24 . 2009-09-21 21:24 -------- d-----w- c:\documents and settings\All Users\Application Data\FreeDownloadManager.ORG
2009-09-21 21:15 . 2009-09-21 21:15 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-09-21 21:12 . 2009-09-21 21:12 -------- d-----w- c:\program files\Total Video Converter
2009-09-21 21:09 . 2009-09-21 21:09 -------- d-----w- c:\documents and settings\mohamed\Application Data\Nero
2009-09-21 21:08 . 2009-09-21 21:07 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-09-21 21:07 . 2009-09-21 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-09-21 21:07 . 2009-09-21 21:07 -------- d-----w- c:\program files\Nero
2009-09-21 20:52 . 2009-09-21 20:52 0 ----a-w- c:\windows\nsreg.dat
2009-09-21 20:05 . 2009-09-21 20:05 -------- d-----w- c:\program files\Realtek
2009-09-21 19:58 . 2009-09-21 19:57 -------- d-----w- c:\program files\Analog Devices
2009-09-21 19:51 . 2009-09-21 19:51 -------- d-----w- c:\documents and settings\mohamed\Application Data\vlc
2009-09-21 19:50 . 2009-09-21 19:50 -------- d-----w- c:\program files\VideoLAN
2009-09-21 19:48 . 2009-09-21 19:48 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-21 19:45 . 2009-09-21 19:45 -------- d-----w- c:\program files\Marvell
2009-09-21 19:44 . 2009-09-21 19:40 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-09-21 19:24 . 2009-09-21 19:24 -------- d-----w- c:\program files\microsoft frontpage
2009-09-21 19:21 . 2009-09-21 19:21 -------- d-----w- c:\program files\Services en ligne
2009-09-21 19:18 . 2009-09-21 19:18 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-08-05 09:00 . 2007-04-27 02:37 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:35 . 2007-04-27 02:37 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:35 . 2007-04-27 02:37 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-25 03:23 . 2009-09-21 21:35 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2007-04-27 02:37 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2007-04-27 02:37 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2007-04-27 02:37 915456 ------w- c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-07-31 00:00 698880 ----a-w- c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll" [2009-07-31 698880]
[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 1762600]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-09-22 3883856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-04 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-04 81920]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-18 995328]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 105328]
"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 226864]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 2282792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 223008]
"Corel Painter 8f"="c:\program files\Fichiers communs\Corel\Registration\FR\Registration.exe" [2003-04-06 401408]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1385808]
"SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2009-07-29 1098240]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-12-04 1695744]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-04-27 15360]
c:\documents and settings\mohamed\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2009-9-23 180224]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2009-9-23 180224]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[COLOR=RED] Les clés de Registre SafeBoot doivent être réparées. Cette machine ne peut pas utiliser le Mode Sans Échec. /COLOR
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Tools\\CD Driver asus\\ASUSACPI.exe"=
"d:\\Tools\\CD Driver asus\\Drivers\\Chipset\\Intel\\Inf\\setup.exe"=
"d:\\Tools\\CD Driver asus\\Bin\\SELECT.EXE"=
"d:\\Tools\\CD Driver asus\\Drivers\\Audio\\ADI\\32bit\\2K_XP\\AsusSetup.exe"=
"d:\\Tools\\CD Driver asus\\Drivers\\LAN\\RTL8168\\setup.exe"=
"d:\\Tools\\U1011_20070511 airpace wifi\\setup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=
"c:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero BackItUp\\NBKeyScan.exe"=
"c:\\Program Files\\Analog Devices\\SoundMAX\\smax4.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\Calibration\\Adobe Gamma Loader.exe"=
"c:\\Program Files\\Fichiers communs\\Corel\\Registration\\FR\\Registration.exe"=
"c:\\Program Files\\Adobe\\Adobe Flash CS3\\Flash.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Fichiers communs\\Nero\\Lib\\NMIndexStoreSvr.exe"=
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\njknnn.sys --> c:\windows\system32\drivers\njknnn.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2009-09-25 c:\windows\Tasks\User_Feed_Synchronization-{505B1C98-AD84-4B8D-ADA1-984149882B21}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} - hxxp://www.zorap.com/zorap_2_1_0_4.cab
FF - ProfilePath - c:\documents and settings\mohamed\Application Data\Mozilla\Firefox\Profiles\pe2ao4ll.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-25 17:13
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Heure de fin: 2009-09-25 17:15
ComboFix-quarantined-files.txt 2009-09-25 15:15
Avant-CF: 89 480 200 192 octets libres
Après-CF: 89 508 196 352 octets libres
328 --- E O F --- 2009-09-23 17:32
ComboFix 09-09-24.01 - mohamed 25/09/2009 17:08.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1622 [GMT 2:00]
Lancé depuis: c:\documents and settings\mohamed\Bureau\moi.exe
Commutateurs utilisés :: c:\documents and settings\mohamed\Bureau\CFScript.txt
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FILE ::
"c:\docume~1\mohamed\LOCALS~1\Temp\cfwo.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\cjpooh.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\fkax.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\nstj.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\obeh.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\spfa.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\vbqur.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winbbfsod.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winfnky.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winkafa.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winkeaply.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winllkt.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winsbbtt.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\winvhvms.exe"
"c:\docume~1\mohamed\LOCALS~1\Temp\yebdnp.exe"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Symantec
c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\Settings.LiveUpdate
c:\program files\Fichiers communs\Symantec Shared
c:\program files\pdfforge Toolbar\SearchSettings.dll
c:\program files\Symantec
c:\program files\Symantec\LiveUpdate\LuResult.txt
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-08-25 au 2009-09-25 ))))))))))))))))))))))))))))))))))))
.
