avast n'est pas une application win 32 valide

[angeofvillerest23]

Voilà j'ai voulu faire un scan car je viens d'installer avast...et là j'ai un message d'erreur comme quoi avast n'est pas une application win 32 valide...je soupçonne un virus donc j'ai fais une recherche avec findy kill et j'ai eu ce rapport:

 

Que dois je faire d'autre pour fixer les bonnes choses?

 

Merci!

 

###################### [ FindyKill V4.714 ]

 

# User : Stef - PC-DE-STEF

# Emplacement : C:\Program Files\FindyKill

# Outils Mis a jours le 19/01/09 par Chiquitine29

# Recherche effectuée à 21:07:04 le 20/01/2009

# Windows Vista - Internet Explorer 7.0.6001.18000

 

# [ FindyKill V4.714 - Scan ] ##############

 

\\\\\\\\\\\\\\\\\\\\ [ Processus actifs ] ///////////////////

 

 

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

C:\Program Files\ATK Hotkey\ASLDRSrv.exe

C:\Program Files\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\ASUS\ASUS Live Update\ALU.exe

C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files\ATK Hotkey\Hcontrol.exe

C:\Program Files\ATK Hotkey\MsgTranAgt.exe

C:\Program Files\Wireless Console 2\wcourier.exe

C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe

C:\Program Files\P4G\BatteryLife.exe

C:\Program Files\ASUS\Splendid\ACMON.exe

C:\Windows\System32\ACEngSvr.exe

C:\Program Files\ATK Hotkey\ATKOSD.exe

C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

C:\Windows\System32\rundll32.exe

C:\Windows\system32\svchost.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\ATK Hotkey\KBFiltr.exe

C:\Program Files\ATK Hotkey\WDC.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\Windows\System32\svchost.exe

C:\Program Files\ATK Hotkey\HControlUser.exe

C:\Program Files\ATKOSD2\ATKOSD2.exe

C:\Windows\System32\svchost.exe

C:\Windows\RtHDVCpl.exe

C:\Windows\system32\PnkBstrA.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ChkMail\ChkMail\ChkMail.exe

C:\Program Files\ASUS\ATK Media\DMedia.exe

C:\Windows\ASScrPro.exe

C:\Windows\system32\svchost.exe

C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

C:\Windows\system32\svchost.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\IncrediMail\bin\IMApp.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\IncrediMail\bin\ImLpp.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\rundll32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Users\Stef\Downloads\ELIBAGLA.BBØABØØI.EXE

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Internet Explorer\iexplore.exe

 

\\\\\\\\\\\\\\\\\\ [ Fichiers/Dossiers infectieux ] ///////////////////

 

 

################## [ C:\ ]

 

Found ! [20/01/2009 20:18] - "C:\Muestras"

Found ! [20/01/2009 20:56] - C:\InfoSat.txt

 

################## [ C:\Windows ]

 

 

################## [ C:\Windows\Prefetch ]

 

 

################## [ C:\Windows\system32 ]

 

Found ! [20/01/2009 19:51] - C:\Windows\system32\a.bat

Found ! [20/01/2009 20:00] - C:\Windows\system32\mdelk.exe

Found ! [20/01/2009 20:00] - C:\Windows\system32\wintems.exe

Found ! [20/01/2009 19:50] - C:\Windows\system32\winupgro.exe

 

################## [ C:\Windows\system32\drivers ]

 

 

################## [ C:\Users\Stef\AppData\Roaming ]

 

Found ! [20/01/2009 19:58] - "C:\Users\Stef\AppData\Roaming\m\flec006.exe"

Found ! [20/01/2009 20:09] - "C:\Users\Stef\AppData\Roaming\m\shared"

Found ! [20/01/2009 20:18] - "C:\Users\Stef\AppData\Roaming\m"

Found ! [20/01/2009 20:18] - "C:\Users\Stef\AppData\Roaming\drivers"

Found ! [20/01/2009 19:56] - "C:\Users\Stef\AppData\Roaming\drivers\wfsintwq.sys"

