déplacement icone ou fichier

gaspar · le 20 février 2011

bonjour, http://forum.zebulon.fr/findpost-t183063-p1537217.html tonton 57 m'envoie ici car mon pc est infecté, que faut-il faire merci d'avance j'ai mmalware antimalware pourtant et en analyse détaillée il n'a rien trouvé

lance_yien · le 21 février 2011

Bonjour gaspar,

Très Important!

>>> A faire immédiatement:

- En haut de ce message cliquer sur le bouton "Suivre ce sujet", en choisissant "Notification immédiate" => "Soumettre" tu seras avisé en temps réel pour les réponses apportées à ton sujet et de ce fait, ta machine sera nettoyée dans les meilleurs délais.

- Sauvegarder (en copiant) tous les documents personnels sur un support autre que la partition système: Clé USB, CD/DVD, Disque Dur externe etc.

>>> Que faire durant ce nettoyage, merci de NE PAS utiliser, installer et/ou désinstaller aucun programme à part ceux qui sont proposés à chaque étape ce qui a pour but d'éviter tout problème d'incompatibilité entre les outils.

>>> Que faire à la réception de nouvelles instructions,

Lire la totalité du message.
Télécharger et enregistrer les utilitaires DIRECTEMENT sur le Bureau ou les déplacer (tout de suite après par un clic-droit dessus => "Couper" puis clic-droit sur le Bureau => "Coller".
Certains programmes peuvent créer des problèmes s'ils ne sont pas lancés depuis le Bureau.
Prendre l'habitude de désactiver tous les programmes de protection au début de chaque nouvelle étape et de les réactiver à la fin.
Procéder toujours dans l'ordre donné et demander des clarifications si nécessaire AVANT de commencer.
NE PAS hésiter à commenter et signaler tout changement (en bien ou en mal) dans le comportement de la machine ou par rapport au problème initial.

>>> Comment répondre:

- Cliquer sur le bouton (et non sur car je n'ai pas besoin de relire mes messages précédents).

- Coller le contenu des rapports SANS y ajouter AUCUN formatage de texte (en citation, code, couleur etc...).

Imprimer ces instructions ou les enregistrer dans un fichier texte sur le Bureau pour les consulter facilement à tout moment et télécharger, sur le Bureau:

ComboFix© (par sUBs) depuis ici ou ici
Security Check (par screen317) depuis ici ou ici.
TDSSKiller.zip depuis ici et le dé-zipper (clic-droit => "Extraire ici").

>>> TDSSKiller: Dézipper TDSSKiller.zip (clic-droit dessus => "Extraire ici". Glisser TDSSKiller.zip dans la corbeille pour le supprimer.

Fermer tout et désactiver antivirus et tout autre programme de protection. Cliquer sur TDSSKiller.exe pour lancer le programme.
Cliquer sur le bouton Start Scan et patienter jusqu'à la fin de l'analyse.
Si un fichier infecté est détecté, l'action par défaut sera Cure. Cliquer sur le bouton Continue Sans rien changer.
Si un fichier suspect est détecté, l'action par défaut sera Skip. Cliquer sur le bouton Continue Sans rien changer.

Si vous êtes invité à redémarre la machine pour finir le processus (reboot the computer to complete the process), cliquez sur le bouton Reboot Now. Le rapport sera sauvegardé à la racine de la partition système, là où Windows est installé (généralement C:\); son format est du type "TDSSKiller.[Version]_[Date]_[Heure]_log.txt" (par exemple, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt). Poster son contenu.

Si aucun redémarrage n'est requis, cliquer sur Report. Un fichier texte s'ouvre et sera sauvegardé de la même manière, poster son contenu.

>>> Utiliser ComboFix: Fermer toutes les applications et fenêtres ouvertes, désactiver antivirus/ pare-feu/ antispyware et cliquer ComboFix.exe. Suivre les instructions.

Accepter l'Agrément de la licence et l'installation de la Console de Récupération (proposée sous XP si pas installée).

NE PAS TOUCHER la machine avant la fin (même si les choses semblent ne pas avancer).

Quand c'est fini, un rapport (ComboFix.txt) s'affiche. Il est sauvegardé, automatiquement, à la racine de la partition système (généralement C:\)

Poster son contenu.

>>> Utiliser SecurityCheck: Fermer tout et double-cliquer sur "SecurityCheck.exe" pour lancer le programme.

Appuyer sur une touche comme demandé et suivre les indications.

Note: Si un des programmes de sécurité demande la permission d'accéder à Internet depuis dig.exe, acceptez.

Le Rapport checkup.txt s'ouvre à la fin. Poster son contenu.

Ce rapport ne sera pas enregistré automatiquement. Si vous voulez en garder une copie, cliquez sur "Fichier" => "Enregistrer sous", choisissez un endroit (Bureau par exemple) et cliquez sur "Enregistrer" en bas à droite.

Poster son contenu.