2009-09-25 14:10 . 2009-09-25 14:10 -------- d-----w- c:\documents and settings\mohamed\Application Data\pdfforge
2009-09-25 14:10 . 2009-09-25 14:10 -------- d-----w- c:\documents and settings\mohamed\Application Data\Search Settings
2009-09-25 14:03 . 2009-09-25 14:03 -------- d-----w- c:\documents and settings\mohamed\Application Data\~LM00001.tmp
2009-09-25 13:32 . 2009-09-25 15:12 -------- d-----w- c:\program files\pdfforge Toolbar
2009-09-25 13:30 . 2001-10-28 14:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2009-09-25 13:30 . 1998-07-12 23:08 119568 ----a-w- c:\windows\system32\VB6FR.DLL
2009-09-25 13:30 . 1998-07-12 23:08 59904 ----a-w- c:\windows\system32\MSCC2FR.DLL
2009-09-25 13:30 . 1998-07-12 23:08 141312 ----a-w- c:\windows\system32\MSCMCFR.DLL
2009-09-25 13:30 . 1998-07-05 22:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2009-09-25 13:30 . 2009-09-25 13:33 -------- d-----w- c:\program files\PDFCreator
2009-09-25 01:38 . 2009-09-25 13:33 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Easy CD-DA Extractor
2009-09-25 01:38 . 2009-09-25 01:40 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-25 01:37 . 2009-09-25 01:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Easy CD-DA Extractor
2009-09-25 01:36 . 2009-09-25 01:36 -------- d-----w- c:\windows\Easy CD-DA Extractor 12.0.1
2009-09-25 01:36 . 2009-09-25 01:37 -------- d-----w- c:\program files\Easy CD-DA Extractor 12
2009-09-24 23:25 . 2009-09-24 23:25 -------- d-----w- C:\rsit
2009-09-24 22:30 . 2009-09-24 22:30 -------- d-----w- c:\documents and settings\mohamed\Application Data\Malwarebytes
2009-09-24 22:30 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-24 22:30 . 2009-09-24 22:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-24 22:30 . 2009-09-24 22:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-24 22:30 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-24 20:13 . 2009-09-24 20:13 -------- d-----w- C:\_OTM
2009-09-24 18:25 . 2009-09-24 18:25 -------- d-----w- c:\program files\Microsoft Works
2009-09-24 18:25 . 2009-09-24 18:25 -------- d-----w- c:\program files\MSBuild
2009-09-24 18:24 . 2009-09-24 18:24 -------- d-----w- c:\program files\Microsoft.NET
2009-09-24 18:22 . 2009-09-24 18:22 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-09-24 18:21 . 2009-09-24 18:25 -------- d-----w- c:\windows\SHELLNEW
2009-09-24 18:21 . 2009-09-24 18:21 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Microsoft Help
2009-09-24 18:21 . 2009-09-24 18:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-24 18:19 . 2009-09-24 18:19 -------- d-----r- C:\MSOCache
2009-09-24 16:56 . 2009-09-24 16:56 -------- d-----w- C:\Intel
2009-09-24 16:56 . 2009-09-24 16:56 -------- d-----w- c:\documents and settings\mohamed\Application Data\InstallShield
2009-09-24 16:30 . 2009-09-24 16:30 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-09-24 15:45 . 2009-09-24 23:25 -------- d-----w- c:\program files\trend micro
2009-09-24 14:15 . 2009-09-24 14:15 -------- d-----w- c:\program files\Stardock
2009-09-24 13:35 . 2006-08-23 09:24 526184 ----a-w- c:\windows\system32\XceedCry.dll
2009-09-24 13:35 . 2003-12-15 09:23 279392 ----a-w- c:\windows\system32\XceedFtp.dll
2009-09-24 13:34 . 2009-09-24 13:48 -------- d-----w- c:\program files\LMSOFT Web Creator Pro 4
2009-09-23 20:14 . 2009-09-24 15:22 -------- d-----w- C:\UsbFix
2009-09-23 18:01 . 2007-03-21 18:39 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2009-09-23 18:01 . 2007-03-21 18:33 503808 ----a-w- c:\windows\system32\MSVCP71.DLL
2009-09-23 18:01 . 2007-03-21 18:33 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2009-09-23 17:48 . 2001-08-23 15:47 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2009-09-23 17:48 . 2001-08-23 15:47 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2009-09-23 17:48 . 2001-08-23 15:47 8192 -c--a-w- c:\windows\system32\dllcache\kbdkor.dll
2009-09-23 17:48 . 2001-08-23 15:47 8192 ----a-w- c:\windows\system32\kbdkor.dll
2009-09-23 17:48 . 2001-08-17 20:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101c.dll
2009-09-23 17:48 . 2001-08-17 20:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101b.dll
2009-09-23 17:48 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101c.dll
2009-09-23 17:48 . 2001-08-17 20:55 6144 ----a-w- c:\windows\system32\kbd101b.dll
2009-09-23 17:48 . 2001-08-17 20:55 5632 -c--a-w- c:\windows\system32\dllcache\kbd103.dll
2009-09-23 17:48 . 2001-08-17 20:55 5632 ----a-w- c:\windows\system32\kbd103.dll
2009-09-23 17:48 . 2008-04-13 17:31 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2009-09-23 17:48 . 2008-04-13 17:31 6144 ----a-w- c:\windows\system32\kbd106.dll
2009-09-23 14:47 . 2009-09-23 14:47 -------- d-----w- c:\program files\Adobe Media Player
2009-09-23 14:24 . 2009-09-23 14:24 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
2009-09-23 14:23 . 2009-09-23 14:23 -------- d-----w- c:\documents and settings\mohamed\Application Data\ViGlance
2009-09-23 14:23 . 2009-09-23 14:23 -------- d-----w- c:\program files\ViGlance
2009-09-23 14:20 . 2009-09-23 14:20 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-09-23 14:20 . 2009-09-23 14:20 -------- d-----w- c:\documents and settings\mohamed\Application Data\DAEMON Tools
2009-09-23 14:12 . 2009-09-23 14:12 -------- d-----w- c:\program files\Fichiers communs\Corel
2009-09-23 14:12 . 2009-09-23 14:12 -------- d-----w- c:\program files\Corel
2009-09-23 00:57 . 2009-09-23 00:57 -------- d-----w- c:\windows\ie8updates
2009-09-23 00:57 . 2009-09-23 00:57 -------- d-----w- c:\program files\MSXML 4.0
2009-09-23 00:47 . 2009-09-23 00:47 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Installer4108
2009-09-23 00:45 . 2009-09-23 00:45 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Installer5520
2009-09-22 23:48 . 2009-09-22 23:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems
2009-09-22 23:47 . 2009-09-22 23:47 -------- d-----w- c:\program files\Fichiers communs\Adobe Systems Shared
2009-09-22 23:24 . 2009-09-22 23:24 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-09-22 23:16 . 2008-06-14 17:33 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-09-22 23:16 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\drivers\bthport.sys
2009-09-22 23:10 . 2009-09-22 23:10 -------- d-----w- c:\program files\QuickTime
2009-09-22 23:10 . 2007-02-20 14:04 190696 ----a-w- c:\windows\system32\NPSWF32_FlashUtil.exe
2009-09-22 23:10 . 2007-02-20 14:04 2463976 ----a-w- c:\windows\system32\NPSWF32.dll
2009-09-22 23:09 . 2009-09-22 23:09 -------- d-----w- c:\program files\Bonjour
2009-09-22 23:02 . 2009-09-22 23:02 -------- d-----w- c:\program files\Fichiers communs\Macrovision Shared
2009-09-22 22:59 . 2009-07-03 16:57 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-22 22:59 . 2009-07-03 16:57 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-22 22:59 . 2009-07-03 16:57 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-09-22 22:59 . 2009-07-03 16:57 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-09-22 22:59 . 2009-07-03 16:57 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-09-22 22:58 . 2009-09-24 14:30 -------- d-----w- c:\documents and settings\mohamed\Local Settings\Application Data\Adobe
2009-09-22 22:57 . 2009-09-22 22:57 -------- d-----w- c:\windows\system32\Adobe
2009-09-22 22:57 . 2001-11-14 18:19 16384 ----a-w- c:\windows\system32\FileOps.exe
2009-09-22 22:54 . 2009-09-22 22:54 -------- d-----w- c:\windows\Adobe Illustrator CS