Found ! [02/09/2005 09:03] - "C:\Users\Stef\AppData\Roaming\drivers\winupgro.exe"

Found ! [20/01/2009 20:18] - "C:\Users\Stef\AppData\Roaming\drivers\downld"

 

################## [ C:\Users\Stef\AppData\Local\Temp ]

 

 

\\\\\\\\\\\\\\\\\\ [ Registre / Startup ] ///////////////////

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

Sidebar=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

LightScribe Control Panel=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

DAEMON Tools Lite="C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

ehTray.exe=C:\Windows\ehome\ehTray.exe

IncrediMail=C:\Program Files\IncrediMail\bin\IncMail.exe /c

WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

Windows Defender=%ProgramFiles%\Windows Defender\MSASCui.exe -hide

CLMLServer="C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"

P2Go_Menu="C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"

NvCplDaemon=RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

NvMediaCenter=RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

HControlUser="C:\Program Files\ATK Hotkey\HcontrolUser.exe"

ATKOSD2="C:\Program Files\ATKOSD2\ATKOSD2.exe"

RtHDVCpl=RtHDVCpl.exe

SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

ChkMail=C:\Program Files\ChkMail\ChkMail\ChkMail.exe

ATKMEDIA=C:\Program Files\ASUS\ATK Media\DMedia.exe

ASUS Camera ScreenSaver=C:\Windows\AsScrProlog.exe

ASUS Screen Saver Protector=C:\Windows\ASScrPro.exe

NeroFilterCheck=C:\Windows\system32\NeroCheck.exe

Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

HP Software Update=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

MSServer=rundll32.exe C:\Windows\system32\wvUkIbaY.dll,#1

Windl=C:\WINDOWS\Windl\mirc.exe

avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

50bd75b2=rundll32.exe "C:\Windows\system32\iqeuwfwh.dll",b

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=

<NO NAME>=

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=

Installed=1

<NO NAME>=

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=

NoChange=1

Installed=1

<NO NAME>=

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=

Installed=1

<NO NAME>=

 

[HKEY_CURRENT_USER\software\local appwizard-generated applications\DestComp]

[HKEY_CURRENT_USER\software\local appwizard-generated applications\hprbui]

[HKEY_CURRENT_USER\software\local appwizard-generated applications\key_gen]

[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

 

\\\\\\\\\\\\\\\\\\ [ Registre / Clés infectieuses ] ///////////////////

 

 

Found ! - HKEY_USERS\S-1-5-21-1362013965-2266447467-1447862643-1000\Software\Local AppWizard-Generated Applications\winupgro

Found ! - HKEY_USERS\S-1-5-21-1362013965-2266447467-1447862643-1000\Software\FirtR

Found ! - HKEY_USERS\S-1-5-21-1362013965-2266447467-1447862643-1000\Software\MuleAppData

Found ! - HKEY_USERS\S-1-5-21-1362013965-2266447467-1447862643-1000\Software\Ubisoft

Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s

Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s

Found ! - HKEY_CURRENT_USER\Software\FirtR

Found ! - HKEY_CURRENT_USER\Software\MuleAppData

Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | drvsyskit

Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | german.exe

Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | mule_st_key

 

/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1

/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

 

\\\\\\\\\\\\\\\\\\ [ Etat / Services ] ///////////////////

 

 

# Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

 

/!\ Ndisuio - # Type de démarrage = 4

 

EapHost - # Type de démarrage = 3

 

Wlansvc - # Type de démarrage = 2

 

SharedAccess - # Type de démarrage = 2

 

wuauserv - # Type de démarrage = 2

 

/!\ wscsvc - # Type de démarrage = 4

 

/!\ WinDefend - # Type de démarrage = 4

 

 

\\\\\\\\\\\\\\\\\\ [ Recherche dans supports amovibles] ///////////////////

 

 

# Informations :

 

C: - Lecteur fixe

D: - Lecteur fixe

 

# Contenu de l'autorun : C:\autorun.inf

 

[autorun]

