Probleme virus

Fermé
ben06 - 29 oct. 2009 à 20:51
 ben06 - 2 nov. 2009 à 22:08
Bonjour,
je nrrive pas a supprimer plusieurs virus ainfo.txt logfile of random's system information tool 1.06 2009-10-27 18:08:09
si quelqu un peut m aider merci d avance de plus je ne peut pas formater mon disque c anti virus inactif ni msn impossible a reinstaller

======Uninstall list======

-->"C:\Program Files\Creative\SBAudigy2\Program\Ctzapxx.EXE" /U /S /L:FRN
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 5.0 Sprint-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A92000000001}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Azureus-->C:\Program Files\Azureus\Uninstall.exe
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Dell AIO Printer A920-->C:\WINDOWS\System32\spool\drivers\w32x86\3\DLBKUN5C.EXE -dDell AIO Printer A920
Dell ResourceCD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD Region+CSS Free 5.9.8.3-->"C:\Program Files\DVD Region+CSS Free\unins000.exe"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Hercules Deluxe Optical Glass-->C:\Program Files\InstallShield Installation Information\{56298F72-C2CC-4FE5-ACEA-30C7A866BF4C}\setup.exe -runfromtemp -l0x040c -removeonly
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
ImgBurn 2.3.2.0 Fr-->"C:\Program Files\ImgBurn\unins000.exe"
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Intel(R) PRO Network Adapters and Drivers-->Prounstl.exe
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
K-Lite Mega Codec Pack 3.8.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
livebox-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe" -l0x40c
Logitech Harmony Remote Software 7-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C6F884D-680C-448B-B4C9-22296EE1B206}\setup.exe" -l0x40c -removeonly
Luxor Mega Pack-->"C:\WINDOWS\Luxor Mega Pack\uninstall.exe" "/U:C:\Program Files\Luxor Mega Pack\Uninstall\uninstall.xml"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Search Enhancement Pack-->MsiExec.exe /I{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB971930)-->"C:\WINDOWS\ie8updates\KB971930-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
Mozilla Firefox (2.0.0.14)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
Nero 9-->C:\Program Files\Fichiers communs\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER="9M03-01A1-PCX7-K31A-8A94-98PT-KT2E-522A"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
OpenOffice.org 3.1-->MsiExec.exe /I{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}
Original-Solitaire-->C:\Program Files\Original-Solitaire\uninst.exe
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
Remote Control USB Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8471021C-F529-43DE-84DF-3612E10F58C4}\setup.exe" -l0x9 -removeonly
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Sound Blaster Audigy 2-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E82BF103-904F-49C0-B77F-6EC110B71E87}\SETUP.EXE" -l0x40c
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VLC media player 1.0.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vuze-->C:\Program Files\Azureus\uninstall.exe
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D5D81435-B8DE-4CAF-867F-7998F2B92CFC}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
Windows Live Writer-->MsiExec.exe /X{4634B21A-CC07-4396-890C-2B8168661FEA}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Zuma's Revenge!-->"C:\WINDOWS\Zuma's Revenge!\uninstall.exe" "/U:C:\Program Files\Zuma's Revenge!\Uninstall\uninstall.xml"

======System event log======

Computer Name: DELL
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 1516776
Source Name: Tcpip
Time Written: 20091002120049.000000+120
Event Type: Avertissement
User:

Computer Name: DELL
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 1516775
Source Name: Tcpip
Time Written: 20091002113055.000000+120
Event Type: Avertissement
User:

Computer Name: DELL
Event Code: 7036
Message: Le service HTTP SSL est entré dans l'état : en cours d'exécution.

Record Number: 1516774
Source Name: Service Control Manager
Time Written: 20091002094544.000000+120
Event Type: Informations
User:

Computer Name: DELL
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service HTTP SSL.

Record Number: 1516773
Source Name: Service Control Manager
Time Written: 20091002094544.000000+120
Event Type: Informations
User: AUTORITE NT\SERVICE LOCAL

Computer Name: DELL
Event Code: 7036
Message: Le service Carte de performance WMI est entré dans l'état : arrêté.

Record Number: 1516772
Source Name: Service Control Manager
Time Written: 20091002085922.000000+120
Event Type: Informations
User:

=====Application event log=====

Computer Name: DELL
Event Code: 1
Message:
Record Number: 20383
Source Name: nview_info
Time Written: 20090722074058.000000+120
Event Type: erreur
User:

Computer Name: DELL
Event Code: 1
Message:
Record Number: 20382
Source Name: nview_info
Time Written: 20090722074056.000000+120
Event Type: erreur
User:

Computer Name: DELL
Event Code: 1
Message:
Record Number: 20381
Source Name: nview_info
Time Written: 20090722074056.000000+120
Event Type: erreur
User:

Computer Name: DELL
Event Code: 1
Message:
Record Number: 20380
Source Name: nview_info
Time Written: 20090722074056.000000+120
Event Type: erreur
User:

Computer Name: DELL
Event Code: 1
Message:
Record Number: 20379
Source Name: nview_info
Time Written: 20090722074056.000000+120
Event Type: erreur
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Samsung\Samsung PC Studio 3\C:\Program Files\DMV\MaxTV4\plugins;
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------
rrive pas a supprimer plusieurs virus Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3038
Windows 5.1.2600 Service Pack 3 (Safe Mode)

27/10/2009 09:45:03
mbam-log-2009-10-27 (09-45-03).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 149132
Temps écoulé: 20 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 10
Fichier(s) infecté(s): 229

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\sK9Ou0s (Worm.Bagle) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\srosa (Worm.Bagle) -> Delete on reboot.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flec003.exe (Email.Worm) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\drvsyskit (Worm.Bagle) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\german.exe (Worm.Bagle) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mule_st_key (Worm.Bagle) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\carole\Application Data\drivers\downld (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\Incoming (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\lang (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\skins (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\Temp (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\WDIR (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\webserver (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m (Trojan.Agent) -> Delete on reboot.

Fichier(s) infecté(s):
C:\Documents and Settings\carole\Application Data\hidires\flec003.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\117593.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\118734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\121218.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\129265.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\133734.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\135562.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\144562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\150796.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\151281.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\154750.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\154890.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\159515.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\181109.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\184359.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\193562.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\196890.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m\flec006.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP390\A0077406.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP390\A0077407.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP391\A0077524.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP391\A0077525.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP391\A0077526.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077636.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077637.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077638.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077650.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077651.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077652.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077667.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077668.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0FE7D1EB-499E-401E-AAAA-85BEAF87460A}\RP392\A0077669.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mdelk.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wintems.exe (Email.Worm) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\119265.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\123156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\124484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\125531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\127390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\131203.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\142062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\142250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\142468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\147312.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\150750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\155562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\164812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\171796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\171984.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\172046.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\173828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\184828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\185296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\185750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\186375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\186828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\186859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\194375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\195437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\195937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\196750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\196812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\207515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\208578.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\208781.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209187.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\209734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\225390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\225734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\225875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\226156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\227031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\227109.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\228078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\229140.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\229937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\230796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\230890.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\243562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\245062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\246562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\247406.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\248093.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\248218.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\261968.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\262359.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\263000.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\263625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\264281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\264656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\264984.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\265281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\265796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\282437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\283937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\284906.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\329359.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\330296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\330437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\330968.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\331515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\331609.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\346171.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\346734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\346828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\347203.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\347468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\353000.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\353671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\353843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\354484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\355156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\355328.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\355703.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\356734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\356937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\357890.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\358734.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\358875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\361562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\362250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\362406.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\368843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\369765.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\370031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\373484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\374078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\374234.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\375593.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376171.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376250.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\376953.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\391468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\392796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\393031.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\394656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\396296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\396578.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\401718.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\403125.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\403281.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\405921.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\406484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\407781.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\408109.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\410187.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\410312.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\415437.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\416390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\416562.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\419484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\420375.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\420656.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\421265.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\422921.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\423828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\423859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\424109.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\424156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\424718.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\425812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\426531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\428468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\429875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\430531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\435171.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\436593.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\436843.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\449531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\450468.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\450515.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\456859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\457984.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\458156.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\458937.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\460484.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\461421.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\469125.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\469875.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\469968.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\510203.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\516796.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\529359.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\531187.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\531953.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\545296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\556453.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\557390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\566390.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\567750.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\568265.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\581062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\583625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\592953.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\594765.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\595234.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\692546.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\695000.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\705062.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\706812.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\downld\707296.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\downloads.bak (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\downloads.txt (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\file.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\names.txt (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\server.txt (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\cancelled.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\clients.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\clients.met.bak (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\cryptkey.dat (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\emfriends.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\known.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\known2_64.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\preferences.ini (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\server.met (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\server_met.old (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\config\statistics.ini (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\WDIR\EnviroDuck Carbon Footprint Calculator 1.0.zip (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\WDIR\Mp3 Editor for Free 3.2.7 Build 79.czip (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\hidires\WDIR\WhenOnEarth 1.10.zip (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\carole\Application Data\drivers\winupgro.exe (Trojan.Agent) -> Quarantined and deleted successfully.

31 réponses

jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
29 oct. 2009 à 20:54
Hello ;

? Télécharge FindyKill de Chiquitine29 sur ton bureau :

http://pagesperso-orange.fr/NosTools/Chiquitine29/FindyKill.exe

! Déconnecte toi et ferme toutes applications en cours !

• Double clique sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut .

• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

• Double-clique sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .

• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

• Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

? Laisse travailler l'outil et ne touche à rien ...

--> Poste le rapport qui apparait à la fin , sur le forum ...

( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html
1
merci pour ta ponse rapide voila le rapport


----------------- FindyKill V4.005 ------------------

* User : carole - DELL
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 17/10/08 par Chiquitine29
* Recherche effectuée à 21:05:17 le 29/10/2009
* Windows XP - Internet Explorer 8.0.6001.18702

((((((((((((((((( *** Recherche *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Hercules\Deluxe Optical Glass\Camservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\carole\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
C:\Program Files\Internet Explorer\iexplore.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Presence des fichiers dans C:


»»»» Presence des fichiers dans C:\WINDOWS


»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Present ! - C:\WINDOWS\prefetch\MDELK.EXE-238AA5EF.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Présent ! - C:\WINDOWS\system32\ban_list.txt

»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers


»»»» Presence des fichiers dans C:\Documents and Settings\carole\Application Data

Présent ! - "C:\Documents and Settings\carole\Application Data\m\shared"
Présent ! - "C:\Documents and Settings\carole\Application Data\m"

»»»» Presence des fichiers dans C:\DOCUME~1\carole\LOCALS~1\Temp


--------------- [ Registre / Startup ] ----------------


! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Dell AIO Printer A920 REG_SZ "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
CTHelper REG_SZ CTHELPER.EXE
AsioReg REG_SZ REGSVR32.EXE /S CTASIO.DLL
UpdReg REG_SZ C:\WINDOWS\UpdReg.EXE
nwiz REG_SZ nwiz.exe /install
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
CamserviceDeluxe2 REG_SZ C:\Program Files\Hercules\Deluxe Optical Glass\Camservice.exe /startup
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
Malwarebytes Anti-Malware (reboot) REG_SZ "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
Malwarebytes' Anti-Malware REG_SZ "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
plusgrid REG_SZ C:\DOCUME~1\carole\APPLIC~1\POPPOL~1\stupid browse.exe
Skype REG_SZ "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

--------------- [ Registre / Clés infectieuses ] ----------------


Présent ! - HKEY_USERS\S-1-5-21-1409082233-606747145-725345543-1004\Software\bisoft
Présent ! - HKEY_USERS\S-1-5-21-1409082233-606747145-725345543-1004\Software\DateTime4
Présent ! - HKEY_USERS\S-1-5-21-1409082233-606747145-725345543-1004\Software\MuleAppData
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Présent ! - HKEY_CURRENT_USER\Software\bisoft
Présent ! - HKEY_CURRENT_USER\Software\DateTime4

--------------- [ Etat / Services ] ----------------


+- Services : [ Auto=2 Demande=3 Désactivé=4 ]

Ndisuio - Type de démarrage = 3

EapHost - Type de démarrage = 3

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4



--------------- [ Recherche dans supports amovibles] ----------------


+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

G: - Lecteur de CD-ROM


+- Contenu de l'autorun : G:\autorun.inf

[Autorun]
open=setup.exe
icon=setup.exe,0

+- presence des fichiers :

Présent ! - G:\autorun.inf


--------------- [ Registre / Moutpoint2 ] ----------------


-> Recherche négative.


------------------- ! Fin du rapport ! --------------------
0
un petit coup de malwarebytes et de ccleaner pourront t'aider(je ne suis pas un expert pour autant)
0
jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
29 oct. 2009 à 20:59
Carmax: Malware'sByte's a déja été passé ,le rapport est juste au dessus .....^^
0
jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
29 oct. 2009 à 22:52
! Déconnecte toi et ferme toutes application en cours ( navigateur compris ) .

• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

• Relance "FindyKill" : au menu principal choisis l'option " F " pour français et tape sur [entrée] .

• Au second menu choisis l'option 2 (suppression) et tape sur [entrée]

• Le pc va redémarrer automatiquement ...

? le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

--> Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide

Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html

=====================
Télécharges ComboFix à partir d'un de ces liens :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Et important, enregistre le sur le bureau.

Avant d'utiliser ComboFix :

? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
la protection en temps réel de ton Antivirus et de tes Antispywares,
qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

/!\Renomme combofix.exe en scan.exe/!\

Une fois fait, sur ton bureau double-clic sur scan.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
est automatiquement sauvegardé et rangé à C:\Combofix.txt)

? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
avant de te reconnecter à internet.

? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
voila le rapport

----------------- FindyKill V4.005 ------------------

* User : carole - DELL
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 17/10/08 par Chiquitine29
* Suppression effectuée à 6:08:45 le 30/10/2009
* Windows XP - Internet Explorer 8.0.6001.18702


((((((((((((((( *** Suppression *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\imapi.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Suppression des fichiers dans C:


»»»» Suppression des fichiers dans C:\WINDOWS


»»»» Suppression des fichiers dans C:\WINDOWS\Prefetch

Supprimé ! - C:\WINDOWS\Prefetch\STUPID~1.EXE-20694082.pf
Supprimé ! - C:\WINDOWS\Prefetch\ACRORD32.EXE-3A1F13AE.pf
Supprimé ! - C:\WINDOWS\Prefetch\LOGTRANSPORT2.EXE-1203B684.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-12E27DD0.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-13E68835.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-147710F4.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-17047A92.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-1714B23E.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-1857459C.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-22E35C38.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-24060C3D.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-2576181F.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-268BFF96.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-2BAAB719.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-2E8940CC.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-35A483DA.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-3A556696.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-41533247.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-4489B61B.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-45E9EA1E.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-485C3FD9.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-4996EB1F.pf
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-4AF8E1D6.pf
Supprimé ! - C:\WINDOWS\Prefetch\SNDVOL32.EXE-383480B7.pf
Supprimé ! - C:\WINDOWS\Prefetch\I4JDEL0.EXE-1F4AA859.pf
Supprimé ! - C:\WINDOWS\Prefetch\WINTEMS.EXE-26D98C75.pf
Supprimé ! - C:\WINDOWS\Prefetch\MDELK.EXE-238AA5EF.pf

»»»» Suppression des fichiers dans C:\WINDOWS\system32

Supprimé ! - C:\WINDOWS\system32\ban_list.txt

»»»» Suppression des fichiers dans C:\WINDOWS\system32\drivers


»»»» Suppression des fichiers dans C:\Documents and Settings\carole\Application Data

Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\1Z0-131_-_Oracle_9i_Build_Internet_Applications_I_Practice_Test_Questions_1.0_[Key].zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\3D_Browser_Pro_6.1_With_Crack.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\@PROMT English-French Professional Translator 7.0 [KeyGen].zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\A-FF Repair Station 4.3.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\A1Click Ultra PC Cleaner 1.01.65.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\ABC_Amber_Advantage_Converter_2.11.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Access_Denied_3.40.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Account_Pro_8.3.120.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Ad-Aware_VX2_Cleaner_Plug-In_2.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Agile MOV Video Converter 3.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\AllSeaSaver 2.5.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\American Idol News.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Animated Paddy Cheers Screensaver 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Antivirus.NOD32.con.crack(Todas.las.versiones).zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Archive Creator 2.0.3.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Archiver_4.0.0_(Key).zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Aston Martin Rapide Screensaver.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\AVTJet Video Studio 2.3.3.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\AxFormExtender 1.5.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Barbie Collectors Desktop 1.0.0.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\BizPix_Gold_2.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Buffer Synth 1.10.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Car Insurance and Automobile Manager 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Cats 3 Screensaver.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Cheers! Blood Alcohol Calculator 2.3 (Cracked).zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Christmas_Music_Player_4.0.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Cleantouch_Trading_Control_System_Professional_Edition_2.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\ClockWatch_Radio_Sync_Server_3.0.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\CS Contact Manager 1.1.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\DF_ProtectionKit 6.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Directory_Classifier_2.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\DiscoDSP_Discovery_2.7.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\DiskSpy_Free_Edition_2.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\DLLfunctions 1.01.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\dlTube Toolbar 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\EasyNN-plus_8.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\EDraw_Flowchart_Software_2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Elite Utilities 9 Professional 9.2.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\eXmedia_Player_4.192_(With_Crack).zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\FastRun 1.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\FileCopier 1.0.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Fire the Grid Countdown 2.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\FirmTools ShellExtension 2.0 Build 313.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Flash_LipSync_1.02.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Flight_Simulator_2002_Sukhoi_SU-29_Model.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\FreeFixer_0.19.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Fx Joiner and Splitter 6.2.10 Cracked.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\GML Undistorter 1.05.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Google Video 1.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\GridinSoft_Notepad_3.2.3.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Hellbender_demo_1.01.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\HelpTrans_1.01.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Hit_Discovery_1.0_(Crack).zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Horror_Time_2.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Hotbid auction marketing analyst 4.0.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\HP0-606_Free_Test_Exam_Questions_10.0_[Crack].zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\HP0-697 Free Test Exam Questions 10.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\HTMLa_v1.0_Key+Serial.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\IcoFX_1.5.01.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\iLead DVD Audio Ripper 4.1.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Imperial_Screen_Saver_1.00.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\ImpressCMS 1.0 Beta 2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Industry 3 Icon Collection 1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Install Partner 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Internet_Access_Monitor_for_MS_ISA_Server_3.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\KDT_Site_Blocker_2.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Kiara 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\KooMail 2.96.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Learn_Chinese_Characters_1.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Love Spells 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Luach 1.1.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Meddle 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Media Player 5.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\mediaExplorer 2004.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Melbourne_Tram_and_Trains_0.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Microsoft Hyper-V Server 2008 R2 RC.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Microsoft_PowerPoint_Helper_1.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\MSC_Wave_Killer_2.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\MSD Employees Multiuser 2.00.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\msgdetach_1.5.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Music Organizer Program 9.26.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\MX Skype Recorder 3.5.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\My_Simple_Desktop_Office_Edition_1.0.1_[KeyGen].zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\NameSaver_1.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\News_File_Grabber_4.5.0.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Nidesoft DVD to 3GP Converter 3.0.80.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Objectreferenceanalyser_1.01.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\OraPiper_1.00_Serial.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Paragon_Encrypted_Disk_SE_3.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\PeerGuardian 2.0 RC1 Test 2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Phobia_Dictionary_1_[Key].zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Portable Jarte 3.3.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Pregnancy_Calculator_2.72.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Pronoleague - Ligue 1 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Psi3 1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Qedoc Author 1.02.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\RB Code Reports 1.5.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Rental_Property_Tracker_Plus_(OS_X)_1.8.6.2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Report_Maker_4.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\RSS_Feeder_3.2.3.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\RuneScape_News_Viewer_1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Schedule24 Professional 3.1.0.10.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Send To Printer 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Shopping_Directory_1.01.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Shrink It! 1.0 Beta 2.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\SimpleMagnifier_1.0.48.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\SiteInFile_Compiler_1.1.0.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Smart_PSP_Converter_1.0_(Crack).zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\SoftPerfect_Bandwidth_Manager_Lite_2.5_build_350_[Serial].zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Sonic_Alpha_Style_Control_1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\SpongeBob_SquarePants_Jellyfish_Shuffleboard_1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\StumbleUpon Toolbar For Internet Explorer 3.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Sum Quick Launcher 2.1.1.8.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Surf It! Browser 15.06.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\SyncBackSE_4.2.4.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Taj Mahal 3D 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Text2GED_1.1_Key.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\The Astrology Program 1.4.6 (With Crack).zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\TXTEditor+ 1.1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Ultimate_Quest_Bundle_Jewel_Quest_&_Mahjong_Quest_1.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Ultra Crpto Component 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Urban_Chaos_demo.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\WinACCESS 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Word Processor Advance 1.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\XBN Java 0.9b.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\Yale toolbar for IE 4.5.131.0.zip
Supprimé ! - C:\Documents and Settings\carole\Application Data\m\shared\You've Got Mail 1.2 build 1008.zip
Supprimé ! - "C:\Documents and Settings\carole\Application Data\m\shared"
Supprimé ! - "C:\Documents and Settings\carole\Application Data\m"

»»»» Suppression des fichiers dans C:\DOCUME~1\carole\LOCALS~1\Temp


--------------- [ Registre / Clés infectieuses ] ----------------

Supprimé ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Supprimé ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Supprimé ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Supprimé ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Supprimé ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA

-> Certaines clés ont été supprimées au premier reboot ...