2009-09-22 22:13 . 2009-09-22 22:18 -------- d-----w- c:\documents and settings\mohamed\Application Data\Mumble
2009-09-22 22:13 . 2009-09-22 22:13 -------- d-----w- c:\program files\Mumble
2009-09-22 21:50 . 2009-02-09 11:24 2191104 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-09-22 21:50 . 2009-02-09 11:23 2147328 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-09-22 21:50 . 2009-02-09 11:23 2025984 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-09-22 21:41 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-09-22 21:09 . 2009-09-23 16:22 -------- d--h--w- c:\windows\$hf_mig$
2009-09-22 16:39 . 2007-04-27 02:37 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-09-22 14:35 . 2009-09-22 14:35 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-09-22 00:42 . 2009-09-22 00:42 -------- d-sh--w- c:\documents and settings\mohamed\IECompatCache
2009-09-22 00:42 . 2009-09-22 00:42 -------- d-sh--w- c:\documents and settings\mohamed\PrivacIE
2009-09-22 00:35 . 2009-09-22 00:35 -------- d-sh--w- c:\documents and settings\mohamed\IETldCache
2009-09-22 00:33 . 2009-09-22 00:33 568 ---ha-w- C:\aaw7boot.cmd
2009-09-21 23:53 . 2009-09-21 23:57 -------- dc-h--w- c:\windows\ie8
2009-09-21 23:51 . 2009-09-24 19:06 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-21 23:47 . 2009-09-25 00:53 -------- d-----w- C:\Downloads
2009-09-21 23:16 . 2009-09-22 16:59 -------- dc----w- c:\windows\system32\DRVSTORE
2009-09-21 23:10 . 2009-09-22 16:59 -------- d-----w- c:\program files\Lavasoft
2009-09-21 23:10 . 2009-09-22 16:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-09-21 23:00 . 2009-09-21 23:00 -------- d-sh--w- c:\documents and settings\mohamed\UserData
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-25 15:02 . 2009-09-21 21:24 -------- d-----w- c:\documents and settings\mohamed\Application Data\Free Download Manager
2009-09-24 18:31 . 2009-09-21 21:15 68856 ----a-w- c:\documents and settings\mohamed\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-24 16:56 . 2009-09-21 19:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-24 16:56 . 2009-09-21 19:34 -------- d-----w- c:\program files\Intel
2009-09-24 14:37 . 2009-09-21 20:50 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-24 13:45 . 2007-04-27 02:37 71488 ----a-w- c:\windows\system32\perfc00C.dat
2009-09-24 13:45 . 2007-04-27 02:37 458648 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-21 23:05 . 2009-09-21 21:34 -------- d-----w- c:\program files\Java
2009-09-21 21:39 . 2009-09-21 21:39 -------- d-----w- c:\program files\Microsoft
2009-09-21 21:39 . 2009-09-21 21:39 -------- d-----w- c:\program files\Windows Live
2009-09-21 21:39 . 2009-09-21 21:39 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-21 21:24 . 2009-09-21 21:24 -------- d-----w- c:\program files\Free Download Manager
2009-09-21 21:24 . 2009-09-21 21:24 -------- d-----w- c:\documents and settings\All Users\Application Data\FreeDownloadManager.ORG
2009-09-21 21:15 . 2009-09-21 21:15 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-09-21 21:12 . 2009-09-21 21:12 -------- d-----w- c:\program files\Total Video Converter
2009-09-21 21:09 . 2009-09-21 21:09 -------- d-----w- c:\documents and settings\mohamed\Application Data\Nero
2009-09-21 21:08 . 2009-09-21 21:07 -------- d-----w- c:\program files\Fichiers communs\Nero
2009-09-21 21:07 . 2009-09-21 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-09-21 21:07 . 2009-09-21 21:07 -------- d-----w- c:\program files\Nero
2009-09-21 20:52 . 2009-09-21 20:52 0 ----a-w- c:\windows\nsreg.dat
2009-09-21 20:05 . 2009-09-21 20:05 -------- d-----w- c:\program files\Realtek
2009-09-21 19:58 . 2009-09-21 19:57 -------- d-----w- c:\program files\Analog Devices
2009-09-21 19:51 . 2009-09-21 19:51 -------- d-----w- c:\documents and settings\mohamed\Application Data\vlc
2009-09-21 19:50 . 2009-09-21 19:50 -------- d-----w- c:\program files\VideoLAN
2009-09-21 19:48 . 2009-09-21 19:48 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-21 19:45 . 2009-09-21 19:45 -------- d-----w- c:\program files\Marvell
2009-09-21 19:44 . 2009-09-21 19:40 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-09-21 19:24 . 2009-09-21 19:24 -------- d-----w- c:\program files\microsoft frontpage
2009-09-21 19:21 . 2009-09-21 19:21 -------- d-----w- c:\program files\Services en ligne
2009-09-21 19:18 . 2009-09-21 19:18 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-08-05 09:00 . 2007-04-27 02:37 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:35 . 2007-04-27 02:37 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:35 . 2007-04-27 02:37 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-25 03:23 . 2009-09-21 21:35 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:03 . 2007-04-27 02:37 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2007-04-27 02:37 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:57 . 2007-04-27 02:37 915456 ------w- c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-07-31 00:00 698880 ----a-w- c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files\pdfforge Toolbar\pdfforgeToolbarIE.dll" [2009-07-31 698880]
[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 1762600]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-09-22 3883856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-04 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-04 81920]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-18 995328]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 105328]
"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 226864]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 2282792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 223008]
"Corel Painter 8f"="c:\program files\Fichiers communs\Corel\Registration\FR\Registration.exe" [2003-04-06 401408]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1385808]
"SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2009-07-29 1098240]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-12-04 1695744]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-04-27 15360]
c:\documents and settings\mohamed\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2009-9-23 180224]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2009-9-23 180224]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[COLOR=RED] Les clés de Registre SafeBoot doivent être réparées. Cette machine ne peut pas utiliser le Mode Sans Échec. /COLOR
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Tools\\CD Driver asus\\ASUSACPI.exe"=
"d:\\Tools\\CD Driver asus\\Drivers\\Chipset\\Intel\\Inf\\setup.exe"=
"d:\\Tools\\CD Driver asus\\Bin\\SELECT.EXE"=
"d:\\Tools\\CD Driver asus\\Drivers\\Audio\\ADI\\32bit\\2K_XP\\AsusSetup.exe"=
"d:\\Tools\\CD Driver asus\\Drivers\\LAN\\RTL8168\\setup.exe"=
"d:\\Tools\\U1011_20070511 airpace wifi\\setup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=
"c:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Nero\\Nero8\\Nero BackItUp\\NBKeyScan.exe"=
"c:\\Program Files\\Analog Devices\\SoundMAX\\smax4.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\Calibration\\Adobe Gamma Loader.exe"=
"c:\\Program Files\\Fichiers communs\\Corel\\Registration\\FR\\Registration.exe"=
"c:\\Program Files\\Adobe\\Adobe Flash CS3\\Flash.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Fichiers communs\\Nero\\Lib\\NMIndexStoreSvr.exe"=
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\njknnn.sys --> c:\windows\system32\drivers\njknnn.sys [?]