;bkbpktjryswrmuszhzvrasjisdjpuw

shellexecute="resycled\ntldr.com c:"

;ezbmulgzkdmnxuowjwygjtqgzzuoqdogompnliremznhykmgyefpbntrdjlnjzljbsjsk

shell\Open\command="resycled\ntldr.com c:"

;pbjhayqvttcdvhmyebmjvhszwyhdkqqngmnvfuujudairqjpikigtfsr

 

# Contenu de l'autorun : D:\autorun.inf

 

[autorun]

;tmilobuehbnvsmqdnnfoownxlqtffvqujswyaccraufflsicedospefmouzwlsndhknzwdnrntkzwwu

xknabifqkufthgdlre

shellexecute="resycled\ntldr.com d:"

;dligwxzsdmumpvddequfynmdueysxbukdakbifmxxhyroxuvknnrtdsvpgcknzduzhdzx

shell\Open\command="resycled\ntldr

 

# presence des fichiers :

 

Found ! [18/01/2009 13:12][-r-hs----] - C:\autorun.inf

Found ! [18/01/2009 13:12][-r-hs----] - D:\autorun.inf

 

 

\\\\\\\\\\\\\\\\\\ [ Registre / Mountpoint2 ] ///////////////////

 

Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\Shell\AutoRun\command

Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\Shell\open\Command

Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell\AutoRun\command

Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell\open\Command

Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ef387cc-b2fe-11dd-aa60-002354685cdd}\Shell\AutoRun\command

Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ef387cc-b2fe-11dd-aa60-002354685cdd}\Shell\open\Command

 

 

################## [ ! Fin du rapport # FindyKill V4.714 ! ]

[pear]

Bonsoir,

 

Fermez ou désactivez tous les programmes Antivirus, Antispyware, Pare-feu actifs car ils pourraient perturber le fonctionnement de cet outil

Cela est absolument nécessaire au succès de la procédure.

Bien évidemment, vous les rétablirez ensuite.

Nettoyage

Déconnectez-vous du net et désactivez l'antivirus (juste le temps de la procédure !)

Double cliquer sur le raccourci FindyKill sur le bureau

Au menu principal,choisir l'option 2 (Suppression)

 

il y aura 2 redémarrages du PC

Laissez travailler l'outil jusqu'à l'apparition du message "Nettoyage effectué !"

Ensuite postez le rapport C:\FindyKill.txt

 

Scan en ligne

NOTE: Le scan en ligne sera à faire avec Internet Explorer.

Désactiver l'antivirus actuel

Kaspersky

Sous Vista,il faut désactiver l'UAC, et cliquer droit sur Internet Explorer / Exécuter en tant qu'administrateur et coller l'URL de Kaspersky

http://www.kaspersky.com/kos/eng/partner/d...kavwebscan.html

Vider la corbeille.

* Cliquer sur Accept

* Une barre jaune va demander d'accepter l'installation de Kavwebscan_Unicode.cab, installer l'Active X.

* cliquer une nouvelle fois sur "Accept"

* Les bases de mises à jour vont s'installer, patienter un moment

* Cliquer sur Next.

* Cliquer sur My Computer, le scan se met en route;

attendre la fin du scan sans fermer la fenêtre sinon il s'arrêtera.

A la fin du scan, si des objets infectés sont découverts, cliquer sur Save report as... Choisirr bureau et nommer le rapport "rapport Kaspersky" et dans le champ d'enregistrement, choisir "fichiers texte" enregistrer le rapport.

Copier/coller l'entièreté du fichier texte ouvert, par clic droit dessus, sélectionner tout/copier.

Coller ce rapport dans la réponse sur le forum.

Aide en cas de problème

Cybersécurité

[angeofvillerest23]

Voilà le rapport...

 

de plus j'ai pu installer antivir et il est en train de scanner...