--------------- [ Etat / Redémarage des services ] ----------------

+- Mode sans echec restauré !

+- Services : [ Auto=2 Demande=3 Désactivé=4 ]

Ndisuio - Type de démarrage = 2

EapHost - Type de démarrage = 2

Wlansvc - Type de démarrage = 2

Ip6Fw - Type de démarrage = 2

SharedAccess - Type de démarrage = 2

wuauserv - Type de démarrage = 2

wscsvc - Type de démarrage = 2


--------------- [ Nettoyage des supports amovibles ] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe


+- Suppression des fichiers :


--------------- [ Registre / Moutpoint2 ] ----------------


-> Recherche négative.


--------------- [ Recherche Cracks / Keygen ] ----------------

C:\Documents and Settings\carole\Bureau\cle usb melo\photoshop cs3\photoshop dernier\ADOBE PHOTOSHOP CS3 EXTENDED FRENCH\Keygens
C:\Documents and Settings\carole\Bureau\cle usb melo\photoshop cs3\photoshop dernier\ADOBE PHOTOSHOP CS3 EXTENDED FRENCH\Keygens\Adobe[1].Photoshop.CS3.Extended.Keymaker.Only-ZWT
C:\Documents and Settings\carole\Bureau\cle usb melo\photoshop cs3\photoshop dernier\ADOBE PHOTOSHOP CS3 EXTENDED FRENCH\Keygens\PhotoShop.CS3.Extended.Keygen+Activation
C:\Documents and Settings\carole\Bureau\cle usb melo\photoshop cs3\photoshop dernier\ADOBE PHOTOSHOP CS3 EXTENDED FRENCH\Keygens\Adobe[1].Photoshop.CS3.Extended.Keymaker.Only-ZWT\file_id.diz
C:\Documents and Settings\carole\Bureau\cle usb melo\photoshop cs3\photoshop dernier\ADOBE PHOTOSHOP CS3 EXTENDED FRENCH\Keygens\Adobe[1].Photoshop.CS3.Extended.Keymaker.Only-ZWT\zwt.nfo
C:\Documents and Settings\carole\Bureau\cle usb melo\photoshop cs3\photoshop dernier\ADOBE PHOTOSHOP CS3 EXTENDED FRENCH\Keygens\PhotoShop.CS3.Extended.Keygen+Activation\Filler.wav


---------------- ! Fin du rapport ! ------------------
0
ComboFix 09-10-28.08 - carole 30/10/2009 6:30.1.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1535.1142 [GMT 1:00]
Lancé depuis: c:\documents and settings\carole\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Il y a peut-être des sites infectés -----

hxxp://www.nicematin.com
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SK9OU0S
-------\Legacy_SROSA


((((((((((((((((((((((((((((( Fichiers créés du 2009-09-28 au 2009-10-30 ))))))))))))))))))))))))))))))))))))
.

2009-10-29 20:04 . 2009-10-30 05:10 -------- d-----w- c:\program files\FindyKill
2009-10-29 17:54 . 2009-10-29 17:54 -------- d-----w- c:\windows\Performance
2009-10-29 17:54 . 2009-10-29 17:54 -------- d-----w- c:\documents and settings\carole\Local Settings\Application Data\Microsoft Corporation
2009-10-29 17:54 . 2009-10-29 18:05 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-10-27 22:08 . 2009-10-27 22:08 -------- d-----w- c:\documents and settings\carole\Application Data\VitySoft
2009-10-27 19:47 . 2009-10-29 18:28 -------- d-----w- c:\documents and settings\carole\Application Data\skypePM
2009-10-27 19:47 . 2009-10-27 19:47 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-27 19:39 . 2009-10-30 05:03 -------- d-----w- c:\documents and settings\carole\Application Data\Skype
2009-10-27 19:38 . 2009-10-27 19:38 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-10-27 19:38 . 2009-10-27 19:39 -------- d-----r- c:\program files\Skype
2009-10-27 19:38 . 2009-10-27 19:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-27 17:07 . 2009-10-27 17:08 -------- d-----w- C:\rsit
2009-10-27 17:07 . 2009-10-27 17:08 -------- d-----w- c:\program files\trend micro
2009-10-27 16:08 . 2009-08-05 21:48 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-10-27 16:08 . 2009-10-27 17:29 -------- d-----w- c:\program files\Windows Live
2009-10-27 16:07 . 2009-10-27 16:07 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-10-27 16:07 . 2009-10-27 16:07 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-10-27 08:57 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-10-27 08:57 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-10-27 08:56 . 2009-10-27 08:56 -------- d-----w- c:\program files\Alwil Software
2009-10-27 08:15 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-27 08:15 . 2009-10-27 08:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-27 08:15 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-27 08:11 . 2009-10-27 17:50 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-10-27 00:51 . 2009-10-27 01:11 -------- d-----w- c:\windows\SxsCaPendDel
2009-10-26 23:46 . 2009-10-26 23:46 855991 -c----w- c:\windows\system32\dllcache\npds.zip
2009-10-26 23:46 . 2009-10-26 23:46 834328 -c----w- c:\windows\system32\dllcache\npdrmv2.zip
2009-10-26 23:19 . 2009-10-27 01:12 -------- d-----w- c:\program files\Registry Winner
2009-10-26 23:13 . 2009-10-27 14:43 119188 ----a-w- c:\windows\system32\wfsintwq.sys
2009-10-26 23:13 . 2009-10-27 14:43 7168 ----a-w- c:\windows\system32\srosa2.sys
2009-10-26 23:08 . 2009-10-27 17:24 -------- d--h--w- c:\documents and settings\carole\Application Data\drivers
2009-10-26 15:49 . 2009-10-26 15:49 -------- d-----w- c:\program files\Pop Poll Rect
2009-10-26 15:48 . 2009-10-26 15:49 -------- d-----w- c:\documents and settings\All Users\Application Data\great coal love default
2009-10-26 15:48 . 2009-10-26 15:50 -------- d-----w- c:\documents and settings\carole\Application Data\Pop Poll Rect
2009-10-25 16:32 . 2009-10-25 16:32 -------- d-----w- c:\documents and settings\carole\Application Data\PlayFirst
2009-10-25 16:32 . 2009-10-25 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\GamesBar
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\Oberon Media
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\Fichiers communs\Oberon Media
2009-10-16 01:26 . 2009-10-16 01:26 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-11 08:14 . 2009-10-29 18:59 -------- d-----w- c:\documents and settings\carole\Application Data\vlc
2009-10-04 18:34 . 2009-10-04 18:34 -------- d-----w- c:\program files\Microsoft
2009-09-30 11:21 . 2009-09-30 11:21 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-30 10:04 . 2009-10-18 08:27 -------- d-----w- c:\windows\system32\NtmsData

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-30 05:35 . 2009-01-16 15:33 288 ----a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-30 05:35 . 2009-01-16 15:33 288 ----a-w- c:\windows\system32\DVCState-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-30 05:28 . 2003-07-22 16:49 510204 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-30 05:28 . 2003-07-22 16:49 85304 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-29 22:04 . 2009-09-16 17:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-29 18:47 . 2009-01-16 18:43 -------- d-----w- c:\documents and settings\carole\Application Data\Azureus
2009-10-27 19:39 . 2009-01-18 10:21 -------- d-----w- c:\program files\Google
2009-10-27 17:51 . 2009-01-16 15:44 -------- d-----w- c:\program files\AVG
2009-10-27 16:02 . 2009-07-18 07:50 -------- d-----w- c:\documents and settings\carole\Application Data\Media Player
2009-10-26 05:17 . 2009-07-18 07:41 -------- d-----w- c:\program files\Orange
2009-10-16 11:23 . 2009-01-16 18:38 -------- d-----w- c:\program files\Azureus
2009-10-15 06:56 . 2009-01-21 17:21 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-16 17:19 . 2009-09-16 17:17 -------- d-----w- c:\program files\Zuma's Revenge!
2009-09-13 08:39 . 2009-01-16 14:59 -------- d-----w- c:\program files\Dell AIO Printer A920
2009-09-11 14:18 . 2003-07-22 16:44 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 21:47 . 2009-06-06 06:06 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-04 21:04 . 2003-07-22 16:42 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2003-07-22 17:01 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:01 . 2003-07-22 16:56 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-22 01:19 . 2009-01-16 15:22 17864 -c--a-w- c:\documents and settings\carole\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-06 17:24 . 2009-01-16 15:15 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2009-01-16 15:15 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2009-01-16 15:15 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 17:24 . 2008-10-16 13:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2009-01-16 14:37 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2003-07-22 16:31 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2009-01-16 15:15 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2009-03-26 03:36 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-06 17:23 . 2009-03-26 03:36 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-06 17:23 . 2009-01-16 14:37 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:00 . 2003-07-22 16:45 205312 -c--a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 20:58 . 2003-07-22 16:48 2191232 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 17:28 . 2002-08-29 11:42 2068096 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-28 11:25 . 2009-01-16 16:01 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-10-28 11:25 . 2009-01-16 16:01 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-10-28 11:25 . 2009-01-16 16:01 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-10-28 11:25 . 2009-01-16 16:01 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-10-28 11:25 . 2009-01-16 16:01 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 -c--a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 -c--a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"plusgrid"="c:\docume~1\carole\APPLIC~1\POPPOL~1\stupid browse.exe" [2009-10-26 434176]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"Dell AIO Printer A920"="c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-06-02 270336]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"CamserviceDeluxe2"="c:\program files\Hercules\Deluxe Optical Glass\Camservice.exe" [2007-08-10 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2003-02-20 28672]
"AsioReg"="CTASIO.DLL" - c:\windows\system32\CTASIO.DLL [2003-02-20 110592]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-03 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\progra~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Hercules\\Deluxe Optical Glass\\Station2.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Hercules\\Deluxe Optical Glass\\ControlUI.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [27/10/2009 17:08 54752]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [27/10/2009 09:15 269648]
R3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [12/03/2009 19:19 94720]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27/10/2009 09:15 19160]
S2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [22/07/2003 17:56 14336]
S3 APL531;Hercules Dualpix HD Webcam;c:\windows\system32\Drivers\HDvid.sys --> c:\windows\system32\Drivers\HDvid.sys [?]
S3 camfilt;camfilt;c:\windows\system32\Drivers\camfilt.sys --> c:\windows\system32\Drivers\camfilt.sys [?]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\drivers\rcblan.sys [03/04/2009 15:49 39704]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - MBR
*NewlyCreated* - WLANSVC
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
.
Contenu du dossier 'Tâches planifiées'