Rapports demandés:

TDSSKiller_log.txt
ComboFix.txt
checkup.txt

Un changement quelconque?

gaspar · le 21 février 2011

bonjour lance, et merci de t'intéresser à mes problèmes, panda scan m'a trouvé un virus, trojan CI-a sans le détruire, hijackthis a trouvé 61 fichiers mauvais, j'ai essayé 3 fois en les cochant de les détruire, rien à faire, bon je te suis : tdss killer dit infection not found, donc il a rien trouvé ? combofix a lancé son scan, j'ai pas touché le pc jusqu'à la fin, après reboot tout était bloqué, impossible de faire aucune opération sur le pc, j'ai redémarré et tout fonctionne, sauf mon icone déplacement toujours là, et firefox avait disparu remplacé par IE pas bien ça. donc je vais continuer avec security check, encore merci lance à tout à l'heure

ComboFix 11-02-20.03 - Henri 21/02/2011 16:23:04.1.2 - x86

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.2046.962 [GMT 1:00]

Lancé depuis: c:\users\Henri\Downloads\ComboFix.exe

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\progra~2\xp

c:\progra~2\xp\EBLib.dll

c:\progra~2\xp\TPwSav.sys

c:\users\Henri\so_activex.dll

c:\windows\es.exe

c:\windows\pthreadGC2.dll

c:\windows\system32\msvbvm60.$$A

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_BOONTY_GAMES

-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers créés du 2011-01-21 au 2011-02-21 ))))))))))))))))))))))))))))))))))))

.

2011-02-21 11:34 . 2011-02-21 11:34 -------- d-----w- c:\program files\Softonic.France

2011-02-21 11:07 . 2011-02-21 15:04 -------- d-----w- c:\progra~2\Comodo

2011-02-21 11:07 . 2011-02-21 11:07 1700352 ----a-w- c:\windows\system32\gdiplus.dll

2011-02-21 10:39 . 2011-02-21 10:39 -------- d-----w- c:\users\Henri\AppData\Roaming\Uniblue

2011-02-21 10:39 . 2011-02-21 10:39 -------- dc-h--w- c:\progra~2\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}

2011-02-21 10:39 . 2011-02-21 10:39 -------- d-----w- c:\program files\Uniblue

2011-02-21 10:38 . 2011-02-21 10:38 -------- d-----w- c:\users\Henri\AppData\Local\PackageAware

2011-02-21 10:10 . 2011-01-13 09:41 5890896 ----a-w- c:\progra~2\Microsoft\Windows Defender\Definition Updates\{6C276A08-A374-4AB5-857E-D0094CF453EC}\mpengine.dll

2011-02-20 22:33 . 2009-06-30 09:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys

2011-02-20 22:32 . 2011-02-20 22:32 -------- d-----w- c:\program files\Panda Security

2011-02-20 20:06 . 2011-02-20 20:06 388096 ----a-r- c:\users\Henri\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-02-20 15:48 . 2011-02-20 15:48 13585 ----a-w- c:\progra~2\xml1E0C.tmp

2011-02-20 15:48 . 2011-02-20 15:48 0 ----a-w- c:\progra~2\xml1F65.tmp

2011-02-20 15:48 . 2011-02-20 15:48 0 ----a-w- c:\progra~2\xml1E99.tmp

2011-02-20 15:48 . 2011-02-20 15:48 7415 ----a-w- c:\progra~2\xml168C.tmp

2011-02-18 22:26 . 2011-02-20 22:00 -------- d-----w- c:\progra~2\PCPitstop

2011-02-18 22:25 . 2011-02-18 22:26 -------- d-----w- c:\program files\CrystalDiskInfo

2011-02-18 20:41 . 2011-02-18 21:10 -------- d-----w- c:\progra~2\SystemExplorer

2011-02-18 20:41 . 2011-02-18 20:41 -------- d-----w- c:\program files\System Explorer

2011-02-18 16:35 . 2011-02-18 16:35 -------- d-----w- c:\program files\Ad-Remover

2011-02-18 15:04 . 2011-02-18 15:04 -------- d-----w- c:\program files\ZHPFix

2011-02-18 14:38 . 2011-02-21 09:49 -------- d-----w- c:\program files\ZHPDiag

2011-02-15 15:07 . 2011-02-15 15:07 -------- d-----w- c:\program files\Common Files\Windows Live

2011-02-15 15:04 . 2010-01-25 12:58 473088 ----a-w- c:\windows\system32\secproc_isv.dll

2011-02-15 15:04 . 2010-01-25 12:58 472576 ----a-w- c:\windows\system32\secproc.dll

2011-02-15 15:04 . 2010-01-25 08:36 435712 ----a-w- c:\windows\system32\RMActivate_ssp.exe

2011-02-15 15:04 . 2010-01-25 08:35 523776 ----a-w- c:\windows\system32\RMActivate_isv.exe

2011-02-15 15:04 . 2010-01-25 08:36 515584 ----a-w- c:\windows\system32\RMActivate.exe

2011-02-15 15:04 . 2010-01-25 12:58 154624 ----a-w- c:\windows\system32\secproc_ssp_isv.dll

2011-02-15 15:04 . 2010-01-25 12:58 154112 ----a-w- c:\windows\system32\secproc_ssp.dll

2011-02-15 15:04 . 2010-01-25 12:56 312320 ----a-w- c:\windows\system32\msdrm.dll

2011-02-15 15:04 . 2010-01-25 08:36 431104 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-02 16:11 . 2009-12-08 17:25 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-12-21 08:48 . 2010-12-21 08:48 2968064 ----a-w- c:\windows\es.scr

2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-19 68856]

"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [2011-01-21 67456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-10-07 2620336]

"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-10-07 904880]

"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2007-10-07 140568]

"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]

"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-04-10 413696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"TOSHIBA Online Product Information"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2225186546-478183646-4290705749-1000]

"EnableNotificationsRef"=dword:00000003

R2 gupdate1c9c2981aea6420;Google Update Service (gupdate1c9c2981aea6420);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-21 133104]

R3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\DRIVERS\TpChoice.sys [x]

R4 CplIR;Embedded IR Driver;c:\windows\system32\DRIVERS\CplIR.SYS [2007-03-06 14848]

S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-30 28552]

S1 aswSP;aswSP; [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]

S2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPO\TempoSVC.exe [2007-10-29 95624]

.