 

 

 

###################### [ FindyKill V4.714 ]

 

# User : Stef - PC-DE-STEF

# Executed from : C:\Program Files\FindyKill

# Update on 19/01/09 by Chiquitine29

# Start at 22:33:57 the 20/01/2009

# Windows Vista - Internet Explorer 7.0.6001.18000

 

# [ FindyKill V4.714 - Deleting ] ###############

 

\\\\\\\\\\\\\\\\\\ [ Active Processes ] ///////////////////

 

 

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\LogonUI.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

C:\Program Files\ATK Hotkey\ASLDRSrv.exe

C:\Program Files\ATKGFNEX\GFNEXSrv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\lpksetup.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\ASUS\ASUS Live Update\ALU.exe

C:\Program Files\ASUS\SmartLogon\sensorsrv.exe

C:\Windows\system32\svchost.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\PnkBstrA.exe

C:\Windows\system32\svchost.exe

C:\Program Files\ATK Hotkey\Hcontrol.exe

C:\Program Files\ATK Hotkey\MsgTranAgt.exe

C:\Program Files\Wireless Console 2\wcourier.exe

C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe

C:\Program Files\P4G\BatteryLife.exe

C:\Program Files\ASUS\Splendid\ACMON.exe

C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\ACEngSvr.exe

C:\Program Files\ATK Hotkey\ATKOSD.exe

C:\Program Files\ATK Hotkey\KBFiltr.exe

C:\Program Files\ATK Hotkey\WDC.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\runonce.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\wbem\wmiprvse.exe

 

\\\\\\\\\\\\\\\\\\ [ Infected Files / Folders ] ///////////////////

 

 

################## [ C:\ ]

 

Deleted ! - "C:\Muestras"

Deleted ! - C:\InfoSat.txt

 

################## [ C:\Windows ]

 

 

################## [ C:\Windows\Prefetch ]

 

 

################## [ C:\Windows\system32 ]

 

Deleted ! - C:\Windows\system32\a.bat

Deleted ! - C:\Windows\system32\mdelk.exe

Deleted ! - C:\Windows\system32\wintems.exe

Deleted ! - C:\Windows\system32\winupgro.exe

 

################## [ C:\Windows\system32\drivers ]

 

 

################## [ C:\Users\Stef\AppData\Roaming ]

 

Deleted ! - "C:\Users\Stef\AppData\Roaming\m\flec006.exe"

Deleted ! - "C:\Users\Stef\AppData\Roaming\m\shared"

Deleted ! - "C:\Users\Stef\AppData\Roaming\m"

Deleted ! - "C:\Users\Stef\AppData\Roaming\drivers\wfsintwq.sys"

Deleted ! - "C:\Users\Stef\AppData\Roaming\drivers\winupgro.exe"

Deleted ! - "C:\Users\Stef\AppData\Roaming\drivers\downld"

Deleted ! - "C:\Users\Stef\AppData\Roaming\drivers"

 

################## [ C:\Users\Stef\AppData\Local\Temp ]

 

 

################## [ C:\Users\Stef\Local Settings\Temporary Internet Files\Content.IE5 ]

 

 

\\\\\\\\\\\\\\\\\\ [ Registry / Infected keys ] ///////////////////

 

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S

Deleted ! - HKEY_CURRENT_USER\Software\FirtR

Deleted ! - HKEY_CURRENT_USER\Software\MuleAppData

Deleted ! - HKEY_USERS\S-1-5-21-1362013965-2266447467-1447862643-1000\Software\Local AppWizard-Generated Applications\winupgro

Deleted ! - HKEY_USERS\S-1-5-21-1362013965-2266447467-1447862643-1000\Software\MuleAppData

Deleted ! - HKEY_USERS\S-1-5-21-1362013965-2266447467-1447862643-1000\Software\Ubisoft

 

\\\\\\\\\\\\\\\\\\ [ States / Restarting of services ] ///////////////////

 

 

# Services : [ Auto=2 / Request=3 / Disable=4 ]

 

Ndisuio - # Type of startup = 3

 

EapHost - # Type of startup = 2

 

Wlansvc - # Type of startup = 2

 

SharedAccess - # Type of startup = 2

 

wuauserv - # Type of startup = 2

 

wscsvc - # Type of startup = 2

 

