Allo charles,
J'ai bien beau enlever l'anti-virus,l'anti pop-up,etc... mais ça ne fonctionne toujours pas...
Voilà le scan de ''Chercher.cmd''
C:\WINDOWS\System32\WPA.DBL -->2006-08-17 14:34:04
C:\WINDOWS\System32\fefcbd9_s.ocx -->2006-08-17 14:25:57
C:\WINDOWS\System32\eae_s.dll -->2006-08-17 14:25:57
C:\WINDOWS\System32\ikhcore.log -->2006-08-17 13:09:13
C:\WINDOWS\System32\' -->2006-08-17 10:33:23
C:\WINDOWS\System32\perfh040.dat -->2006-08-17 02:26:55
C:\WINDOWS\System32\PERFH009.DAT -->2006-08-17 02:26:54
C:\WINDOWS\System32\perfc040.dat -->2006-08-17 02:26:54
C:\WINDOWS\System32\PERFC009.DAT -->2006-08-17 02:26:54
C:\WINDOWS\System32\pavas.ico -->2006-08-16 20:24:43
C:\WINDOWS\System32\FNTCACHE.DAT -->2006-08-15 00:25:24
C:\WINDOWS\System32\OODBS.lor -->2006-08-14 14:21:00
C:\WINDOWS\System32\wpcap.dll -->2006-08-14 00:34:20
C:\WINDOWS\System32\pthreadVC.dll -->2006-08-14 00:34:20
C:\WINDOWS\System32\packet.dll -->2006-08-14 00:34:20
C:\WINDOWS\System32\initdebug.nfo -->2006-08-10 17:44:43
C:\WINDOWS\System32\PerfStringBackup.INI -->2006-08-08 13:06:48
C:\WINDOWS\System32\perfh00C.dat -->2006-08-08 13:06:48
C:\WINDOWS\System32\perfc00C.dat -->2006-08-08 13:06:48
C:\WINDOWS\System32\d3d9caps.dat -->2006-08-08 11:37:54
C:\WINDOWS\System32\ikhcore.cfg -->2006-08-07 23:10:26
C:\WINDOWS\System32\WIAcache.DLL -->2006-08-07 18:27:39
C:\WINDOWS\System32\CONFIG.NT -->2006-08-03 23:36:04
C:\WINDOWS\System32\E.exe -->2006-08-03 16:21:48
C:\WINDOWS\System32\MRT.exe -->2006-08-02 21:22:50
C:\WINDOWS\SchedLgU.Txt -->2006-08-17 19:16:00
C:\WINDOWS\wmsetup.log -->2006-08-17 15:41:59
C:\WINDOWS\WindowsUpdate.log -->2006-08-17 14:35:06
C:\WINDOWS\win.ini -->2006-08-17 13:49:46
C:\WINDOWS\system.ini -->2006-08-17 13:49:46
C:\WINDOWS\wiadebug.log -->2006-08-17 13:38:31
C:\WINDOWS\wiaservc.log -->2006-08-17 13:38:30
C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt -->2006-08-17 13:09:58
C:\WINDOWS\BOOTSTAT.DAT -->2006-08-17 13:09:23
C:\WINDOWS\Sti_Trace.log -->2006-08-17 00:24:35
C:\WINDOWS\NeroDigital.ini -->2006-08-16 22:41:35
C:\WINDOWS\eReg.dat -->2006-08-12 15:46:32
C:\WINDOWS\wininit.ini -->2006-08-10 20:25:57
C:\WINDOWS\mozver.dat -->2006-08-09 22:20:27
C:\WINDOWS\ST6UNST.EXE -->2006-08-01 22:28:49
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 34DE-C82E
Répertoire de C:\WINDOWS\system32
2004-08-05 14:00 6 144 CSRSS.EXE
1 fichier(s) 6 144 octets
0 Rép(s) 43 778 629 632 octets libres
Contenu de Downloaded Program Files
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 34DE-C82E
Répertoire de C:\WINDOWS\Downloaded Program Files
2006-08-16 23:18 <REP> .
2006-08-16 23:18 <REP> ..