Contenu du dossier 'Tâches planifiées'

2011-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-21 15:44]

2011-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-21 15:44]

2011-02-21 c:\windows\Tasks\RegistryBooster.job

- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]

2011-02-21 c:\windows\Tasks\User_Feed_Synchronization-{292548E3-D7FD-4F81-9069-F7F0B755792F}.job

- c:\windows\system32\msfeedssync.exe [2010-04-03 04:54]

.

------- Examen supplémentaire -------

.

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Henri\AppData\Roaming\Mozilla\Firefox\Profiles\cz563vbu.default\

FF - prefs.js: browser.search.selectedEngine - MyStart Search

FF - prefs.js: browser.startup.homepage - hxxp://fr.news.yahoo.com/

FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=IM3DJUN09FFAB&search=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Walnut for Firefox: {5A170DD3-63CA-4c58-93B7-DE9FF536C2FF} - %profile%\extensions\{5A170DD3-63CA-4c58-93B7-DE9FF536C2FF}

FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com

FF - Ext: Softonic.France Community Toolbar: {c41be492-d9e6-4262-a0bd-e8cf6dc4208d} - %profile%\extensions\{c41be492-d9e6-4262-a0bd-e8cf6dc4208d}

.

- - - - ORPHELINS SUPPRIMES - - - -

Toolbar-Locked - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

HKLM-Run-PC Pitstop PC Matic Reminder - c:\program files\PCPitstop\PC Matic\Reminder-PCMatic.exe

AddRemove-Microsoft_World_of_Flight - f:\data\00Setup\App\Uninstal.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-02-21 16:41

Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,98,d3,d1,92,9b,0f,51,4e,b8,8d,7f,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,98,d3,d1,92,9b,0f,51,4e,b8,8d,7f,\

[HKEY_LOCAL_MACHINE\SOFTWARE\Chicony Electronics Co.,Ltd.\Camera Assistant Software for Toshiba]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\OpenWithProgIds]

@DACL=(02 0000)

"avifile"=hex(0):

"WMP11.AssocFile.AVI"=hex(0):

"QuickTime.avi"=hex(0):

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\ShellEx]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\IncrediMail\AddOns\LetterWizard\System]

@DACL=(02 0000)

"VipSupport"="97EA3982-945A-4E07-AA84-9C3A79202230"

@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\InstalledOptions\Synaptics]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Extensions]

@DACL=(02 0000)

"IncludedExtensions"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Mappings]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Protocols]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Sites]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages]

@DACL=(02 0000)

"NewStartPageIdentifier"=dword:00000004

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StreamLog]

@DACL=(02 0000)

"CurrentStreamLog"=dword:00000006

"MaxLogs"=dword:00000005

"StreamLogCount"=dword:00000005

[HKEY_LOCAL_MACHINE\SOFTWARE\Waves Audio\MaxxAudio]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{0643592e-b1bf-417b-9488-49ecef912647}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0c001b38

"Dhcpv6State"=dword:00000000

"NameServer"=""

"Domain"=""

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{18a9e679-5533-4c3c-872c-a81e4acba966}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:07020054

"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{28c73641-4d11-4a8e-b83c-4ef178270df8}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0d000000

"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{634c0cd1-aae5-4787-aac0-3b626ec0c369}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0c0016d4

"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9c642153-bfe0-4511-a0b6-e778ddd5ea9e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:07001422

"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{b77f9962-4d41-4001-99c5-c7f736bc6adf}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:090016e3

"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{cd9080e7-2f96-43c2-9083-c351402cce28}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0c001b38

"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{ed906096-f6e9-4f4a-938f-3af9fab3537a}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0e001cbf

"Dhcpv6State"=dword:00000000

"NameServer"=""

"Domain"=""

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f50c0996-5b4a-4c6a-a322-6e991d4caa0e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:06001422

"Dhcpv6State"=dword:00000000

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\program files\Common Files\Acronis\Schedule2\schedul2.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\windows\System32\tcpsvcs.exe

c:\program files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

c:\windows\system32\TODDSrv.exe

c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe

c:\program files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

c:\program files\Alwil Software\Avast5\AvastUI.exe

.

**************************************************************************

.

Heure de fin: 2011-02-21 16:49:02 - La machine a redémarré

ComboFix-quarantined-files.txt 2011-02-21 15:48

Avant-CF: 66 338 947 072 octets libres

Après-CF: 65 891 782 656 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,11

- - End Of File - - BCBF5881BF3CEB39B16C436211046FE6

gaspar · le 21 février 2011

bon j'ai vérifié avec hijackthis, les 61 fichiers dangereux sont toujours là, j'ai lancé security check et j'ai trouvé le rapport, apparemment ila scanné sans que je m'en aperçoive, voici le rapport

@echo off

cd %~dp0

title Security Check

color F

set cleanver=0.99.8

echo.

echo.`````````````````````````Security Check by screen317`````````````````````````

echo.

echo.This will check your system and display the security programs on your computer.

echo.

echo.`````````If you don't want this done for any reason, please quit now.````````

echo.

pause

cls

echo.