.
Contenu du dossier 'Tâches planifiées'
2009-09-25 c:\windows\Tasks\User_Feed_Synchronization-{505B1C98-AD84-4B8D-ADA1-984149882B21}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} - hxxp://www.zorap.com/zorap_2_1_0_4.cab
FF - ProfilePath - c:\documents and settings\mohamed\Application Data\Mozilla\Firefox\Profiles\pe2ao4ll.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-25 17:13
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Heure de fin: 2009-09-25 17:15
ComboFix-quarantined-files.txt 2009-09-25 15:15
Avant-CF: 89 480 200 192 octets libres
Après-CF: 89 508 196 352 octets libres
328 --- E O F --- 2009-09-23 17:32
voila le rapport Rsit
Logfile of random's system information tool 1.06 (written by random/random)
Run by mohamed at 2009-09-25 17:19:10
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 85 GB (85%) free of 101 GB
Total RAM: 2047 MB (75% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:19:12, on 25/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\mohamed\Bureau\RSIT.exe
C:\Program Files\trend micro\mohamed.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Corel Painter 8f] C:\Program Files\Fichiers communs\Corel\Registration\FR\Registration.exe /title="Corel Painter 8" /date=100809 serial=PF08CTF-9999999-PGZ
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} (ZorapCtrl Class) - http://www.zorap.com/zorap_2_1_0_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{18BFBAFA-F934-462D-A1E8-9042EE1C734B}: NameServer = 208.67.222.222 193.55.10.102
O17 - HKLM\System\CS1\Services\Tcpip\..\{18BFBAFA-F934-462D-A1E8-9042EE1C734B}: NameServer = 208.67.222.222 193.55.10.102
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Logfile of random's system information tool 1.06 (written by random/random)
Run by mohamed at 2009-09-25 17:19:10
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 85 GB (85%) free of 101 GB
Total RAM: 2047 MB (75% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:19:12, on 25/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\mohamed\Bureau\RSIT.exe
C:\Program Files\trend micro\mohamed.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Corel Painter 8f] C:\Program Files\Fichiers communs\Corel\Registration\FR\Registration.exe /title="Corel Painter 8" /date=100809 serial=PF08CTF-9999999-PGZ
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} (ZorapCtrl Class) - http://www.zorap.com/zorap_2_1_0_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{18BFBAFA-F934-462D-A1E8-9042EE1C734B}: NameServer = 208.67.222.222 193.55.10.102
O17 - HKLM\System\CS1\Services\Tcpip\..\{18BFBAFA-F934-462D-A1E8-9042EE1C734B}: NameServer = 208.67.222.222 193.55.10.102
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
fix200
Messages postés
3243
Date d'inscription
dimanche 28 décembre 2008
Statut
Contributeur sécurité
Dernière intervention
7 février 2011
158
25 sept. 2009 à 17:21
25 sept. 2009 à 17:21
Re,
Redémarre le PC & poste un nouveau RSIT stp.
Redémarre le PC & poste un nouveau RSIT stp.
voila le rapport apres redemarage
Logfile of random's system information tool 1.06 (written by random/random)
Run by mohamed at 2009-09-25 17:24:50
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 85 GB (84%) free of 101 GB
Total RAM: 2047 MB (83% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:04, on 25/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\mohamed\Bureau\RSIT.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\trend micro\mohamed.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Corel Painter 8f] C:\Program Files\Fichiers communs\Corel\Registration\FR\Registration.exe /title="Corel Painter 8" /date=100809 serial=PF08CTF-9999999-PGZ
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} (ZorapCtrl Class) - http://www.zorap.com/zorap_2_1_0_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Logfile of random's system information tool 1.06 (written by random/random)
Run by mohamed at 2009-09-25 17:24:50
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 85 GB (84%) free of 101 GB
Total RAM: 2047 MB (83% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:04, on 25/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\mohamed\Bureau\RSIT.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\trend micro\mohamed.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Corel Painter 8f] C:\Program Files\Fichiers communs\Corel\Registration\FR\Registration.exe /title="Corel Painter 8" /date=100809 serial=PF08CTF-9999999-PGZ
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} (ZorapCtrl Class) - http://www.zorap.com/zorap_2_1_0_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
fix200
Messages postés
3243
Date d'inscription
dimanche 28 décembre 2008
Statut
Contributeur sécurité
Dernière intervention
7 février 2011
158
25 sept. 2009 à 17:43
25 sept. 2009 à 17:43
Re,
Very Good ! ^^ :)
Par-contre quelque chose qui m'énerve ...
Télécharge OTM (Old Timer) sur ton bureau:
▶ Sous XP: Double-clique sur OTM.exe afin de le lancer.
* Sous Vista: fais un clic droit sur OTM et choisis "exécuter en tant qu'administrateur"
▶ Copie (Ctrl+C) le texte suivant ci-dessous :
:Processes
explorer.exe
:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
:Commands
[start explorer]
[emptytemp]
[purity]
[reboot]
▶ Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
▶ Clique maintenant sur le bouton MoveIt! puis ferme OTM.
Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. => Accepte en cliquant sur YES.
▶ Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
* Note: Le nom du rapport correspond au moment de sa création : date_heure.log
==========
Télécharge ToolBar S&D (Team IDN )
▶ Lance l'installation du programme en exécutant le fichier téléchargé et laisse le te guider pendant l'installation ..
▶ Sous XP : Double-clique sur le raccourci de Toolbar-S&D.
▶ Sous Vista : Fais un clic droit sur le raccourci ToolbarS&D et choisis "exécuter en tant qu'administrateur"
▶ Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
▶ Tape sur "2" puis valide en appuyant sur "Entrée".
▶ ! Ne ferme pas la fenêtre lors de la suppression !
▶ Un rapport sera généré à la fin du processus : ⇒ poste son contenu dans ta prochaine réponse
Note : Si ton Bureau ne réapparaissait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..." , Tape explorer puis valide.