2009-10-30 c:\windows\Tasks\Malwarebytes' Scheduled Update for carole.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-27 13:53]

2009-10-30 c:\windows\Tasks\User_Feed_Synchronization-{F6A67EAF-6081-4907-B7D9-A0AAEA79BC17}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_8971.cab
FF - ProfilePath - c:\documents and settings\carole\Application Data\Mozilla\Firefox\Profiles\u1ugs6mn.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://fr.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-30 06:37
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3840)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSFR.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\System32\SCardSvr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\System32\vssvc.exe
c:\program files\Dell AIO Printer A920\dlbkbmon.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\windows\system32\rundll32.exe
c:\documents and settings\carole\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\Adobe\Reader 9.0\Reader\LogTransport2.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\windows\System32\rundll32.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Heure de fin: 2009-10-30 6:41 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-10-30 05:41

Avant-CF: 26 449 768 448 octets libres
Après-CF: 26 389 815 296 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn

- - End Of File - - 5E9B37B8BF4E4D2D378442E691B936EF
merci pour vos conseil mais je ne peut toujours pas installer l antivirus
0
au cours de l instalations j ai ce message d erreur Erreur: Echec de l'opération clé de registre HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: création d'une clé de registre....
Accès refusé.
0
sKe69 Messages postés 21360 Date d'inscription samedi 15 mars 2008 Statut Contributeur sécurité Dernière intervention 30 décembre 2012 463
30 oct. 2009 à 09:14
Salut,


pour JFK :


----------------- FindyKill V4.005 ------------------

* User : carole - DELL
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 17/10/08 par Chiquitine29
* Recherche effectuée à 21:05:17 le 29/10/2009
* Windows XP - Internet Explorer 8.0.6001.18702



un peu vieille cette version de l'outil ! .... notre ami(e) ici présente a déjà été confronté(e) à un bagle apparemment et n'a absolument pas retenu la leçon ...


bon courage ... ( fait gaff au doublon avec notre zozo ... ;) )


A+
0
jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
30 oct. 2009 à 13:36
Salut Ske et merci pour l'info (z'avé pas vu..)

Ok ,on reprend a zero :

A faire dans l'ordre /!\:

· Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.
http://pc-system.fr/
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
==================
? Télécharge FindyKill de Chiquitine29 sur ton bureau :

http://pagesperso-orange.fr/NosTools/Chiquitine29/FindyKill.exe

! Déconnecte toi et ferme toutes applications en cours !

• Double clique sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut .

• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

• Double-clique sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .

• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

• Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

? Laisse travailler l'outil et ne touche à rien ...

--> Poste le rapport qui apparait à la fin , sur le forum ...

( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html
0
merci[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\FindyKill.txt: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\carole\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression:

C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\FindyKill.txt: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\carole\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\FindyKill: supprimé !

Fichiers temporaires nettoyés !
Corbeille vidée!
Sauvegarde du registre crée ! de prendre du temps pour mon problème
0
voici l autre rapport

############################## | FindyKill V5.016 |

# User : carole (Administrateurs) # DELL
# Update on 26/10/2009 by Chiquitine29
# Start at: 14:51:44 | 30/10/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) 4 CPU 2.80GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | (!) Outdated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 39,06 Go (24,14 Go free) # NTFS
# D:\ # Disque fixe local # 72,69 Go (214,74 Mo free) # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Hercules\Deluxe Optical Glass\Camservice.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\system32 |

Présent ! C:\WINDOWS\system32\srosa2.sys
Présent ! C:\WINDOWS\system32\wfsintwq.sys

################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\carole\Application Data |

Présent ! C:\Documents and Settings\carole\Application Data\drivers
################## | Autres detections ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s]
Présent ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S]
Présent ! [HKCU\Software\Local AppWizard-Generated Applications\winupgro]
Présent ! [HKU\S-1-5-21-1409082233-606747145-725345543-1004\Software\Local AppWizard-Generated Applications\winupgro]
Présent ! [HKLM\software\microsoft\security center] "AntiVirusDisableNotify"
Présent ! [HKLM\software\microsoft\security center] "AntiVirusOverride"
Présent ! [HKLM\software\microsoft\security center] "FirewallDisableNotify"
Présent ! [HKLM\software\microsoft\security center] "FirewallOverride"
Présent ! [HKLM\software\microsoft\security center] "UpdatesDisableNotify"
Présent ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Ndisuio -> Start = 2 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.016 ! |
0
jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
30 oct. 2009 à 22:32
! Déconnecte toi et ferme toutes application en cours ( navigateur compris ) .

• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

• Relance "FindyKill" : au menu principal choisis l'option " F " pour français et tape sur [entrée] .

• Au second menu choisis l'option 2 (suppression) et tape sur [entrée]

• Le pc va redémarrer automatiquement ...

? le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

--> Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide

Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html
=============================
Télécharges ComboFix à partir d'un de ces liens :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Et important, enregistre le sur le bureau.

Avant d'utiliser ComboFix :

? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
la protection en temps réel de ton Antivirus et de tes Antispywares,
qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.


Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
est automatiquement sauvegardé et rangé à C:\Combofix.txt)

? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
avant de te reconnecter à internet.

? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
0
############################## | FindyKill V5.016 |

# User : carole (Administrateurs) # DELL
# Update on 26/10/2009 by Chiquitine29
# Start at: 07:04:42 | 31/10/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) 4 CPU 2.80GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 39,06 Go (23,1 Go free) # NTFS
# D:\ # Disque fixe local # 72,69 Go (214,74 Mo free) # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\rundll32.exe

################## | C: |


################## | C:\WINDOWS |

Supprimé ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-17681AA8.pf

################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\carole\Application Data |

################## | Autres suppressions ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Supprimé ! [HKLM\software\microsoft\security center] "AntiVirusDisableNotify"
Supprimé ! [HKLM\software\microsoft\security center] "AntiVirusOverride"
Supprimé ! [HKLM\software\microsoft\security center] "FirewallDisableNotify"
Supprimé ! [HKLM\software\microsoft\security center] "FirewallOverride"
Supprimé ! [HKLM\software\microsoft\security center] "UpdatesDisableNotify"

################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | PEH ... |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.016 ! |
0
jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
31 oct. 2009 à 09:39
Ensuite le rapport de Combofix .
0
ComboFix 09-10-30.01 - carole 31/10/2009 10:42.2.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1535.1087 [GMT 1:00]
Lancé depuis: c:\documents and settings\carole\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Il y a peut-être des sites infectés -----

hxxp://www.nicematin.com
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-09-28 au 2009-10-31 ))))))))))))))))))))))))))))))))))))
.