:prep

If "%OS%"=="Windows_NT" (

goto NT

) else (

echo. UNSUPPORTED OPERATING SYSTEM! Aborting now! && echo. UNSUPPORTED OPERATING SYSTEM! ABORTED!>>checkup.txt

)

goto preend

:NT

if exist checkup.txt del /q /f *.txt

echo. Results of screen317's Security Check version %cleanver% >prelimcheckup.txt

echo.

echo. ``Collecting information``

"%cd%\Other\cmdinfo.exe">check.txt

find /i "OS type" check.txt>OS1check.txt

@FOR /F "eol=- tokens=3-6* delims= " %%d in (OS1check.txt) do @echo. %%d %%e %%f %%g %%h>OS1check2.txt

@find /i "vista" OS1check2.txt>nul && set OS1=Windows Vista

@find /i "XP" OS1check2.txt>nul && set OS1=Windows XP

@find /i "2000" OS1check2.txt>nul && set OS1=Windows 2000

@find /i "7" OS1check2.txt>nul && set OS1=Windows 7

@find /i "Service Pack" check.txt>OS2check.txt

@find /i "1" OS2check.txt>nul && set OS2=Service Pack 1

@find /i "2" OS2check.txt>nul && set OS2=Service Pack 2

@find /i "3" OS2check.txt>nul && set OS2=Service Pack 3

@find /i "4" OS2check.txt>nul && set OS2=Service Pack 4

"%cd%\Other\swreg.exe" query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System">UAC.txt

@find /i "EnableLUA" "UAC.txt">"UAC2.txt"

@find /I "1 " "UAC2.txt">nul && set UAC=(UAC is enabled)

@find /I "0 " "UAC2.txt">nul && set UAC=(UAC is disabled!)

:uacskip

echo. %OS1% %OS2% %UAC%>>prelimcheckup.txt

@find /i "windows" "prelimcheckup.txt">nul || echo. Error getting OS version

@find /i "2000" prelimcheckup.txt>nul && @find /i "2000 Service Pack 4" prelimcheckup.txt>nul || echo. Out of date service pack!!>>prelimcheckup.txt

@find /i "Vista" prelimcheckup.txt>nul && @find /i "Vista Service Pack 2" prelimcheckup.txt>nul || echo. Out of date service pack!!>>prelimcheckup.txt

@find /i "XP" prelimcheckup.txt>nul && @find /i "XP Service Pack 3" prelimcheckup.txt>nul || echo. Out of date service pack!!>>prelimcheckup.txt

:IE version

"%cd%\other\SWreg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version Vector">IEversion.txt

Find /I "IE" "IEVersion.txt">IEVersion2.txt

@FOR /F "eol=- tokens=1-3* delims= " %%a in (IEVersion2.txt) do echo.%%c>IEVersion3.txt

@FOR /F "eol=- tokens=1 delims=." %%# in (IEVersion3.txt) do (

if "%%#" LSS "8" (

echo. Internet Explorer %%# Out of date!>>prelimcheckup.txt

) else (

echo. Internet Explorer 8 >>prelimcheckup.txt

)

cls

echo.

echo. Collecting Information Done

"%cd%\Other\nircmdc.exe" wait 3000

:preparing

cls

echo.

echo. ``Preparing``

objlist.exe "programlist"

if exist install.txt goto processlist1

objlist.exe "programlist"

if exist install.txt goto processlist1

objlist.exe "programlist"

if exist install.txt goto processlist1

if ERRORLEVEL 1 echo. Error creating install.txt after 3 tries! Trying alternate method...>>prelimcheckup.txt

uninstalllist.exe

:processlist1

objlist.exe "processlist"

if exist process.txt goto preantivirus

objlist.exe "processlist"

if exist process.txt goto preantivirus

objlist.exe "processlist"

if exist process.txt goto preantivirus

if ERRORLEVEL 1 echo. Error creating process.txt after after 3 tries! Trying Alternate method...>>prelimproccheck.txt

runprocesses.exe

if exist process.txt (

goto preantivirus

) else (

echo. Error creating Process List-- tell your Helper>>prelimcheckup.txt

)

:preantivirus

cls

echo.

echo. ``Preparing Done!``

"%cd%\Other\nircmdc.exe" wait 3000

goto antivirus

:antivirus

echo.

echo.``````````````````````````````>>prelimcheckup.txt

echo.Antivirus/Firewall Check:>>prelimcheckup.txt

if not exist "C:\windows\system32\sc.exe" goto skipwscsvccheck && echo. sc.exe missing!>>prelimcheckup.txt

sc query "wscsvc">wscsvc1.txt

@find /I "RUNNING" wscsvc1.txt>nul || echo. Windows Security Center service is not running! This report may not be accurate!>>prelimcheckup.txt

:skipwscsvccheck

if not exist "C:\windows\system32\netsh.exe" goto skipfirewallcheck && echo. netsh.exe missing!>>prelimcheckup.txt

netsh firewall show state>fw1.txt

"%cd%\Other\nircmdc.exe" wait 2000

@find /I "Operational" fw1.txt>fw2.txt

@find /I "Enable" fw2.txt >nul && echo. Windows Firewall Enabled! >>prelimcheckup.txt

@find /I "Disable" fw2.txt >nul && echo. Windows Firewall Disabled! >>prelimcheckup.txt

:skipfirewallcheck

FIND /I "V3 VirusBlock" install.txt>>prelimviruscheck.txt

FIND /V /I "V3 VirusBlock" install.txt>install2.txt

FIND /I "avast! 4 Small Business Server Edition" install2.txt>>prelimviruscheck.txt