2004-08-20 12:36 65 DESKTOP.INI
1 fichier(s) 65 octets
Total des fichiers listés :
1 fichier(s) 65 octets
2 Rép(s) 43 778 629 632 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 34DE-C82E
Répertoire de C:\Program Files
2006-08-17 14:42 <REP> .
2006-08-17 14:42 <REP> ..
2006-05-10 14:42 <REP> ACD Systems
2004-11-19 04:44 <REP> Adobe
2006-05-12 13:38 <REP> Advanced System Optimizer
2006-05-10 14:42 <REP> Ahead
2006-08-15 00:53 <REP> ATI Technologies
2006-06-15 16:39 <REP> Backwork 2.1
2006-08-17 10:48 <REP> BeClean
2006-08-15 21:49 <REP> BitLord
2004-11-19 04:36 <REP> Broadcom
2006-08-17 01:53 <REP> Cain
2006-08-15 21:05 <REP> CCleaner
2006-08-15 19:21 <REP> Codemasters
2004-11-19 04:14 <REP> ComPlus Applications
2004-11-19 04:27 <REP> CONEXANT
2004-11-19 04:38 <REP> Creative
2004-11-19 04:39 <REP> CyberLink
2006-08-16 20:22 <REP> DAEMON Tools
2004-11-19 04:39 <REP> Dell
2006-05-11 08:43 <REP> Dell Computer
2004-11-19 04:37 <REP> Digital Line Detect
2006-08-08 02:18 <REP> DRIVERS
2006-05-10 15:20 <REP> Executive Software
2006-08-15 19:45 <REP> Fichiers communs
2006-08-16 20:32 <REP> Hijackthis
2004-11-19 04:36 <REP> Intel
2006-08-02 15:58 <REP> Internet Explorer
2006-07-04 21:20 <REP> iTunes
2006-05-16 16:01 <REP> Java
2006-08-17 14:51 <REP> jv16 PowerTools 2006
2006-08-17 02:30 <REP> Kaspersky Lab
2006-08-14 13:13 <REP> LimeWire
2006-08-15 19:22 <REP> Macrogaming
2006-08-06 14:51 <REP> Maxis
2006-08-17 01:07 <REP> Messenger
2004-11-19 04:14 <REP> microsoft frontpage
2006-05-10 14:50 <REP> Microsoft Office
2006-07-28 11:59 <REP> Microsoft SQL Server
2006-05-10 14:47 <REP> Microsoft Visual Studio
2006-05-21 19:06 <REP> Microsoft Windows Script
2006-05-10 14:49 <REP> Microsoft Works
2006-05-10 14:44 <REP> Microsoft.NET
2006-08-15 20:23 <REP> mIRC
2004-11-19 04:14 <REP> Movie Maker
2004-11-19 04:14 <REP> MSN
2004-11-19 04:14 <REP> MSN Gaming Zone
2006-05-10 16:02 <REP> MSN Messenger
2006-06-03 19:23 <REP> NetMeeting
2006-06-18 10:41 <REP> NovaLogic
2004-11-19 04:40 <REP> Nullsoft
2006-05-10 15:19 <REP> OfficeUpdate11
2006-05-10 15:36 <REP> Outlook Express
2006-07-04 21:21 <REP> QuickTime
2004-11-19 04:14 <REP> Services en ligne
2006-05-26 20:03 <REP> SmartSound Software
2006-08-01 16:35 <REP> Sony
2006-08-09 16:35 <REP> Spybot - Search & Destroy
2006-08-15 16:27 <REP> Spyware Doctor
2006-08-15 02:25 <REP> Steam
2006-05-10 14:33 <REP> Symantec
2006-05-26 20:01 <REP> Ulead Systems
2006-06-03 19:26 <REP> Ventrilo
2004-11-19 04:40 <REP> Viewpoint
2006-05-26 20:02 <REP> Windows Media Components
2006-08-11 14:24 <REP> Windows Media Player
2004-11-19 04:14 <REP> Windows NT
2006-06-22 17:12 <REP> WinRAR
2004-11-19 04:44 <REP> WordPerfect Office 12
2004-11-19 04:14 <REP> XEROX
0 fichier(s) 0 octets
70 Rép(s) 43 778 625 536 octets libres
Le volume dans le lecteur C n'a pas de nom.
Le numéro de série du volume est 34DE-C82E
Répertoire de C:\Program Files\fichiers communs
2006-08-15 19:45 <REP> .