==========
> Désinstalle AD-Aware .
> Désinstalle les restes de Norton.
==========
Mets a jour MalwareBytes , fais un scan rapide vire ce qu'il trouve puis colle le rapport obtenu.
==========
Fais un test comme expliqué ici , puis tiens moi au courent des résultats.
==========
Refais RSIT puis colle le rapport obtenu.
==========
Very Good ! ^^ :)
Par-contre quelque chose qui m'énerve ...
Télécharge OTM (Old Timer) sur ton bureau:
▶ Sous XP: Double-clique sur OTM.exe afin de le lancer.
* Sous Vista: fais un clic droit sur OTM et choisis "exécuter en tant qu'administrateur"
▶ Copie (Ctrl+C) le texte suivant ci-dessous :
:Processes
explorer.exe
:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=-
"DisableRegistryTools"=-
:Commands
[start explorer]
[emptytemp]
[purity]
[reboot]
▶ Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
▶ Clique maintenant sur le bouton MoveIt! puis ferme OTM.
Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. => Accepte en cliquant sur YES.
▶ Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
* Note: Le nom du rapport correspond au moment de sa création : date_heure.log
==========
Télécharge ToolBar S&D (Team IDN )
▶ Lance l'installation du programme en exécutant le fichier téléchargé et laisse le te guider pendant l'installation ..
▶ Sous XP : Double-clique sur le raccourci de Toolbar-S&D.
▶ Sous Vista : Fais un clic droit sur le raccourci ToolbarS&D et choisis "exécuter en tant qu'administrateur"
▶ Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
▶ Tape sur "2" puis valide en appuyant sur "Entrée".
▶ ! Ne ferme pas la fenêtre lors de la suppression !
▶ Un rapport sera généré à la fin du processus : ⇒ poste son contenu dans ta prochaine réponse
Note : Si ton Bureau ne réapparaissait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..." , Tape explorer puis valide.
==========
> Désinstalle AD-Aware .
> Désinstalle les restes de Norton.
==========
Mets a jour MalwareBytes , fais un scan rapide vire ce qu'il trouve puis colle le rapport obtenu.
==========
Fais un test comme expliqué ici , puis tiens moi au courent des résultats.
==========
Refais RSIT puis colle le rapport obtenu.
==========
voila rapport OTM
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableRegistryTools deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
User: mohamed
->Temp folder emptied: 47979 bytes
->Temporary Internet Files folder emptied: 12322373 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 57374744 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_860.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 16384 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 66,56 mb
OTM by OldTimer - Version 3.0.0.6 log created on 09252009_174804
Files moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_860.dat moved successfully.
Registry entries deleted on Reboot...
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableRegistryTools deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
User: mohamed
->Temp folder emptied: 47979 bytes
->Temporary Internet Files folder emptied: 12322373 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 57374744 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_860.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 16384 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 66,56 mb
OTM by OldTimer - Version 3.0.0.6 log created on 09252009_174804
Files moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_860.dat moved successfully.
Registry entries deleted on Reboot...
voila!
-----------\\ ToolBar S&D 1.2.9 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 3.00GHz )
BIOS : BIOS Date: 01/30/07 15:12:28 Ver: 08.00.10
USER : mohamed ( Administrator )
BOOT : Normal boot
Antivirus : Kaspersky Anti-Virus 9.0.0.463 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:98 Go (Free:83 Go)
D:\ (Local Disk) - NTFS - Total:183 Go (Free:22 Go)
E:\ (Local Disk) - NTFS - Total:183 Go (Free:126 Go)
F:\ (CD or DVD)
G:\ (CD or DVD)
"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 25/09/2009|17:56 )
-----------\\ SUPPRESSION
Supprime! - C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
Supprime! - C:\DOCUME~1\mohamed\APPLIC~1\Search Settings\kb128
Supprime! - C:\DOCUME~1\mohamed\APPLIC~1\Search Settings
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ Extensions
(mohamed) - {9AA46F4F-4DC7-4c06-97AF-5035170634FE} => imtranslator
(mohamed) - {EF522540-89F5-46b9-B6FE-1829E2B572C6} => googlepreview
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"
--------------------\\ Recherche d'autres infections
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\mohamed\Recent\Crack.lnk
C:\DOCUME~1\mohamed\Recent\How To Crack.lnk
1 - "C:\ToolBar SD\TB_1.txt" - 25/09/2009|17:56 - Option : [2]
-----------\\ Fin du rapport a 17:56:53,29
voila adwar n'est pas sur mon ordi ni norton il son nul part je continu avec malwarbytes...
-----------\\ ToolBar S&D 1.2.9 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 3.00GHz )
BIOS : BIOS Date: 01/30/07 15:12:28 Ver: 08.00.10
USER : mohamed ( Administrator )
BOOT : Normal boot
Antivirus : Kaspersky Anti-Virus 9.0.0.463 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:98 Go (Free:83 Go)
D:\ (Local Disk) - NTFS - Total:183 Go (Free:22 Go)
E:\ (Local Disk) - NTFS - Total:183 Go (Free:126 Go)
F:\ (CD or DVD)
G:\ (CD or DVD)
"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 25/09/2009|17:56 )
-----------\\ SUPPRESSION
Supprime! - C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
Supprime! - C:\DOCUME~1\mohamed\APPLIC~1\Search Settings\kb128
Supprime! - C:\DOCUME~1\mohamed\APPLIC~1\Search Settings
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ Extensions
(mohamed) - {9AA46F4F-4DC7-4c06-97AF-5035170634FE} => imtranslator
(mohamed) - {EF522540-89F5-46b9-B6FE-1829E2B572C6} => googlepreview
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/"
--------------------\\ Recherche d'autres infections
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\mohamed\Recent\Crack.lnk
C:\DOCUME~1\mohamed\Recent\How To Crack.lnk
1 - "C:\ToolBar SD\TB_1.txt" - 25/09/2009|17:56 - Option : [2]
-----------\\ Fin du rapport a 17:56:53,29
voila adwar n'est pas sur mon ordi ni norton il son nul part je continu avec malwarbytes...
rapport malawarbytes:
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2859
Windows 5.1.2600 Service Pack 3
25/09/2009 18:26:33
mbam-log-2009-09-25 (18-26-33).txt
Type de recherche: Examen rapide
Eléments examinés: 91144
Temps écoulé: 3 minute(s), 14 second(s)
Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
C:\Documents and Settings\mohamed\Local Settings\temp\qebxg.exe (Worm.Spambot) -> Unloaded process successfully.
C:\Documents and Settings\mohamed\Local Settings\temp\ojjivl.exe (Worm.Spambot) -> Unloaded process successfully.
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\mohamed\Local Settings\temp\qebxg.exe (Worm.Spambot) -> Quarantined and deleted successfully.