FIND /V /I "avast! 4 Small Business Server Edition" install2.txt>install3.txt

FIND /I "avast! Antivirus" install3.txt>>prelimviruscheck.txt

FIND /V /I "avast! Antivirus" install3.txt>install4.txt

FIND /I "avast! 4 SBS Edition" install4.txt>>prelimviruscheck.txt

FIND /V /I "avast! 4 SBS Edition" install4.txt>install5.txt

FIND /I "AVG Internet Security" install5.txt>>prelimviruscheck.txt

FIND /V /I "AVG Internet Security" install5.txt>install6.txt

FIND /I "AVG Anti-Virus" install6.txt>>prelimviruscheck.txt

FIND /V /I "AVG Anti-Virus" install6.txt>install7.txt

FIND /I "avast!" install7.txt>>prelimviruscheck.txt

FIND /V /I "avast!" install7.txt>install8.txt

FIND /I "AVG" install8.txt>>prelimviruscheck.txt

FIND /V /I "AVG" install8.txt>install9.txt

FIND /I "Avira AntiVir Personal - Free Antivirus" install9.txt>>prelimviruscheck.txt

FIND /V /I "Avira AntiVir Personal - Free Antivirus" install9.txt>install10.txt

FIND /I "Avira AntiVir Premium" install10.txt>>prelimviruscheck.txt

FIND /V /I "Avira AntiVir Premium" install10.txt>install11.txt

FIND /I "Avira AntiVir Professional" install11.txt>>prelimviruscheck.txt

FIND /V /I "Avira AntiVir Professional" install11.txt>install12.txt

FIND /I "Avira" install12.txt>>prelimviruscheck.txt

FIND /V /I "Avira" install12.txt>install13.txt

FIND /I "Rising Antivirus" install13.txt>>prelimviruscheck.txt

FIND /V /I "Rising Antivirus" install13.txt>install14.txt

FIND /I "BullGuard" install14.txt>>prelimviruscheck.txt

FIND /V /I "BullGuard" install14.txt>install15.txt

FIND /I "eTrust Antivirus" install15.txt>>prelimviruscheck.txt

FIND /V /I "eTrust Antivirus" install15.txt>install16.txt

FIND /I "Quick Heal" install16.txt>>prelimviruscheck.txt

FIND /V /I "Quick Heal" install16.txt>install17.txt

FIND /I "ClamWin" install17.txt>>prelimviruscheck.txt

FIND /V /I "ClamWin" install17.txt>install18.txt

FIND /I "EarthLink Protection" install18.txt>>prelimviruscheck.txt

FIND /V /I "EarthLink Protection" install18.txt>install19.txt

FIND /I "Aluria Security" install19.txt>>prelimviruscheck.txt

FIND /V /I "Aluria Security" install19.txt>install20.txt

FIND /I "Digital Security Blink Professional" install20.txt>>prelimviruscheck.txt