WinDefend - # Type of startup = 2

 

-> UAC is Enable

 

\\\\\\\\\\\\\\\\\\ [ Cleaning Removable drives ] ///////////////////

 

# Informations :

 

C: - Lecteur fixe

D: - Lecteur fixe

 

# deleting files :

 

Deleted ! - C:\autorun.inf

Deleted ! - D:\autorun.inf

 

\\\\\\\\\\\\\\\\\\ [ Registry / Mountpoint2 ] ///////////////////

 

Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\Shell\AutoRun\command

Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\Shell\open\Command

Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell\AutoRun\command

Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\Shell\open\Command

Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ef387cc-b2fe-11dd-aa60-002354685cdd}\Shell\AutoRun\command

Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ef387cc-b2fe-11dd-aa60-002354685cdd}\Shell\open\Command

 

\\\\\\\\\\\\\\\\\\ [ Searching Other Infections ] ///////////////////

 

Références de comparaison Bagle MD5 :

 

2144df1c C:\Users\Stef\AppData\Roaming\drivers\winupgro.exe

895c7dd60d43bc828d2355a956d9db27 C:\Users\Stef\AppData\Roaming\drivers\winupgro.exe

 

Suspect ! - 895c7dd60d43bc828d2355a956d9db27 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

 

\\\\\\\\\\\\\\\\\\ [ Searching Cracks / Keygen ] ///////////////////

 

C:\Users\Stef\Documents\Mes Jeux\Brothers In Arms Hell's Highway Crack NoCD - Activation Multilanguage - certified -.zip

C:\Users\Stef\Documents\Mes Jeux\Brothers in arms Hell's Highway crack [NoCD] - Multilanguage -.zip

C:\Users\Stef\Documents\Mes Jeux\pc game-Fallout 3 CrackFix JUST RELOADED!.rar

C:\Users\Stef\Documents\Mes Jeux\COD World at war\Call.Of.Duty.World.At.War-RELOADED NoCD.Crack.Patch.KEYGEN by d33VV

C:\Users\Stef\Documents\Mes Jeux\Far Cry 2\FAR CRY 2 (pc) FR-ENG-GER-SPA-ITA- crack simplifi‚ - by TEKNOMADE.iso

C:\Users\Stef\Documents\Mes Jeux\NBA 2007\Crack NO CD

C:\Users\Stef\Documents\Mes Jeux\NBA 2007\Keygen

C:\Users\Stef\Documents\Mes Jeux\NBA 2007\Crack NO CD\nbalive07.exe

C:\Users\Stef\Documents\Mes Jeux\NBA 2007\Keygen\rld-nba7.exe

C:\Users\Stef\Documents\Mes Jeux\PES 2009\Pes 2009 Pro Evolution Soccer 2009 Dvd Completo Viene Con Crack Y Serial Descomprimir E Instalar Funciona Perfecto.rar

C:\Users\Stef\Documents\Mes Jeux\PES 2009\pes2009\Crack

C:\Users\Stef\Documents\Mes Jeux\PES 2009\pes2009\Crack\pes2009.exe

C:\Users\Stef\Documents\Mes Logiciels\CartoExplorer 3\Carto Exploreur 3.02 Crack‚.iso

C:\Users\Stef\Documents\Mes Logiciels\Magellan map send\Mapsend Direct Route Europe\crack

C:\Users\Stef\Documents\Mes Logiciels\Magellan map send\Mapsend Direct Route Europe\crack\Magellan - Mapsend DirectRoute Europe - v2.00c - no CD patch.txt

C:\Users\Stef\Documents\Mes Logiciels\Magellan map send\Mapsend Direct Route Europe\crack\MapSend.exe

C:\Users\Stef\Downloads\crack_3555.exe

C:\Users\Stef\Music\Uncommonmenfrommars - Noise pollution\10 Firecracker.mp3

C:\ProgramData\IncrediMail\Data\Sound\tchaikovsky_the_nutcracker.imw

 

################## [ ! End of report # FindyKill V4.714 ! ]