2009-10-31 09:02 . 2009-10-31 09:02 -------- d-----w- c:\windows\LastGood
2009-10-31 09:01 . 2009-10-31 09:01 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-10-31 09:00 . 2009-10-31 09:02 -------- d-----w- c:\program files\Windows Live
2009-10-31 08:48 . 2009-10-31 08:48 -------- d-----w- c:\program files\Windows Installer Clean Up
2009-10-31 08:46 . 2009-10-31 08:48 -------- d-----w- c:\program files\MSECACHE
2009-10-31 08:06 . 2009-10-31 08:06 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-10-31 08:01 . 2009-10-31 08:01 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-31 06:30 . 2009-10-31 06:30 -------- d-----r- c:\documents and settings\LocalService\Favoris
2009-10-31 06:19 . 2009-03-30 09:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-10-31 06:19 . 2009-02-13 11:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-10-31 06:19 . 2009-02-13 11:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-10-31 06:19 . 2009-10-31 06:19 -------- d-----w- c:\program files\Avira
2009-10-31 06:19 . 2009-10-31 06:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-30 16:10 . 2009-10-27 08:32 15360 -c--a-w- c:\windows\system32\dllcache\register.exe.REN
2009-10-30 13:51 . 2009-10-31 06:11 -------- d-----w- C:\FindyKill
2009-10-30 08:25 . 2009-10-31 06:23 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-30 08:03 . 2009-10-30 08:10 -------- d-----w- c:\windows\BDOSCAN8
2009-10-29 17:54 . 2009-10-29 17:54 -------- d-----w- c:\windows\Performance
2009-10-29 17:54 . 2009-10-29 17:54 -------- d-----w- c:\documents and settings\carole\Local Settings\Application Data\Microsoft Corporation
2009-10-27 22:08 . 2009-10-27 22:08 -------- d-----w- c:\documents and settings\carole\Application Data\VitySoft
2009-10-27 19:47 . 2009-10-31 07:00 -------- d-----w- c:\documents and settings\carole\Application Data\skypePM
2009-10-27 19:47 . 2009-10-31 05:49 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-27 19:39 . 2009-10-31 09:40 -------- d-----w- c:\documents and settings\carole\Application Data\Skype
2009-10-27 19:38 . 2009-10-27 19:38 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-10-27 19:38 . 2009-10-27 19:39 -------- d-----r- c:\program files\Skype
2009-10-27 19:38 . 2009-10-27 19:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-27 16:08 . 2009-08-05 21:48 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-10-27 16:07 . 2009-10-27 16:07 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-10-27 08:57 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-10-27 08:57 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-10-27 08:56 . 2009-10-27 08:56 -------- d-----w- c:\program files\Alwil Software
2009-10-27 08:15 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-27 08:15 . 2009-10-27 08:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-27 08:15 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-27 08:11 . 2009-10-30 07:43 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-10-27 00:51 . 2009-10-27 01:11 -------- d-----w- c:\windows\SxsCaPendDel
2009-10-26 23:19 . 2009-10-31 06:58 -------- d-----w- c:\program files\Registry Winner
2009-10-26 15:48 . 2009-10-30 17:04 -------- d-----w- c:\documents and settings\All Users\Application Data\great coal love default
2009-10-25 16:32 . 2009-10-25 16:32 -------- d-----w- c:\documents and settings\carole\Application Data\PlayFirst
2009-10-25 16:32 . 2009-10-25 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\GamesBar
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\Oberon Media
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\Fichiers communs\Oberon Media
2009-10-16 01:26 . 2009-10-16 01:26 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-11 08:14 . 2009-10-29 18:59 -------- d-----w- c:\documents and settings\carole\Application Data\vlc
2009-10-04 18:34 . 2009-10-04 18:34 -------- d-----w- c:\program files\Microsoft

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-31 07:52 . 2003-07-22 16:49 510204 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-31 07:52 . 2003-07-22 16:49 85304 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-31 07:47 . 2009-01-16 15:33 288 ----a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-31 07:47 . 2009-01-16 15:33 288 ----a-w- c:\windows\system32\DVCState-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-31 07:31 . 2009-06-07 12:31 -------- d-----w- c:\program files\DivX
2009-10-31 06:58 . 2009-05-12 15:19 -------- d-----w- c:\program files\Original-Solitaire
2009-10-31 05:29 . 2009-01-16 18:43 -------- d-----w- c:\documents and settings\carole\Application Data\Azureus
2009-10-30 18:11 . 2009-09-16 17:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-30 09:53 . 2009-01-16 14:59 -------- d-----w- c:\program files\Dell AIO Printer A920
2009-10-27 19:39 . 2009-01-18 10:21 -------- d-----w- c:\program files\Google
2009-10-27 16:02 . 2009-07-18 07:50 -------- d-----w- c:\documents and settings\carole\Application Data\Media Player
2009-10-26 05:17 . 2009-07-18 07:41 -------- d-----w- c:\program files\Orange
2009-10-16 11:23 . 2009-01-16 18:38 -------- d-----w- c:\program files\Azureus
2009-10-15 06:56 . 2009-01-21 17:21 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-16 17:19 . 2009-09-16 17:17 -------- d-----w- c:\program files\Zuma's Revenge!
2009-09-11 14:18 . 2003-07-22 16:44 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 21:47 . 2009-06-06 06:06 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-04 21:04 . 2003-07-22 16:42 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2003-07-22 17:01 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:01 . 2003-07-22 16:56 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-22 01:19 . 2009-01-16 15:22 17864 -c--a-w- c:\documents and settings\carole\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-06 17:24 . 2009-01-16 15:15 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2009-01-16 15:15 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2009-01-16 15:15 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 17:24 . 2008-10-16 13:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2009-01-16 14:37 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2003-07-22 16:31 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2009-01-16 15:15 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2009-03-26 03:36 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-06 17:23 . 2009-03-26 03:36 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-06 17:23 . 2009-01-16 14:37 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:00 . 2003-07-22 16:45 205312 -c--a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 20:58 . 2003-07-22 16:48 2191232 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 17:28 . 2002-08-29 11:42 2068096 ------w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"Dell AIO Printer A920"="c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-06-02 270336]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"CamserviceDeluxe2"="c:\program files\Hercules\Deluxe Optical Glass\Camservice.exe" [2007-08-10 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2003-02-20 28672]
"AsioReg"="CTASIO.DLL" - c:\windows\system32\CTASIO.DLL [2003-02-20 110592]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-03 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\progra~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Hercules\\Deluxe Optical Glass\\Station2.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Hercules\\Deluxe Optical Glass\\ControlUI.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [31/10/2009 07:19 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [27/10/2009 17:08 54752]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [27/10/2009 09:15 269648]
R3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [12/03/2009 19:19 94720]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27/10/2009 09:15 19160]
S2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [22/07/2003 17:56 14336]
S3 APL531;Hercules Dualpix HD Webcam;c:\windows\system32\Drivers\HDvid.sys --> c:\windows\system32\Drivers\HDvid.sys [?]
S3 camfilt;camfilt;c:\windows\system32\Drivers\camfilt.sys --> c:\windows\system32\Drivers\camfilt.sys [?]
S3 fsssvc;Service Windows Live Contrôle parental;"c:\program files\Windows Live\Family Safety\fsssvc.exe" --> c:\program files\Windows Live\Family Safety\fsssvc.exe [?]
S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\drivers\rcblan.sys [03/04/2009 15:49 39704]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - PCIIDEX_2
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
*Deregistered* - PCIIDEX_2
.
Contenu du dossier 'Tâches planifiées'

2009-10-31 c:\windows\Tasks\Malwarebytes' Scheduled Update for carole.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-27 13:53]

2009-10-31 c:\windows\Tasks\User_Feed_Synchronization-{F6A67EAF-6081-4907-B7D9-A0AAEA79BC17}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
mStart Page = hxxp://www.duxet.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_8971.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-31 10:48
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-10-31 10:50
ComboFix-quarantined-files.txt 2009-10-31 09:50

Avant-CF: 24 176 594 944 octets libres
Après-CF: 24 143 593 472 octets libres

- - End Of File - - C38E1AD62EF4FF589F09A49D0F4132DC
0
jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
31 oct. 2009 à 11:40
Il va falloir analyser un ou des fichier(s) suspect(s) !

Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.

Pour afficher les dossiers et fichiers cachés:

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence.

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : c:\windows\system32\drivers\fssfltr_tdi­.sys

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.


0
Srpski | Македонски | العربية | Suomi | ihMdI | | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...

Fichier fssfltr_tdi.sys1 reçu le 2009.10.29 21:36:00 (UTC)
Situation actuelle: terminé

Résultat: 0/41 (0.00%)
Formaté Impression des résultats Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.10.29 -
AhnLab-V3 5.0.0.2 2009.10.29 -
AntiVir 7.9.1.50 2009.10.29 -
Antiy-AVL 2.0.3.7 2009.10.27 -
Authentium 5.1.2.4 2009.10.29 -
Avast 4.8.1351.0 2009.10.29 -
AVG 8.5.0.423 2009.10.29 -
BitDefender 7.2 2009.10.29 -
CAT-QuickHeal 10.00 2009.10.29 -
ClamAV 0.94.1 2009.10.29 -
Comodo 2772 2009.10.29 -
DrWeb 5.0.0.12182 2009.10.29 -
eSafe 7.0.17.0 2009.10.29 -
eTrust-Vet 35.1.7092 2009.10.29 -
F-Prot 4.5.1.85 2009.10.29 -
F-Secure 9.0.15370.0 2009.10.27 -
Fortinet 3.120.0.0 2009.10.29 -
GData 19 2009.10.29 -
Ikarus T3.1.1.72.0 2009.10.29 -
Jiangmin 11.0.800 2009.10.29 -
K7AntiVirus 7.10.883 2009.10.29 -
Kaspersky 7.0.0.125 2009.10.29 -
McAfee 5786 2009.10.29 -
McAfee+Artemis 5786 2009.10.29 -
McAfee-GW-Edition 6.8.5 2009.10.29 -
Microsoft 1.5202 2009.10.29 -
NOD32 4556 2009.10.29 -
Norman 6.03.02 2009.10.29 -
nProtect 2009.1.8.0 2009.10.29 -
Panda 10.0.2.2 2009.10.29 -
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.29 -
Rising 21.53.34.00 2009.10.29 -
Sophos 4.47.0 2009.10.29 -
Sunbelt 3.2.1858.2 2009.10.29 -
Symantec 1.4.4.12 2009.10.29 -
TheHacker 6.5.0.2.056 2009.10.28 -
TrendMicro 8.950.0.1094 2009.10.29 -
VBA32 3.12.10.11 2009.10.29 -
ViRobot 2009.10.29.2011 2009.10.29 -
VirusBuster 4.6.5.0 2009.10.29 -
Information additionnelle
File size: 54752 bytes
MD5 : c6ee3a87fe609d3e1db9dbd072a248de
SHA1 : 3b5ec3ba91ca30522d825a91b35aa33479bc4f27
SHA256: 9c2189fa09a9e1dc39f9ab8f0c9c0b44be0e11fc3165bcd0813dfa85ea62907c
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x99F1
timedatestamp.....: 0x4A7A6E81 (Thu Aug 6 07:47:45 2009)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x5D39 0x5D80 6.53 bea300ce15cfffb4e3db424619fd423a
.rdata 0x6200 0xA4D 0xA80 4.81 f28f87e7621a677cec55f0e8fb61ec04
.data 0x6C80 0x6F0 0x700 0.75 2de88d9cab4fead0a2d37188d8c69b3a
PAGE 0x7380 0x2460 0x2480 6.39 c6a35bda388d7551e96358a84a3cdcd7
INIT 0x9800 0x13E4 0x1400 6.22 89135a12ec609b314bf0773c8ef9ea7d
.rsrc 0xAC00 0x918 0x980 5.98 4b4314e10a7677711d8cb1eaa8ca95d8
.reloc 0xB580 0x8AC 0x900 6.25 a47d12ff72962c116e547e5f90b9e309