2006-08-15 19:45 <REP> ..
2006-05-10 14:42 <REP> ACD Systems
2006-05-19 14:37 <REP> Adobe
2006-05-10 14:42 <REP> Ahead
2004-11-19 04:40 <REP> AOL
2004-11-19 04:44 <REP> Borland Shared
2004-11-19 04:44 <REP> Corel
2006-05-10 14:49 <REP> DESIGNER
2006-05-26 20:01 <REP> InstallShield
2004-11-19 04:36 <REP> Java
2006-05-10 14:58 <REP> Microsoft Shared
2004-11-19 04:14 <REP> MSSoap
2004-11-19 04:14 <REP> ODBC
2006-05-13 12:03 <REP> Real
2004-11-19 04:14 <REP> Services
2004-11-19 04:14 <REP> SpeechEngines
2006-05-10 15:08 <REP> Symantec Shared
2006-05-10 15:36 <REP> System
2006-05-26 20:03 <REP> Ulead Systems
2006-08-07 22:49 <REP> Wise Installation Wizard
2006-08-05 01:51 <REP> {34DEC82E-0BB0-3084-1011-040405120002}
0 fichier(s) 0 octets
22 Rép(s) 43 778 625 536 octets libres
c:\Documents and Settings\Sébastien\Application Data\LimeWire\.NetworkShare\LimeWireWin4.12.6.exe
c:\Documents and Settings\Sébastien\Bureau\Ventrilo -m.exe
c:\Documents and Settings\Sébastien\Bureau\chercher\LFiles.exe
c:\Documents and Settings\Sébastien\Bureau\foto\jvtorrent.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\KillBox.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\UltraVNC-102-Setup.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Cleaner\ATF-Cleaner.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\BitLord_1.01.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\daemon403-x86.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\jv16pt_setup.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\chercher\LFiles.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\chercher\chercher\LFiles.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\Kaspersky\kav6.0.0.303fr.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\Spyware Doctor\sdsetup.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\WGA\RemoveWGA.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\Zebulon\beclean140.exe
c:\Documents and Settings\Sébastien\Bureau\Francis\Prog toute sorte\Zebulon\ccsetup131.exe
c:\Documents and Settings\Sébastien\Bureau\Sébastien\iTunesSetup.exe
c:\Documents and Settings\Sébastien\Bureau\Sébastien\LimeWireWin.exe
c:\Documents and Settings\Sébastien\Bureau\Sébastien\mIRC\mirc.exe
c:\Documents and Settings\Sébastien\Bureau\Sébastien\mIRC\download\360view_setup.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\ACDSee\ACDsee Powerpack 603 fr\acdseepowerpack-fr.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\ACDSee\ACDsee Powerpack 603 fr\acd62pwpck\Crack ACDSEE 5 ou 6.XXX.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\adaware SE pro 1.5\Ad-Aware Se Pro.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\adaware SE pro 1.5\Ad-Aware_SE_1.x_Personal_Plus_Pro_FR.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Asian Language Files\Chinese Simplified\alf_chs.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Asian Language Files\Chinese Traditional\alf_cht.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Asian Language Files\Japanese\alf_jpn.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Asian Language Files\Korean\alf_kor.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Deutsch\Installer\instmsia.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Deutsch\Installer\instmsiw.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Deutsch\Installer\setup.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\English\Installer\instmsia.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\English\Installer\instmsiw.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\English\Installer\setup.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Français\Installer\instmsia.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Français\Installer\instmsiw.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Adobe Reader 6.0\Français\Installer\setup.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Advanced System Optimizer 2.10\asov2.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Antivirus\Ad-Aware SE Plus Edition\aawseplus.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Antivirus\Adaware106\aawsepersonal.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Antivirus\Avast.professional_4.6.7\Avast.Professional-v4.6.744-BSoft.ru\keygen.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Antivirus\Avast.professional_4.6.7\Avast.Professional-v4.6.744-BSoft.ru\setupengpro.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Antivirus\Spybot14\spybotsd14.