FIND /V /I "Digital Security Blink Professional" install20.txt>install21.txt

FIND /I "NOD32 Antivirus" install21.txt>>prelimviruscheck.txt

FIND /V /I "NOD32 Antivirus" install21.txt>install22.txt

FIND /I "ESET" install22.txt>>prelimviruscheck.txt

FIND /V /I "ESET" install22.txt>install23.txt

FIND /I "F-Prot Antivirus" install23.txt>>prelimviruscheck.txt

FIND /V /I "F-Prot Antivirus" install23.txt>install24.txt

FIND /I "F-Secure Anti-Virus" install24.txt>>prelimviruscheck.txt

FIND /V /I "F-Secure Anti-Virus" install24.txt>install25.txt

FIND /I "F-Secure Internet Security" install25.txt>>prelimviruscheck.txt

FIND /V /I "F-Secure Internet Security" install25.txt>install26.txt

FIND /I "ViRobot Expert" install26.txt>>prelimviruscheck.txt

FIND /V /I "ViRobot Expert" install26.txt>install27.txt

FIND /I "Kaspersky Anti-Virus" install27.txt>>prelimviruscheck.txt

FIND /V /I "Kaspersky Anti-Virus" install27.txt>install28.txt

FIND /I "Kaspersky Internet Security" "install28.txt" >>prelimviruscheck.txt

FIND /V /I "Kaspersky Internet Security" "install28.txt" >install29.txt

FIND /I "McAfee VirusScan" "install29.txt" >>prelimviruscheck.txt

FIND /V /I "McAfee VirusScan" "install29.txt" >install30.txt

FIND /I "McAfee Total Protection" "install30.txt" >>prelimviruscheck.txt

FIND /V /I "McAfee Total Protection" "install30.txt" >install31.txt

FIND /I "McAfee Internet Security" "install31.txt" >>prelimviruscheck.txt

FIND /V /I "McAfee Internet Security" "install31.txt" >install32.txt

FIND /I "OneCare" "install32.txt" >>prelimviruscheck.txt

FIND /V /I "OneCare" "install32.txt" >install33.txt

FIND /I "Norman" "install33.txt" >>prelimviruscheck.txt

FIND /V /I "Norman" "install33.txt" >install34.txt

FIND /I "Panda for Desktops" "install34.txt" >>prelimviruscheck.txt

FIND /V /I "Panda for Desktops" "install34.txt" >install35.txt

FIND /I "OneCare" "install35.txt" >>prelimviruscheck.txt

FIND /V /I "OneCare" "install35.txt" >install36.txt

FIND /I "Panda Antivirus" "install36.txt" >>prelimviruscheck.txt

FIND /V /I "Panda Antivirus" "install36.txt" >install37.txt

FIND /I "Panda Internet Security" "install37.txt" >>prelimviruscheck.txt

FIND /V /I "Panda Internet Security" "install37.txt" >install38.txt

FIND /I "Panda Global Protection" "install38.txt" >>prelimviruscheck.txt

FIND /V /I "Panda Global Protection" "install38.txt" >install39.txt

FIND /I "Panda Platinum" "install39.txt" >>prelimviruscheck.txt

FIND /V /I "Panda Platinum" "install39.txt" >install40.txt

FIND /I "Panda Titanium" "install40.txt" >>prelimviruscheck.txt

FIND /V /I "Panda Titanium" "install40.txt" >install41.txt

FIND /I "BitDefender" "install41.txt" >>prelimviruscheck.txt

FIND /V /I "BitDefender" "install41.txt" >install42.txt

FIND /I "Sophos Anti-Virus" "install42.txt" >>prelimviruscheck.txt

FIND /V /I "Sophos Anti-Virus" "install42.txt" >install43.txt

FIND /I "Norton AntiVirus" "install43.txt" >>prelimviruscheck.txt

FIND /V /I "Norton AntiVirus" "install43.txt" >install44.txt

FIND /I "Symantec EndPoint Protection" "install44.txt" >>prelimviruscheck.txt

FIND /V /I "Symantec EndPoint Protection" "install44.txt" >install45.txt

FIND /I "Symantec Antivirus" "install45.txt" >>prelimviruscheck.txt

FIND /V /I "Symantec Antivirus" "install45.txt" >install46.txt

FIND /I "Norton Internet Security" "install46.txt" >>prelimviruscheck.txt

FIND /V /I "Norton Internet Security" "install46.txt" >install47.txt

FIND /I "Norton System Works" "install47.txt" >>prelimviruscheck.txt

FIND /V /I "Norton System Works" "install47.txt" >install48.txt

FIND /I "PC-Cillin Internet Security" "install48.txt" >>prelimviruscheck.txt

FIND /V /I "PC-Cillin Internet Security" "install48.txt" >install49.txt

FIND /I "Trend Micro Internet Security" "install49.txt" >>prelimviruscheck.txt

FIND /V /I "Trend Micro Internet Security" "install49.txt" >install50.txt

FIND /I "Online Armor 3.5" "install50.txt" >>prelimviruscheck.txt

FIND /V /I "Online Armor 3.5" "install50.txt" >install51.txt

FIND /I "Kerio Personal Firewall 2.1.5" "install51.txt" >>prelimviruscheck.txt

FIND /V /I "Kerio Personal Firewall 2.1.5" "install51.txt" >install52.txt

FIND /I "NETGEAR ProSafe Firewall Router" "install52.txt" >>prelimviruscheck.txt

FIND /V /I "NETGEAR ProSafe Firewall Router" "install52.txt" >install53.txt

FIND /I "Trend Micro Officescan Client" "install53.txt" >>prelimviruscheck.txt

FIND /V /I "Trend Micro Officescan Client" "install53.txt" >install54.txt

FIND /I "Authentium AntiVirus" "install54.txt" >>prelimviruscheck.txt

FIND /V /I "Authentium AntiVirus" "install54.txt" >install55.txt

FIND /I "Sunbelt Personal Firewall" "install55.txt" >>prelimviruscheck.txt

FIND /V /I "Sunbelt Personal Firewall" "install55.txt" >install56.txt

FIND /I "COMODO Firewall Pro" "install56.txt" >>prelimviruscheck.txt

FIND /V /I "COMODO Firewall Pro" "install56.txt" >install57.txt

FIND /I "Privatefirewall 6.1" "install57.txt" >>prelimviruscheck.txt

FIND /V /I "Privatefirewall 6.1" "install57.txt" >install58.txt

FIND /I "Comodo Firewall" "install58.txt" >>prelimviruscheck.txt

FIND /V /I "Comodo Firewall" "install58.txt" >install59.txt

FIND /I "Norton Personal Firewall" "install59.txt" >>prelimviruscheck.txt

FIND /V /I "Norton Personal Firewall" "install59.txt" >install60.txt

FIND /I "Aluria Firewall" "install60.txt" >>prelimviruscheck.txt

FIND /V /I "Aluria Firewall" "install60.txt" >install61.txt

FIND /V /I "EzTrends" "install61.txt" >install62.txt

FIND /I "Norton 360" "install62.txt">nul && echo. Norton 360>>prelimviruscheck.txt

FIND /V /I "Norton 360" "install62.txt" >install63.txt

FIND /I "TrustPort Antivirus" "install63.txt" >>prelimviruscheck.txt

FIND /V /I "TrustPort Antivirus" "install63.txt" >install64.txt

FIND /V /I "malw" "install64.txt" >install65.txt

FIND /V /I "virustotal" "install65.txt" >install66.txt

FIND /V /I "Comodo Memory Firewall" "install66.txt" >install67.txt

FIND /I "DriveSentry" "install67.txt" >>prelimviruscheck.txt

FIND /V /I "TrendProtect" "install67.txt" >install68.txt

FIND /V /I "SiteAdvisor" "install68.txt" >install69.txt

FIND /V /I "RegScanner" "install69.txt" >install70.txt

FIND /I "Outpost Firewall 2009" "install70.txt" >>prelimviruscheck.txt

FIND /V /I "Outpost Firewall 2009" "install70.txt" >install71.txt

"%cd%\other\SWreg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run">hklmrun.txt