C:\Documents and Settings\mohamed\Local Settings\temp\ojjivl.exe (Worm.Spambot) -> Quarantined and deleted successfully.
voila
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2859
Windows 5.1.2600 Service Pack 3
25/09/2009 18:26:33
mbam-log-2009-09-25 (18-26-33).txt
Type de recherche: Examen rapide
Eléments examinés: 91144
Temps écoulé: 3 minute(s), 14 second(s)
Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
C:\Documents and Settings\mohamed\Local Settings\temp\qebxg.exe (Worm.Spambot) -> Unloaded process successfully.
C:\Documents and Settings\mohamed\Local Settings\temp\ojjivl.exe (Worm.Spambot) -> Unloaded process successfully.
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\mohamed\Local Settings\temp\qebxg.exe (Worm.Spambot) -> Quarantined and deleted successfully.
C:\Documents and Settings\mohamed\Local Settings\temp\ojjivl.exe (Worm.Spambot) -> Quarantined and deleted successfully.
voila
pour le test
alors j'explique :
1- pour le test online :http://consultaide.e-monsite.com/rubrique,conficker-simples-tests,355935.html
la page n'apparait qu'apres un long moment et je ne voi que 6 photo un diable un pingouin..f-secur ...ect
apres sous la photo ya page blanche donc je sais pas si c bon signe
2- pour la visite des site de sécurité :
-A-Squared ................... ok
-Avast ........................... ok
-Avira Antivir....................ok
-Bit Defender.....................non :(
-Eset smart security...........reste en attente
-Kaspersky........................non :(
-Norton.............................ok
-Mc Afee...........................reste en attente
-Microsoft..........................ok mais un message me referme la page (( c:\programes files\ free download manager\firfox\extentioen\composents\composents.DLL)) n'est pas une image windows valide
-Panda Security...................reste en attente
-Trend Micro ....................reste en attente
voila tout :s
alors j'explique :
1- pour le test online :http://consultaide.e-monsite.com/rubrique,conficker-simples-tests,355935.html
la page n'apparait qu'apres un long moment et je ne voi que 6 photo un diable un pingouin..f-secur ...ect
apres sous la photo ya page blanche donc je sais pas si c bon signe
2- pour la visite des site de sécurité :
-A-Squared ................... ok
-Avast ........................... ok
-Avira Antivir....................ok
-Bit Defender.....................non :(
-Eset smart security...........reste en attente
-Kaspersky........................non :(
-Norton.............................ok
-Mc Afee...........................reste en attente
-Microsoft..........................ok mais un message me referme la page (( c:\programes files\ free download manager\firfox\extentioen\composents\composents.DLL)) n'est pas une image windows valide
-Panda Security...................reste en attente
-Trend Micro ....................reste en attente
voila tout :s
et voila le rapport Rsit
Logfile of random's system information tool 1.06 (written by random/random)
Run by mohamed at 2009-09-25 19:08:03
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 86 GB (85%) free of 101 GB
Total RAM: 2047 MB (77% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:08:06, on 25/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\windpcs.exe
C:\Documents and Settings\mohamed\Bureau\RSIT.exe
C:\Program Files\trend micro\mohamed.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Corel Painter 8f] C:\Program Files\Fichiers communs\Corel\Registration\FR\Registration.exe /title="Corel Painter 8" /date=100809 serial=PF08CTF-9999999-PGZ
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} (ZorapCtrl Class) - http://www.zorap.com/zorap_2_1_0_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{18BFBAFA-F934-462D-A1E8-9042EE1C734B}: NameServer = 208.67.222.222 193.55.10.102
O17 - HKLM\System\CS1\Services\Tcpip\..\{18BFBAFA-F934-462D-A1E8-9042EE1C734B}: NameServer = 208.67.222.222 193.55.10.102
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Logfile of random's system information tool 1.06 (written by random/random)
Run by mohamed at 2009-09-25 19:08:03
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 86 GB (85%) free of 101 GB
Total RAM: 2047 MB (77% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:08:06, on 25/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\windpcs.exe
C:\Documents and Settings\mohamed\Bureau\RSIT.exe
C:\Program Files\trend micro\mohamed.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Corel Painter 8f] C:\Program Files\Fichiers communs\Corel\Registration\FR\Registration.exe /title="Corel Painter 8" /date=100809 serial=PF08CTF-9999999-PGZ
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} (ZorapCtrl Class) - http://www.zorap.com/zorap_2_1_0_4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{18BFBAFA-F934-462D-A1E8-9042EE1C734B}: NameServer = 208.67.222.222 193.55.10.102
O17 - HKLM\System\CS1\Services\Tcpip\..\{18BFBAFA-F934-462D-A1E8-9042EE1C734B}: NameServer = 208.67.222.222 193.55.10.102
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
fix200
Messages postés
3243
Date d'inscription
dimanche 28 décembre 2008
Statut
Contributeur sécurité
Dernière intervention
7 février 2011
158
25 sept. 2009 à 21:30
25 sept. 2009 à 21:30
Re,
Il est bien coriace Kido ... tout est revenu d'un coup. :(
On va essayer autrement :
Pour Ad-aware , suis les instructions.
De même pour Norton.
============================================
Télécharge ZEB_RESTORE
ou ICI
Enregistre ce fichier sur ton bureau.
! Déconnecte toi et ferme toutes tes applications !
- Clique droit Zeb-Restore.zip ==> "Extraire tout" choisis comme lieu d'enregistrement le bureau.
- Ouvre le dossier ZR_1.0.0.37 ==> double clique sur Zeb-Restore.exe
- Coche les cases devant ( et uniquement celles-ci ! ) :
* RegEdit : réactive l'accès à RegEdit
* Gestionnaire des tâches : réactive le gestionnaire des tâches
* Policies : remet en place des éléments désactivés par "Policies"
* Sites de confiance et sensibles : efface le contenu de ces zones (à utiliser si vous êtes infecté par des malwares)
- Clique sur : " Restaurer " et laisse faire.
- Une fois fait, redémarre ton PC pour que les réparations prennent effet ...
=========
▶ Télécharge cet outil.
▶ Exécute le puis redémarre le PC.
=========
Télécharge OTM (Old Timer) sur ton bureau:
▶ Sous XP: Double-clique sur OTM.exe afin de le lancer.
* Sous Vista: fais un clic droit sur OTM et choisis "exécuter en tant qu'administrateur"
▶ Copie (Ctrl+C) le texte suivant ci-dessous :
:Processes
explorer.exe
rctn.exe
winxhpep.exe
winpdks.exe
windpcs.exe
:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=-
"DisableTaskMgr"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxqehg.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\rctn.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winyckydg.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winopmceq.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\qebxg.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winfflxk.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\mmdqk.exe"=-
:Files
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxqehg.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\rctn.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winyckydg.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winopmceq.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\qebxg.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winfflxk.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\mmdqk.exe
:Commands
[start explorer]
[emptytemp]
[purity]
[reboot]
▶ Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
▶ Clique maintenant sur le bouton MoveIt! puis ferme OTM.
Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. => Accepte en cliquant sur YES.
▶ Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
* Note: Le nom du rapport correspond au moment de sa création : date_heure.log
=========
Télécharge Dr.Web CureIt sur ton Bureau:
▶ Double clique drweb-cureit.exe et ensuite clique sur Analyse ;
▶ Clique Ok à l'invite de l'analyse rapide. Ce scan permet l'analyse des processus chargés en mémoire ; s'il trouve des processus infectés, clique le bouton Oui pour tout à l'invite.
**Note : une fenêtre s'ouvrira avec options pour "Commander" ou "50% de réduction" ; vous pouvez quitter en cliquant le "X"
▶ Lorsque le scan rapide est terminé, Clique sur le menu Options >> Changer la configuration;
▶ Choisis l'onglet "Scanner", et décoche "Analyse heuristique". Clique "Ok"
▶ De retour à la fenêtre principale : clique pour activer "Analyse complète";
▶ Clique le bouton avec flèche verte sur la droite, et le scan débutera.
▶ Clique Oui pour tout à l'invite "Désinfecter ?" lorsqu'un fichier est détecté, et ensuite clique "Désinfecter".
▶ Lorsque le scan sera complété, regarde si tu peux cliquer sur cet icône, adjacent aux fichiers détectés :
▶ Si oui, alors clique dessus et ensuite clique sur l'icône "Suivant", au dessous, et choisis Déplacer en quarantaine l'objet indésirable
▶ Du menu principal de l'outil, au haut à gauche, clique sur le menu Fichier et choisis Enregistrer le rapport
▶ Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv
▶ Ferme Dr.Web Cureit* Redémarre ton ordi (*très important*), car certains fichiers peuvent être déplacés/réparés au redémarrage.
▶ Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.
=========
Démarrer => exécuter
Tape : combofix /u
Valide par OK
ComboFix va redémarrer puis se supprimer
Fais un clic droit ici
Choisis "Enregistrer la cible du lien..." Au lieu de Combofix.exe -> Tape Moi.exe .
Clique sur "enregistrer" et laisse le téléchargement ce faire.
AVANT d'utiliser ComboFix :
▶ /!\ Déconnecte ton PC d'Internet et referme les fenêtres de tous les programmes en cours. /!\
▶ (!) Désactive provisoirement (et seulement le temps de l'utilisation de ComboFix), la protection en temps réel de ton Antivirus et de tes Antispywares et de TOUT tes logiciels de protection (!).
( Tutoriel si besoin )
▶ Double clique sur Moi.exe afin de le lancer (Sous Vista: Clique droit et choisir " Exécuter en tant qu'administrateur")
▶ Note :
Sous XP : L'outil va te demander si tu souhaite installer la console de récupération (image) .
Reconnecte toi , Puis clique sur "YES" , et une fois la console installée :
! Déconnecte toi d'internet , (très important) !
.
▶ Répond par Oui / Yes au message d'avertissement , pour que le programme commence à procéder à l'analyse du pc.
!!!!! NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS, CLAVIER.....) !!!!!
▶ A la fin du scan , il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection , laisse le travailler.
▶ Après le redémarrage du PC, un rapport s'ouvrira dans le Bloc Notes en fin d'analyse,
▶ Réactive toutes tes défenses , reviens sur le forum puis copie et colle le rapport dans ton a ta prochaine réponse
* Note :
(Le fichier rapport Combofix.txt , est ensuite automatiquement sauvegardé dans C:\Combofix.txt)
=========
Mets a jour MalwareByte's , fais un scan rapide et colle le rapport.
=========
Refais RSIT puis colle le rapport.
=========
P.S : je risque de m'absenter pour quelque raisons ; donc soit patient , utilise le pc que pour venir ici.
==========
A+ & Bon courage
Il est bien coriace Kido ... tout est revenu d'un coup. :(
On va essayer autrement :
Pour Ad-aware , suis les instructions.
De même pour Norton.
============================================
Télécharge ZEB_RESTORE
ou ICI
Enregistre ce fichier sur ton bureau.
! Déconnecte toi et ferme toutes tes applications !
- Clique droit Zeb-Restore.zip ==> "Extraire tout" choisis comme lieu d'enregistrement le bureau.
- Ouvre le dossier ZR_1.0.0.37 ==> double clique sur Zeb-Restore.exe
- Coche les cases devant ( et uniquement celles-ci ! ) :
* RegEdit : réactive l'accès à RegEdit
* Gestionnaire des tâches : réactive le gestionnaire des tâches
* Policies : remet en place des éléments désactivés par "Policies"
* Sites de confiance et sensibles : efface le contenu de ces zones (à utiliser si vous êtes infecté par des malwares)
- Clique sur : " Restaurer " et laisse faire.
- Une fois fait, redémarre ton PC pour que les réparations prennent effet ...
=========
▶ Télécharge cet outil.
▶ Exécute le puis redémarre le PC.
=========
Télécharge OTM (Old Timer) sur ton bureau:
▶ Sous XP: Double-clique sur OTM.exe afin de le lancer.
* Sous Vista: fais un clic droit sur OTM et choisis "exécuter en tant qu'administrateur"
▶ Copie (Ctrl+C) le texte suivant ci-dessous :
:Processes
explorer.exe
rctn.exe
winxhpep.exe
winpdks.exe
windpcs.exe
:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=-
"DisableTaskMgr"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxqehg.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\rctn.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winyckydg.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winopmceq.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\qebxg.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winfflxk.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe"=-
"C:\DOCUME~1\mohamed\LOCALS~1\Temp\mmdqk.exe"=-
:Files
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxqehg.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\rctn.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winyckydg.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winopmceq.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\qebxg.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winfflxk.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe
C:\DOCUME~1\mohamed\LOCALS~1\Temp\mmdqk.exe
:Commands
[start explorer]
[emptytemp]
[purity]
[reboot]
▶ Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
▶ Clique maintenant sur le bouton MoveIt! puis ferme OTM.
Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. => Accepte en cliquant sur YES.
▶ Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
* Note: Le nom du rapport correspond au moment de sa création : date_heure.log
=========
Télécharge Dr.Web CureIt sur ton Bureau:
▶ Double clique drweb-cureit.exe et ensuite clique sur Analyse ;
▶ Clique Ok à l'invite de l'analyse rapide. Ce scan permet l'analyse des processus chargés en mémoire ; s'il trouve des processus infectés, clique le bouton Oui pour tout à l'invite.