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Diskeeper Workstation v7.0 Build 430\instmsia.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Diskeeper Workstation v7.0 Build 430\instmsiw.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Diskeeper Workstation v7.0 Build 430\setup.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Nero 6.6.0.12 fr\Nero-6.6.0.12.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Nero 6.6.0.12 fr\Nero-6.6.0.12_fra.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Nero 6.6.0.12 fr\NVE-3.1.0.0.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Nero 6.6.0.12 fr\NVE-3.1.0.0_fra.exe
c:\Documents and Settings\Sébastien\Mes documents\Mes downloads\Norton antivirus corporate client 80c\Symantec AntiVirus Client.exe
c:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP6\Bases\avcmhk4.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{26506DFF-0588-41CD-856D-7667C01AE7CA}\mpengine.dll
c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Expsrv.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msado15.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msadox.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msadrh15.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msjet40.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msjetoledb40.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msjint40.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msjro.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msjter40.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Msjtes40.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\Mswstr10.dll
c:\Documents and Settings\Propriétaire\Application Data\Creative\Media Database\JetFileBackup\vbajet32.dll
c:\Documents and Settings\Sébastien\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
Vérifications de quelques clefs
Recherche de clefs EGDACCESS
HKLM\SOFTWARE\Microsoft\Windows\explorer\SharedTaskScheduler
Et voilà pour Killbox
Pocket Killbox version 2.0.0.648
Running on Windows XP as Sébastien(Administrator)
was started @ mercredi, août 16, 2006, 8:26 PM
# 1 [Delete on Reboot]
Path = C:\WINDOWS\System32\eae_s.dll
# 2 [Delete on Reboot]
Path = C:\WINDOWS\System32\fefcbd9_s.ocx
# 3 [Delete on Reboot]
Path = C:\WINDOWS\System32\ssmute.ini
# 4 [Delete on Reboot]
Path = C:\WINDOWS\System32\jjkkj.ini2
# 5 [Delete on Reboot]
Path = C:\WINDOWS\System32\jjkkj.bak2
# 6 [Delete on Reboot]
Path = C:\WINDOWS\System32\jjkkj.ini
# 7 [Delete on Reboot]
Path = C:\WINDOWS\System32\msnc-b-f.exe
# 8 [Delete on Reboot]
Path = C:\WINDOWS\Setup1.exe
# 9 [Delete on Reboot]
Path = C:\WINDOWS\temp.000
Killbox Closed(Exit) @ 8:26:43 PM
__________________________________________________
Pocket Killbox version 2.0.0.648
Running on Windows XP as Sébastien(Administrator)
was started @ jeudi, août 17, 2006, 11:32 AM
Killbox Closed(Exit) @ 11:33:00 AM
__________________________________________________
Pocket Killbox version 2.0.0.648
Running on Windows XP as Sébastien(Administrator)
was started @ jeudi, août 17, 2006, 11:33 AM
# 1 [Delete on Reboot]
Path = C:\WINDOWS\System32\eae_s.dll
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:33:59 AM
# 2 [Delete on Reboot]
Path = C:\WINDOWS\System32\fefcbd9_s.ocx
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:34:46 AM
# 3 [Delete on Reboot]
Path = C:\WINDOWS\System32\fefcbd9_s.ocx
# 4 [Delete on Reboot]
Path = C:\WINDOWS\System32\ssmute.ini
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:35:11 AM
# 5 [Delete on Reboot]
Path = C:\WINDOWS\System32\ssmute.ini
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:35:25 AM
# 6 [Delete on Reboot]
Path = C:\WINDOWS\System32\ssmute.ini
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:35:39 AM
# 7 [Delete on Reboot]
Path = C:\WINDOWS\System32\ssmute.ini
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:35:53 AM
# 8 [Delete on Reboot]
Path = C:\WINDOWS\System32\ssmute.ini
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:36:06 AM
# 9 [Delete on Reboot]
Path = C:\WINDOWS\System32\ssmute.ini
# 10 [Delete on Reboot]
Path = C:\WINDOWS\System32\msnc-b-f.exeC:\WINDOWS\System32\msnc-b-f.exe
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 11:36:27 AM
# 11 [Delete on Reboot]
Path = C:\WINDOWS\System32\msnc-b-f.exeC:\WINDOWS\System32\msnc-b-f.exe
Killbox Closed(Exit) @ 11:36:39 AM
__________________________________________________