FIND /I "iolo AntiVirus" "hklmrun.txt">nul && echo. iolo Antivirus>>prelimviruscheck.txt

FIND /I "iolo Personal Firewall" "hklmrun.txt">nul && echo. iolo Personal Firewall>>prelimviruscheck.txt

@FOR /F "eol=- tokens=1-5* delims= " %%a in (prelimviruscheck.txt) do @echo. %%a %%b %%c %%d %%e %%f>>prelimcheckup.txt

FIND /I "virus" "install71.txt" >>prelimviruscheck2.txt

FIND /V /I "virus" "install71.txt" >install72.txt

FIND /I "firewall" "install72.txt" >>prelimviruscheck2.txt

FIND /V /I "firewall" "install72.txt" >install73.txt

FIND /I "squared" "install73.txt" >>prelimviruscheck2.txt

FIND /I "DefenseWall" "install73.txt" >>prelimviruscheck2.txt

FIND /I "etrust" "install73.txt" >>prelimviruscheck2.txt

FIND /I "armor" "install73.txt" >>prelimviruscheck2.txt

FIND /I "McAfee" "install73.txt" >>prelimviruscheck2.txt

FIND /I "ZoneAlarm" "install73.txt" >>prelimviruscheck2.txt

FIND /I "bullguard" "install73.txt" >>prelimviruscheck2.txt

FIND /I "trend" "install73.txt" >>prelimviruscheck2.txt

FIND /I "prevx" "install73.txt" >>prelimviruscheck2.txt

FIND /I "outpost" "install73.txt" >>prelimviruscheck2.txt

FIND /I "AT^&T Internet Security" "install73.txt" >>prelimviruscheck2.txt

FIND /I "iolo" "install73.txt" >>prelimviruscheck2.txt

FIND /I "Microsoft Security Essentials" "install73.txt" >>prelimviruscheck2.txt

@FOR /F "eol=- tokens=1-5* delims= " %%4 in (prelimviruscheck2.txt) do @echo. %%4 %%5 %%6 %%7 %%8 %%9>>prelimcheckup.txt

If exist "%systemroot%\System32\wbem\wmic.exe" (

goto SecurityCenter

) else (

goto autoupdate

)

:SecurityCenter

find /i "Vista" "prelimcheckup.txt">nul && goto VistaWMI

find /i "Windows 7" "prelimcheckup.txt">nul && goto VistaWMI

find /i "XP" "prelimcheckup.txt">nul && goto XPWMI

:VistaWMI

@wmic /namespace:\\root\SecurityCenter2 PATH AntivirusProduct GET productUptoDate >AVupdatestatus.txt 2>nul

"%cd%\Other\nircmdc.exe" wait 2000

@wmic /namespace:\\root\securitycenter2 PATH antivirusproduct GET onaccessscanningenabled>AVscanstatus.txt 2>nul

"%cd%\Other\nircmdc.exe" wait 2000

goto next

:XPWMI

@wmic /namespace:\\root\SecurityCenter PATH AntivirusProduct GET productUptoDate >AVupdatestatus.txt 2>nul

"%cd%\Other\nircmdc.exe" wait 2000

@wmic /namespace:\\root\securitycenter PATH antivirusproduct GET onaccessscanningenabled>AVscanstatus.txt 2>nul

"%cd%\Other\nircmdc.exe" wait 2000

goto next

:next

if not exist AVupdatestatus.txt echo. WMIC error!>>prelimcheckup.txt && goto preantispy

if not exist AVscanstatus.txt echo. WMIC error!>>prelimcheckup.txt && goto preantispy

@Find /I "true" AVupdatestatus.txt>nul && set updatestatus=Antivirus up to date!

@Find /I "false" AVupdatestatus.txt>nul && set updatestatus=Antivirus out of date!

@find /i "false" AVscanstatus.txt>nul && set scanstatus=(On Access scanning disabled!)

if "%updatestatus% %scanstatus%"==" " (

echo. WMI entry may not exist for antivirus; attempting automatic update.>>prelimcheckup.txt

) && (

goto autoupdate

)

echo. %updatestatus% %scanstatus%>>prelimcheckup.txt

@find /i "date" prelimcheckup.txt>nul || @echo. Error obtaining update status for antivirus! >>prelimcheckup.txt

goto preantispy

:autoupdate

cls

echo.

echo. Attempting to update antivirus.

"%cd%\Other\nircmdc.exe" wait 3000

cls

if exist "%programfiles%\Avira\AntiVir Desktop\avcenter.exe" (

"%programfiles%\Avira\AntiVir Desktop\avcenter.exe" /STARTUPDATE

) && (

echo. Avira successfully updated!>>prelimcheckup.txt

)

if exist "%programfiles%\alwil software\avast4\ashupd.exe" (

"%programfiles%\alwil software\avast4\ashupd.exe" program /silent

) && (

echo. avast! successfully updated!>>prelimcheckup.txt

)

if exist "%programfiles%\Microsoft Security Essentials\MpCmdRun.exe" (

"%programfiles%\Microsoft Security Essentials\MpCmdRun.exe" /SignatureUpdate

) && (

echo. Microsoft Security Essentials successfully updated!>>prelimcheckup.txt

)

if exist "%programfiles%\AVG\AVG9\avgupd.exe" (

"%programfiles%\AVG\AVG9\avgupd.exe" /update

) && (

echo. AVG9 successfully updated!>>prelimcheckup.txt

)

echo.