**Note : une fenêtre s'ouvrira avec options pour "Commander" ou "50% de réduction" ; vous pouvez quitter en cliquant le "X"
▶ Lorsque le scan rapide est terminé, Clique sur le menu Options >> Changer la configuration;
▶ Choisis l'onglet "Scanner", et décoche "Analyse heuristique". Clique "Ok"
▶ De retour à la fenêtre principale : clique pour activer "Analyse complète";
▶ Clique le bouton avec flèche verte sur la droite, et le scan débutera.
▶ Clique Oui pour tout à l'invite "Désinfecter ?" lorsqu'un fichier est détecté, et ensuite clique "Désinfecter".
▶ Lorsque le scan sera complété, regarde si tu peux cliquer sur cet icône, adjacent aux fichiers détectés :
▶ Si oui, alors clique dessus et ensuite clique sur l'icône "Suivant", au dessous, et choisis Déplacer en quarantaine l'objet indésirable
▶ Du menu principal de l'outil, au haut à gauche, clique sur le menu Fichier et choisis Enregistrer le rapport
▶ Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv
▶ Ferme Dr.Web Cureit* Redémarre ton ordi (*très important*), car certains fichiers peuvent être déplacés/réparés au redémarrage.
▶ Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.
=========
Démarrer => exécuter
Tape : combofix /u
Valide par OK
ComboFix va redémarrer puis se supprimer
Fais un clic droit ici
Choisis "Enregistrer la cible du lien..." Au lieu de Combofix.exe -> Tape Moi.exe .
Clique sur "enregistrer" et laisse le téléchargement ce faire.
AVANT d'utiliser ComboFix :
▶ /!\ Déconnecte ton PC d'Internet et referme les fenêtres de tous les programmes en cours. /!\
▶ (!) Désactive provisoirement (et seulement le temps de l'utilisation de ComboFix), la protection en temps réel de ton Antivirus et de tes Antispywares et de TOUT tes logiciels de protection (!).
( Tutoriel si besoin )
▶ Double clique sur Moi.exe afin de le lancer (Sous Vista: Clique droit et choisir " Exécuter en tant qu'administrateur")
▶ Note :
Sous XP : L'outil va te demander si tu souhaite installer la console de récupération (image) .
Reconnecte toi , Puis clique sur "YES" , et une fois la console installée :
! Déconnecte toi d'internet , (très important) !
.
▶ Répond par Oui / Yes au message d'avertissement , pour que le programme commence à procéder à l'analyse du pc.
!!!!! NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS, CLAVIER.....) !!!!!
▶ A la fin du scan , il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection , laisse le travailler.
▶ Après le redémarrage du PC, un rapport s'ouvrira dans le Bloc Notes en fin d'analyse,
▶ Réactive toutes tes défenses , reviens sur le forum puis copie et colle le rapport dans ton a ta prochaine réponse
* Note :
(Le fichier rapport Combofix.txt , est ensuite automatiquement sauvegardé dans C:\Combofix.txt)
=========
Mets a jour MalwareByte's , fais un scan rapide et colle le rapport.
=========
Refais RSIT puis colle le rapport.
=========
P.S : je risque de m'absenter pour quelque raisons ; donc soit patient , utilise le pc que pour venir ici.
==========
A+ & Bon courage
fix200
Messages postés
3243
Date d'inscription
dimanche 28 décembre 2008
Statut
Contributeur sécurité
Dernière intervention
7 février 2011
158
25 sept. 2009 à 21:32
25 sept. 2009 à 21:32
Re,
[Test]
Fais ceci:
https://forums.commentcamarche.net/forum/affich-14497549-ugrent-besoin-d-aide?page=2#37
[Test]
Fais ceci:
https://forums.commentcamarche.net/forum/affich-14497549-ugrent-besoin-d-aide?page=2#37
Re
1- j'ai telecharger Zrestor et j'ai effectuer la manip mais il na rien pu fair
2- safebootkey ma donné se rapport :
Reg export of SafeBoot key after repair:
========================
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]
"AlternateShell"="cmd.exe"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PEVSystemStart]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\procexp90.Sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]
@="FSFilter System Recovery"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PEVSystemStart]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\procexp90.Sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]
@="FSFilter System Recovery"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
@="Net"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
@="NetClient"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
@="NetService"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
@="NetTrans"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"
========================
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\PEVSystemStart
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\procexp90.Sys
je redemar et je continu ...a+
1- j'ai telecharger Zrestor et j'ai effectuer la manip mais il na rien pu fair
2- safebootkey ma donné se rapport :
Reg export of SafeBoot key after repair:
========================
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]
"AlternateShell"="cmd.exe"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PEVSystemStart]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\procexp90.Sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]
@="FSFilter System Recovery"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PEVSystemStart]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\procexp90.Sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]
@="FSFilter System Recovery"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]
@="Driver Group"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC]
@="Service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
@="Net"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
@="NetClient"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
@="NetService"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
@="NetTrans"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"
========================
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\PEVSystemStart
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\procexp90.Sys
je redemar et je continu ...a+
Re voici le rapport du OTM:
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named rctn.exe was found!
No active process named winxhpep.exe was found!
No active process named winpdks.exe was found!
No active process named windpcs.exe was found!
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxqehg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\rctn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winyckydg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winopmceq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\qebxg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winfflxk.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\mmdqk.exe deleted successfully.
========== FILES ==========
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxqehg.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\rctn.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winyckydg.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winopmceq.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\qebxg.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winfflxk.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\mmdqk.exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
User: mohamed
->Temp folder emptied: 138462 bytes
->Temporary Internet Files folder emptied: 44557818 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 11895861 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_fc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 32768 bytes
RecycleBin emptied: 74505 bytes
Total Files Cleaned = 54,10 mb
OTM by OldTimer - Version 3.0.0.6 log created on 09262009_203618
Files moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_fc.dat moved successfully.
Registry entries deleted on Reboot...
je continu....
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named rctn.exe was found!
No active process named winxhpep.exe was found!
No active process named winpdks.exe was found!
No active process named windpcs.exe was found!
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxqehg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\rctn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winyckydg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winopmceq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\qebxg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winfflxk.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\mohamed\LOCALS~1\Temp\mmdqk.exe deleted successfully.
========== FILES ==========
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxqehg.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\rctn.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winyckydg.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winopmceq.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\qebxg.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winfflxk.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winxhpep.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\winpdks.exe not found.
File/Folder C:\DOCUME~1\mohamed\LOCALS~1\Temp\mmdqk.exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
User: mohamed
->Temp folder emptied: 138462 bytes
->Temporary Internet Files folder emptied: 44557818 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 11895861 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_fc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied: 32768 bytes
RecycleBin emptied: 74505 bytes
Total Files Cleaned = 54,10 mb
OTM by OldTimer - Version 3.0.0.6 log created on 09262009_203618
Files moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_fc.dat moved successfully.
Registry entries deleted on Reboot...
je continu....