( 4 imports )

> hal.dll: KeAcquireInStackQueuedSpinLock, KfReleaseSpinLock, KfAcquireSpinLock, KeReleaseInStackQueuedSpinLock
> ntoskrnl.exe: MmMapLockedPagesSpecifyCache, IoCsqRemoveNextIrp, IoSetCompletionRoutineEx, MmBuildMdlForNonPagedPool, IoAllocateMdl, ExInitializeNPagedLookasideList, ExDeleteNPagedLookasideList, RtlCompareMemory, RtlInitString, IoFreeMdl, ObfDereferenceObject, IoDeleteDevice, IoDetachDevice, InterlockedPopEntrySList, InterlockedPushEntrySList, ObReferenceObjectByHandle, IoFileObjectType, IoAttachDeviceToDeviceStackSafe, IoGetDeviceObjectPointer, RtlInitUnicodeString, IoCsqInsertIrp, KeTickCount, KeBugCheckEx, IofCallDriver, IoGetRequestorProcessId, memcpy, SeQueryInformationToken, RtlLengthSid, RtlInitializeGenericTableAvl, ExFreePoolWithTag, ExAllocatePoolWithTag, RtlLookupElementGenericTableAvl, IofCompleteRequest, KeSetTimer, KeCancelTimer, KeInsertQueueDpc, KeInitializeTimer, KeInitializeDpc, IoDeleteSymbolicLink, IoWMIRegistrationControl, RtlValidSid, IoCreateSymbolicLink, RtlCopyUnicodeString, IoWMIWriteEvent, MmGetSystemRoutineAddress, IoCsqInitialize, ExAllocatePool, RtlDeleteElementGenericTableAvl, RtlLookupElementGenericTableFullAvl, RtlInsertElementGenericTableFullAvl, memset, IoCreateDevice, ZwClose, ZwSetSecurityObject, ObOpenObjectByPointer, IoDeviceObjectType, RtlGetDaclSecurityDescriptor, RtlGetSaclSecurityDescriptor, RtlGetGroupSecurityDescriptor, RtlGetOwnerSecurityDescriptor, _snwprintf, RtlLengthSecurityDescriptor, SeCaptureSecurityDescriptor, SeExports, IoIsWdmVersionAvailable, _wcsnicmp, RtlAddAccessAllowedAce, wcschr, RtlAbsoluteToSelfRelativeSD, RtlSetDaclSecurityDescriptor, RtlCreateSecurityDescriptor, ZwOpenKey, ZwCreateKey, ZwQueryValueKey, ZwSetValueKey, RtlFreeUnicodeString
> tdi.sys: TdiMapUserRequest, TdiDefaultChainedRcvExpeditedHandler, TdiDefaultChainedReceiveHandler, TdiDefaultRcvExpeditedHandler, TdiDefaultReceiveHandler
> wmilib.sys: WmiCompleteRequest, WmiSystemControl

( 0 exports )

TrID : File type identification
-
ssdeep: 768:plrSclHrGx6tB1H9xllMGCa3kgTgPGBlkF3TWqUoTsqsM/gINz4Z1jxhp:brzlLM6tB1TwNTWxoTB45Z1Nhp
PEiD : -
RDS : NSRL Reference Data Set
-


ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy
0
jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
1 nov. 2009 à 09:39
> Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)
- Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie/colle dedans les lignes suivantes :




Folder::
c:\program files\Registry Winner





- Enregistre ce fichier sous le nom CFScript
- Fait un glisser/déposer de ce fichier CFScrïpt sur le fichier ComboFix.exe comme sur cette image. (Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris.) Combofix va démarrer.
- Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
- Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
- Ne touche à rien tant que le scan n'est pas terminé sinon le PC peut planter !
- Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Note : Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
=================

télécharge lopS&D

*double-cliquez dessus pour installer le programme.
* Un raccourci sera créé sur votre bureau , double-cliquez dessus pour lancer l'outil.
*choisis la langue .
*choisis l'option 1 (recherche) .
*copie/colle le rapport sur le forum.
0
ComboFix 09-10-30.01 - carole 01/11/2009 11:51.3.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1535.1081 [GMT 1:00]
Lancé depuis: c:\documents and settings\carole\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\carole\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Registry Winner
c:\program files\Registry Winner\AutoBackup\AutoBackup20091027004844.zip
c:\program files\Registry Winner\RegistryWinner.exe.wbak
c:\program files\Registry Winner\RWCleaner.ini
c:\program files\Registry Winner\RWOptimizer.ini
c:\program files\Registry Winner\Settings.ini
c:\program files\Registry Winner\Utilities\Favorites\? Riad Marrakech, Riads de charme Marrakech, Liste Riads Marrakech.url
c:\program files\Registry Winner\Utilities\Favorites\Annonces immobilieres Vente Maison 5 pieces (06400) prix 1000000 EUR.url
c:\program files\Registry Winner\Utilities\Favorites\ASOS.com - Women's Clothing - Womens Fashion - Designer Clothes For Women.url
c:\program files\Registry Winner\Utilities\Favorites\Body Bumps.url
c:\program files\Registry Winner\Utilities\Favorites\Celebrity Dresses.url
c:\program files\Registry Winner\Utilities\Favorites\christian louboutin classic sheos on sale,free shipping,discout louboutin shoes,sandal,high heel shoes,CLASSIC sheos.url
c:\program files\Registry Winner\Utilities\Favorites\Console extensible Amandine - Meubles and Co.url
c:\program files\Registry Winner\Utilities\Favorites\cydia.url
c:\program files\Registry Winner\Utilities\Favorites\Derniers ajouts - eMule-Island.url
c:\program files\Registry Winner\Utilities\Favorites\Desktop.ini
c:\program files\Registry Winner\Utilities\Favorites\dismoioù.url
c:\program files\Registry Winner\Utilities\Favorites\Dsone-i pour dsi-ds+ micro sd 4go - Supercard DSOne-i - M3 R4 DSTT.url
c:\program files\Registry Winner\Utilities\Favorites\DVDRiP Mega Films.url
c:\program files\Registry Winner\Utilities\Favorites\Evening Dresses - Women's Evening Dresses - Designer Dresses - ASOS.com.url
c:\program files\Registry Winner\Utilities\Favorites\HD-Life.Net - La Vie En Haute Définition.url
c:\program files\Registry Winner\Utilities\Favorites\Hermes - Handbags - products list.url
c:\program files\Registry Winner\Utilities\Favorites\http--www.achatdesign.com-.url
c:\program files\Registry Winner\Utilities\Favorites\http--www.photoweb.fr-produit-tirage-eco-tirage-photo-economique.asp.url
c:\program files\Registry Winner\Utilities\Favorites\http--www2.equipement.gouv.fr-formulaires-fic_pdf-cerce.pdf.url
c:\program files\Registry Winner\Utilities\Favorites\https--www.highreplica.com-home.html.url
c:\program files\Registry Winner\Utilities\Favorites\interencheres.com site d'annonce de ventes aux enchères publiques. Art, matériel, voiture..url
c:\program files\Registry Winner\Utilities\Favorites\iPhoneGen.fr.url
c:\program files\Registry Winner\Utilities\Favorites\Itoma Accueil.url
c:\program files\Registry Winner\Utilities\Favorites\Lesmagouilles.url
c:\program files\Registry Winner\Utilities\Favorites\Liens\desktop.ini
c:\program files\Registry Winner\Utilities\Favorites\Liste des dernieres fiche ajoutees - eMule-Box.url
c:\program files\Registry Winner\Utilities\Favorites\Liste des formulaires à télécharger.url
c:\program files\Registry Winner\Utilities\Favorites\Maquillage, cosmétiques, produits de beauté elf, EyesLipsFace.url
c:\program files\Registry Winner\Utilities\Favorites\Megaupload transformer un compte membre en compte premium.url
c:\program files\Registry Winner\Utilities\Favorites\Mod Dresses.url
c:\program files\Registry Winner\Utilities\Favorites\MSC Croisières.url
c:\program files\Registry Winner\Utilities\Favorites\Nappage - VEGA, matériel pour la restauration et l'hôtellerie.url
c:\program files\Registry Winner\Utilities\Favorites\New Arrivals Replica Handbags - Fake Purses - 2008 Collection.url
c:\program files\Registry Winner\Utilities\Favorites\New Look.url
c:\program files\Registry Winner\Utilities\Favorites\Pages Jaunes.url
c:\program files\Registry Winner\Utilities\Favorites\Play-The.Net - Envie de Jouer.url
c:\program files\Registry Winner\Utilities\Favorites\Prestige Replicas Luxury at affordable prices!.url
c:\program files\Registry Winner\Utilities\Favorites\PS3Gen.fr - [TUTO] La solution pour la vidéo en HD sur PS3.url
c:\program files\Registry Winner\Utilities\Favorites\PS3Gen.fr - Accueil.url
c:\program files\Registry Winner\Utilities\Favorites\Ralph Lauren Polo - Men's Apparel.url
c:\program files\Registry Winner\Utilities\Favorites\Reload Paradise Infos.url
c:\program files\Registry Winner\Utilities\Favorites\Replica Bvlgari Designer Jewelry.url
c:\program files\Registry Winner\Utilities\Favorites\RISERVA BIANCA LIMONE PIEMONTE SCI SKI.url
c:\program files\Registry Winner\Utilities\Favorites\Robe de bal courte dentelle et tulle beige 04090914A.url
c:\program files\Registry Winner\Utilities\Favorites\Sherri Hill Prom Dresses, 2009 Prom Dresses, Formal Dresses.url
c:\program files\Registry Winner\Utilities\Favorites\Sports98.com.url
c:\program files\Registry Winner\Utilities\Favorites\Sun Dresses - Dresses - Topshop.url
c:\program files\Registry Winner\Utilities\Favorites\Toutes les ventes en cours - myfab.com.url
c:\program files\Registry Winner\Utilities\Favorites\Uploader-Team-Tracker Home.url
c:\program files\Registry Winner\Utilities\Favorites\USG Demarche à suivre.url
c:\program files\Registry Winner\Utilities\Favorites\vente-privee.com.url
c:\program files\Registry Winner\Utilities\Favorites\Version traduite de la page http--www.replica031.com-Replica_Handbags-Hermes_Replica_Handbags_1.html.url
c:\program files\Registry Winner\Utilities\Favorites\Version traduite de la page http--www.tvix.co.kr-eng-.url
c:\program files\Registry Winner\Utilities\Favorites\Walter ... et vos nuits s'éclairent !.url
c:\program files\Registry Winner\Utilities\Favorites\Wii Info - Article - Graver un backup de jeu Wii-GameCube sur DVD.url
c:\program files\Registry Winner\Utilities\Favorites\Women's Dresses Ladies Designer Dresses.url
c:\program files\Registry Winner\Utilities\Favorites\XTREAMER France.url

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-10-01 au 2009-11-01 ))))))))))))))))))))))))))))))))))))
.