:preantispy

"%cd%\Other\nircmdc.exe" wait 3000

cls

echo.

echo. ``Antivirus/Firewall Check Done!``

"%cd%\Other\nircmdc.exe" wait 3000

goto antispy

:antispy

echo.>>prelimcheckup.txt

echo.```````````````````````````````>>prelimcheckup.txt

echo.Anti-malware/Other Utilities Check:>>prelimcheckup.txt

FIND /I "spy" "install.txt" >prelimspycheck.txt

FIND /I "Destroy 1.3" "prelimspycheck.txt">nul && echo. Out of date Spybot installed!>>prelimcheckup.txt

FIND /I "Destroy 1.4" "prelimspycheck.txt">nul && echo. Out of date Spybot installed!>>prelimcheckup.txt

FIND /I "Destroy 1.5" "prelimspycheck.txt">nul && echo. Out of date Spybot installed!>>prelimcheckup.txt

FIND /I "Windows Defender" "install.txt" >>prelimspycheck.txt

FIND /I "ad-aware" "install.txt" >nul && echo. Ad-Aware>>prelimcheckup.txt

FIND /I "WinPatrol 2009" "install.txt" >nul && echo. WinPatrol 2009>>prelimcheckup.txt

FIND /I "WinPatrol 2008" "install.txt">nul && echo. WinPatrol 2008 (Outdated! Latest version is WinPatrol 2009)>>prelimcheckup.txt

FIND /I "WinPatrol 2007" "install.txt" >nul && echo. WinPatrol 2007 (Outdated! Latest version is WinPatrol 2009)>>prelimcheckup.txt

FIND /I "trendprotect" "install.txt" >>prelimspycheck.txt

FIND /I "ThreatFire" "install.txt" >>prelimspycheck.txt

FIND /I "Mamutu" "install.txt" >>prelimspycheck.txt

FIND /I "web of trust" "install.txt" >>prelimspycheck.txt

FIND /I "SpywareBlaster 4.1" "install.txt">nul && echo SpywareBlaster 4.1 Out of Date!>>prelimspycheck.txt

FIND /I "SpywareBlaster 4.2" "install.txt">nul && echo SpywareBlaster 4.2 Out of Date!>>prelimspycheck.txt

FIND /I "SpywareBlaster 4.3" "install.txt" >>prelimspycheck.txt

FIND /I "Finjan" "install.txt" >>prelimspycheck.txt

FIND /I "siteadvisor" "install.txt" >>prelimspycheck.txt

FIND /I "RegProt" "hklmrun.txt">nul && echo. DiamondCS RegProt>>prelimspycheck.txt

FIND /I "Norton Ghost" "install.txt" >>prelimspycheck.txt

if exist "%systemdrive%\IE-SPYAD" @echo. IE SpyAd >>prelimspycheck.txt

FIND /I "Secunia" "install.txt" >>prelimspycheck.txt

@COPY /Y "%SystemRoot%\system32\drivers\etc\HOSTS" "hostcopy.txt" >nul

FIND /I "MVPS" "hostcopy.txt" >>nul && echo. MVPS Hosts File >>prelimcheckup.txt

FIND /I "BOClean" "install.txt" >>prelimspycheck.txt

FIND /I "hosts" "install.txt" >>prelimspycheck.txt

FIND /I "virustotal" "install.txt" >>prelimspycheck.txt

FIND /I "Key Scrambler" "install.txt" >>prelimspycheck.txt

FIND /I "WindowsCare" "install.txt" >>prelimspycheck.txt

if exist "%windir%\gmer.exe" @echo. Gmer >>prelimspycheck.txt

FIND /I "RegSupreme" "install.txt" >>prelimspycheck.txt

FIND /I "Trojan Remover" "install.txt" >>prelimspycheck.txt

FIND /I "Free Internet Window Washer" "install.txt" >>prelimspycheck.txt

if exist "%userprofile%\Desktop\cwshredder.exe" @echo. CWShredder >>prelimspycheck.txt

FIND /I "rootkit" "install.txt" >>prelimspycheck.txt

FIND /I "Zemana" "install.txt" >>prelimspycheck.txt

FIND /I "Malwarebytes' Anti-Malware" "install.txt" > nul && echo. Malwarebytes' Anti-Malware >prelimspycheck.txt

FIND /I "HijackThis 1.99.1" "install.txt" >>prelimspycheck.txt && echo. Out of date HijackThis installed!>>prelimcheckup.txt

FIND /I "HijackThis 2.0.2" "install.txt" >>prelimspycheck.txt

FIND /I "HijackThis 2.0.3" "install.txt" >>prelimspycheck.txt

FIND /I "runscanner" "install.txt" >>prelimspycheck.txt

FIND /I "tuneup" "install.txt" >>prelimspycheck.txt

FIND /I "Comodo Memory Firewall" "install.txt" >>prelimspycheck.txt

FIND /I "cleaner" "install.txt" >>prelimspycheck.txt

FIND /I "RegScanner" "install.txt" >>prelimspycheck.txt

FIND /I "DriveSentry" "install.txt" >>prelimspycheck.txt

FIND /I "Java" "install.txt" >>prelimspycheck.txt

FIND /V "Java 6 Update 23" "prelimspycheck.txt">java.txt

FIND /I "Java 6 Update 1" "java.txt">nul && echo. Out of date Java installed!>>prelimspycheck.txt