2009-10-31 09:02 . 2009-10-31 09:02 -------- d-----w- c:\windows\LastGood
2009-10-31 09:01 . 2009-10-31 09:01 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-10-31 09:00 . 2009-10-31 09:02 -------- d-----w- c:\program files\Windows Live
2009-10-31 08:48 . 2009-10-31 08:48 -------- d-----w- c:\program files\Windows Installer Clean Up
2009-10-31 08:46 . 2009-10-31 08:48 -------- d-----w- c:\program files\MSECACHE
2009-10-31 08:06 . 2009-10-31 08:06 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-10-31 08:01 . 2009-10-31 08:01 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-31 06:30 . 2009-10-31 06:30 -------- d-----r- c:\documents and settings\LocalService\Favoris
2009-10-31 06:19 . 2009-03-30 09:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-10-31 06:19 . 2009-02-13 11:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-10-31 06:19 . 2009-02-13 11:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-10-31 06:19 . 2009-10-31 06:19 -------- d-----w- c:\program files\Avira
2009-10-31 06:19 . 2009-10-31 06:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-30 16:10 . 2009-10-27 08:32 15360 -c--a-w- c:\windows\system32\dllcache\register.exe.REN
2009-10-30 13:51 . 2009-10-31 06:11 -------- d-----w- C:\FindyKill
2009-10-30 08:25 . 2009-10-31 06:23 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-30 08:03 . 2009-10-30 08:10 -------- d-----w- c:\windows\BDOSCAN8
2009-10-29 17:54 . 2009-10-29 17:54 -------- d-----w- c:\windows\Performance
2009-10-29 17:54 . 2009-10-29 17:54 -------- d-----w- c:\documents and settings\carole\Local Settings\Application Data\Microsoft Corporation
2009-10-27 22:08 . 2009-10-27 22:08 -------- d-----w- c:\documents and settings\carole\Application Data\VitySoft
2009-10-27 19:47 . 2009-10-31 07:00 -------- d-----w- c:\documents and settings\carole\Application Data\skypePM
2009-10-27 19:47 . 2009-10-31 05:49 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-27 19:39 . 2009-10-31 09:40 -------- d-----w- c:\documents and settings\carole\Application Data\Skype
2009-10-27 19:38 . 2009-10-27 19:38 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-10-27 19:38 . 2009-10-27 19:39 -------- d-----r- c:\program files\Skype
2009-10-27 19:38 . 2009-10-27 19:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-27 16:08 . 2009-08-05 21:48 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-10-27 16:07 . 2009-10-27 16:07 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-10-27 08:57 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-10-27 08:57 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-10-27 08:56 . 2009-10-27 08:56 -------- d-----w- c:\program files\Alwil Software
2009-10-27 08:15 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-27 08:15 . 2009-10-27 08:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-27 08:15 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-27 08:11 . 2009-10-30 07:43 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-10-27 00:51 . 2009-10-27 01:11 -------- d-----w- c:\windows\SxsCaPendDel
2009-10-26 15:48 . 2009-10-30 17:04 -------- d-----w- c:\documents and settings\All Users\Application Data\great coal love default
2009-10-25 16:32 . 2009-10-25 16:32 -------- d-----w- c:\documents and settings\carole\Application Data\PlayFirst
2009-10-25 16:32 . 2009-10-25 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\GamesBar
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\Oberon Media
2009-10-25 16:31 . 2009-10-25 16:31 -------- d-----w- c:\program files\Fichiers communs\Oberon Media
2009-10-16 01:26 . 2009-10-16 01:26 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-11 08:14 . 2009-10-31 10:11 -------- d-----w- c:\documents and settings\carole\Application Data\vlc
2009-10-04 18:34 . 2009-10-04 18:34 -------- d-----w- c:\program files\Microsoft

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-01 08:23 . 2009-01-16 18:43 -------- d-----w- c:\documents and settings\carole\Application Data\Azureus
2009-10-31 07:52 . 2003-07-22 16:49 510204 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-31 07:52 . 2003-07-22 16:49 85304 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-31 07:47 . 2009-01-16 15:33 288 ----a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-31 07:47 . 2009-01-16 15:33 288 ----a-w- c:\windows\system32\DVCState-{00000002-00000000-00000000-00001102-00000004-10031102}.dat
2009-10-31 07:31 . 2009-06-07 12:31 -------- d-----w- c:\program files\DivX
2009-10-31 06:58 . 2009-05-12 15:19 -------- d-----w- c:\program files\Original-Solitaire
2009-10-30 18:11 . 2009-09-16 17:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-30 09:53 . 2009-01-16 14:59 -------- d-----w- c:\program files\Dell AIO Printer A920
2009-10-27 19:39 . 2009-01-18 10:21 -------- d-----w- c:\program files\Google
2009-10-27 16:02 . 2009-07-18 07:50 -------- d-----w- c:\documents and settings\carole\Application Data\Media Player
2009-10-26 05:17 . 2009-07-18 07:41 -------- d-----w- c:\program files\Orange
2009-10-16 11:23 . 2009-01-16 18:38 -------- d-----w- c:\program files\Azureus
2009-10-15 06:56 . 2009-01-21 17:21 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-09-16 17:19 . 2009-09-16 17:17 -------- d-----w- c:\program files\Zuma's Revenge!
2009-09-11 14:18 . 2003-07-22 16:44 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 21:47 . 2009-06-06 06:06 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-04 21:04 . 2003-07-22 16:42 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2003-07-22 17:01 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:01 . 2003-07-22 16:56 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-22 01:19 . 2009-01-16 15:22 17864 -c--a-w- c:\documents and settings\carole\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-06 17:24 . 2009-01-16 15:15 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 17:24 . 2009-01-16 15:15 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 17:24 . 2009-01-16 15:15 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 17:24 . 2008-10-16 13:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 17:24 . 2009-01-16 14:37 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-06 17:24 . 2003-07-22 16:31 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 17:23 . 2009-01-16 15:15 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 17:23 . 2009-03-26 03:36 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-06 17:23 . 2009-03-26 03:36 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-06 17:23 . 2009-01-16 14:37 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:00 . 2003-07-22 16:45 205312 -c--a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 20:58 . 2003-07-22 16:48 2191232 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 17:28 . 2002-08-29 11:42 2068096 ------w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"Dell AIO Printer A920"="c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-06-02 270336]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"CamserviceDeluxe2"="c:\program files\Hercules\Deluxe Optical Glass\Camservice.exe" [2007-08-10 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2003-02-20 28672]
"AsioReg"="CTASIO.DLL" - c:\windows\system32\CTASIO.DLL [2003-02-20 110592]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-03 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\progra~1\DVDREG~1\DVDShell.dll" [2004-10-09 49152]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Hercules\\Deluxe Optical Glass\\Station2.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Hercules\\Deluxe Optical Glass\\ControlUI.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [31/10/2009 07:19 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [27/10/2009 17:08 54752]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [27/10/2009 09:15 269648]
R3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [12/03/2009 19:19 94720]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27/10/2009 09:15 19160]
S2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [22/07/2003 17:56 14336]
S3 APL531;Hercules Dualpix HD Webcam;c:\windows\system32\Drivers\HDvid.sys --> c:\windows\system32\Drivers\HDvid.sys [?]
S3 camfilt;camfilt;c:\windows\system32\Drivers\camfilt.sys --> c:\windows\system32\Drivers\camfilt.sys [?]
S3 fsssvc;Service Windows Live Contrôle parental;"c:\program files\Windows Live\Family Safety\fsssvc.exe" --> c:\program files\Windows Live\Family Safety\fsssvc.exe [?]
S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\drivers\rcblan.sys [03/04/2009 15:49 39704]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - PCIIDEX_2
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
*Deregistered* - PCIIDEX_2
.
Contenu du dossier 'Tâches planifiées'

2009-11-01 c:\windows\Tasks\Malwarebytes' Scheduled Update for carole.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-27 13:53]

2009-11-01 c:\windows\Tasks\User_Feed_Synchronization-{F6A67EAF-6081-4907-B7D9-A0AAEA79BC17}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
mStart Page = hxxp://www.duxet.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_8971.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-01 11:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0




--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.80GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A12
USER : carole ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.32 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:20 Go)
D:\ (Local Disk) - NTFS - Total:72 Go (Free:0 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 01/11/2009|12:03 )

--------------------\\ Listing des dossiers dans APPLIC~1

[30/10/2009|07:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[15/10/2009|07:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[30/10/2009|08:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg9
[31/10/2009|07:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
[16/01/2009|20:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[19/01/2009|13:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[27/10/2009|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[30/10/2009|18:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
[06/08/2009|10:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HiYo
[16/01/2009|19:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[09/08/2009|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[27/10/2009|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[26/08/2009|14:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[21/01/2009|14:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MumboJumbo
[16/01/2009|21:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
[22/01/2009|22:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
[31/01/2009|14:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[25/10/2009|17:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
[16/01/2009|16:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
[27/10/2009|20:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[30/10/2009|19:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[04/02/2009|21:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[22/08/2009|18:09] C:\DOCUME~1\carole\APPLIC~1\Adobe
[01/11/2009|09:23] C:\DOCUME~1\carole\APPLIC~1\Azureus
[13/05/2009|11:17] C:\DOCUME~1\carole\APPLIC~1\DMV Technologies
[24/08/2009|09:02] C:\DOCUME~1\carole\APPLIC~1\dvdcss
[18/01/2009|11:23] C:\DOCUME~1\carole\APPLIC~1\Google
[07/05/2009|16:00] C:\DOCUME~1\carole\APPLIC~1\Help
[06/08/2009|10:03] C:\DOCUME~1\carole\APPLIC~1\HiYo
[16/01/2009|15:48] C:\DOCUME~1\carole\APPLIC~1\Identities
[11/07/2009|18:05] C:\DOCUME~1\carole\APPLIC~1\ImgBurn
[12/03/2009|19:18] C:\DOCUME~1\carole\APPLIC~1\InstallShield
[16/01/2009|16:55] C:\DOCUME~1\carole\APPLIC~1\Macromedia
[09/08/2009|11:10] C:\DOCUME~1\carole\APPLIC~1\Malwarebytes
[27/10/2009|17:02] C:\DOCUME~1\carole\APPLIC~1\Media Player
[31/10/2009|09:48] C:\DOCUME~1\carole\APPLIC~1\Microsoft
[13/05/2009|11:17] C:\DOCUME~1\carole\APPLIC~1\Mozilla
[26/08/2009|14:54] C:\DOCUME~1\carole\APPLIC~1\MSN6
[16/01/2009|22:04] C:\DOCUME~1\carole\APPLIC~1\Nero
[04/03/2009|10:57] C:\DOCUME~1\carole\APPLIC~1\OneSwarm
[02/02/2009|17:28] C:\DOCUME~1\carole\APPLIC~1\OpenOffice.org
[25/10/2009|17:32] C:\DOCUME~1\carole\APPLIC~1\PlayFirst
[16/01/2009|21:20] C:\DOCUME~1\carole\APPLIC~1\Real
[18/05/2009|09:03] C:\DOCUME~1\carole\APPLIC~1\Samsung
[31/10/2009|10:40] C:\DOCUME~1\carole\APPLIC~1\Skype
[31/10/2009|08:00] C:\DOCUME~1\carole\APPLIC~1\skypePM
[16/01/2009|19:41] C:\DOCUME~1\carole\APPLIC~1\Sun
[27/10/2009|23:08] C:\DOCUME~1\carole\APPLIC~1\VitySoft
[31/10/2009|11:11] C:\DOCUME~1\carole\APPLIC~1\vlc
[02/02/2009|14:31] C:\DOCUME~1\carole\APPLIC~1\Yahoo!

[18/07/2009|22:07] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[31/10/2009|07:30] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
[30/10/2009|07:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[30/10/2009|07:25] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[01/11/2009 01:00][--a------] C:\WINDOWS\tasks\Malwarebytes' Scheduled Update for carole.job
[01/11/2009 12:02][--ah-----] C:\WINDOWS\tasks\User_Feed_Synchronization-{F6A67EAF-6081-4907-B7D9-A0AAEA79BC17}.job
[01/11/2009 11:58][--ah-----] C:\WINDOWS\tasks\SA.DAT
[22/07/2003 17:44][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[16/01/2009|16:01] C:\Program Files\ABBYY FineReader 5.0 Sprint
[16/01/2009|16:01] C:\Program Files\ABBYY FineReader 6.0
[22/01/2009|13:22] C:\Program Files\Adobe
[27/10/2009|09:56] C:\Program Files\Alwil Software
[31/10/2009|07:19] C:\Program Files\Avira
[16/10/2009|12:23] C:\Program Files\Azureus
[02/02/2009|14:31] C:\Program Files\CCleaner
[16/01/2009|16:05] C:\Program Files\Creative
[16/01/2009|15:59] C:\Program Files\Dell A920
[30/10/2009|10:53] C:\Program Files\Dell AIO Printer A920
[31/10/2009|08:31] C:\Program Files\DivX
[29/01/2009|11:37] C:\Program Files\DVD Region+CSS Free
[28/07/2009|09:32] C:\Program Files\eMule
[01/11/2009|11:54] C:\Program Files\Fichiers communs
[16/01/2009|16:12] C:\Program Files\Foxireader
[25/10/2009|17:31] C:\Program Files\GamesBar
[27/10/2009|20:39] C:\Program Files\Google
[12/03/2009|19:18] C:\Program Files\Hercules
[06/08/2009|10:03] C:\Program Files\HiYo
[11/07/2009|18:03] C:\Program Files\ImgBurn
[31/07/2009|08:24] C:\Program Files\InstallShield Installation Information
[16/01/2009|15:50] C:\Program Files\Intel
[16/10/2009|02:05] C:\Program Files\Internet Explorer
[05/08/2009|21:35] C:\Program Files\Java
[10/06/2009|12:39] C:\Program Files\JRE
[16/01/2009|16:11] C:\Program Files\K-Lite Codec Pack
[31/07/2009|08:23] C:\Program Files\Logitech
[19/01/2009|22:52] C:\Program Files\Luxor Mega Pack
[27/10/2009|09:15] C:\Program Files\Malwarebytes' Anti-Malware
[04/10/2009|19:34] C:\Program Files\Microsoft
[16/01/2009|15:45] C:\Program Files\microsoft frontpage
[09/09/2009|22:47] C:\Program Files\Microsoft Silverlight
[25/03/2009|09:37] C:\Program Files\Microsoft SQL Server Compact Edition
[27/10/2009|17:07] C:\Program Files\Microsoft Sync Framework
[17/06/2009|11:00] C:\Program Files\Mindscape
[16/01/2009|18:01] C:\Program Files\Movie Maker
[31/10/2009|08:31] C:\Program Files\Mozilla Firefox
[20/04/2009|22:47] C:\Program Files\MSBuild
[31/10/2009|09:48] C:\Program Files\MSECACHE
[16/01/2009|15:37] C:\Program Files\MSN Gaming Zone
[17/01/2009|18:47] C:\Program Files\MSXML 4.0
[16/01/2009|21:36] C:\Program Files\Nero
[16/01/2009|17:58] C:\Program Files\NetMeeting
[22/01/2009|22:54] C:\Program Files\NOS
[25/10/2009|17:31] C:\Program Files\Oberon Media
[10/06/2009|12:39] C:\Program Files\OpenOffice.org 3
[02/02/2009|17:23] C:\Program Files\OpenOffice.org 3.0 (fr) Installation Files
[10/06/2009|12:26] C:\Program Files\OpenOffice.org 3.1 (fr) Installation Files
[26/10/2009|06:17] C:\Program Files\Orange
[31/10/2009|07:58] C:\Program Files\Original-Solitaire
[13/08/2009|02:02] C:\Program Files\Outlook Express
[20/04/2009|22:42] C:\Program Files\Reference Assemblies
[16/01/2009|16:51] C:\Program Files\SAGEM
[27/10/2009|20:39] C:\Program Files\Skype
[16/01/2009|17:22] C:\Program Files\SystemRequirementsLab
[06/08/2009|10:25] C:\Program Files\UltraISO
[16/01/2009|15:48] C:\Program Files\Uninstall Information
[16/01/2009|16:19] C:\Program Files\VideoLAN
[16/01/2009|16:54] C:\Program Files\Wanadoo
[31/10/2009|09:48] C:\Program Files\Windows Installer Clean Up
[31/10/2009|10:02] C:\Program Files\Windows Live
[31/10/2009|10:01] C:\Program Files\Windows Live SkyDrive
[04/02/2009|21:12] C:\Program Files\Windows Media Connect 2
[31/10/2009|07:58] C:\Program Files\Windows Media Player
[16/01/2009|17:58] C:\Program Files\Windows NT
[16/01/2009|15:38] C:\Program Files\WindowsUpdate
[16/01/2009|16:10] C:\Program Files\WinRAR
[16/01/2009|15:45] C:\Program Files\xerox
[16/09/2009|18:19] C:\Program Files\Zuma's Revenge!

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[15/10/2009|07:56] C:\Program Files\Fichiers communs\Adobe
[16/01/2009|19:13] C:\Program Files\Fichiers communs\InstallShield
[02/02/2009|17:24] C:\Program Files\Fichiers communs\Java
[27/10/2009|17:08] C:\Program Files\Fichiers communs\Microsoft Shared
[16/01/2009|15:38] C:\Program Files\Fichiers communs\MSSoap
[16/01/2009|21:52] C:\Program Files\Fichiers communs\Nero
[25/10/2009|17:31] C:\Program Files\Fichiers communs\Oberon Media
[16/01/2009|15:33] C:\Program Files\Fichiers communs\ODBC
[03/04/2009|15:49] C:\Program Files\Fichiers communs\Remote Control Software Common
[03/04/2009|15:49] C:\Program Files\Fichiers communs\Remote Control USB Driver
[16/01/2009|15:39] C:\Program Files\Fichiers communs\Services
[27/10/2009|20:38] C:\Program Files\Fichiers communs\Skype
[16/01/2009|15:33] C:\Program Files\Fichiers communs\SpeechEngines
[16/01/2009|17:58] C:\Program Files\Fichiers communs\System
[31/10/2009|09:06] C:\Program Files\Fichiers communs\Windows Live

--------------------\\ Process

( 39 Processes )

iexplore.exe ~ [PID:4404]
iexplore.exe ~ [PID:4508]
iexplore.exe ~ [PID:4464]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\ALLUSE~1\APPLIC~1\great coal love default
C:\DOCUME~1\carole\Cookies\carole@advertising[2].txt

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-01 12:05:02
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:3][D:0]-> C:\DOCUME~1\carole\Cookies
[F:60][D:4]-> C:\DOCUME~1\carole\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 01/11/2009|12:05 - Option : [1]

--------------------\\ Fin du rapport a 12:05:44

**************************************************************************
.
Heure de fin: 2009-11-01 11:58
ComboFix-quarantined-files.txt 2009-11-01 10:57
ComboFix2.txt 2009-10-31 09:50

Avant-CF: 22 064 304 128 octets libres
Après-CF: 22 055 600 128 octets libres

- - End Of File - - BF43DD58C2FEB8CB6CA6A80E26F1702B
0
jfkpresident Messages postés 13404 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
1 nov. 2009 à 12:46
relance LopS&D et choisis l'option 2 .
ensuite colle le rapport généré .

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
0