Problem z usunieciem programu

**Posty:** 84 · przez **bandy** 06 Lip 2009, 16:09

Witam. Dostałem do naprawy kompa na którym jest mnóstwo syfu róznego i nie moge sobie ze wszystkim poradzić:) Jest tu zainstalowany pewien program do sciagania z ssieci jakis Free Download manager. Nie wiem cco to za cenzura ale przy skanowaniu oznaczylo mi jakies pliki z niego jako trojany. BTw próbowalem calość odinstalowac. Niby sioe udalo ale to było złudne poniewaz w tej chwili program i tak sie włacza przy starcie systemu a na liscie w menadzerze sie juz nie pojawia. Nie moge równiez odnaleźc katalogo w którym jest niby zainstalowany. Po trzecie pojawia mi sie non stop jakas reklama która w program meneger jest oznaczona jako program favourite ale tego tez nie moge odinstalowac w ogole:( to log z HJ

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:02:41, on 06/07/2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18248) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Windows Defender\MSASCui.exe C:\hp\support\hpsysdrv.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\mobsync.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Windows\System32\rundll32.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe C:\Program Files\Skype\Phone\Skype.exe C:\Users\andre\AppData\Local\kqyicig.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe C:\PROGRA~1\FREEDO~1\FDM.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cndt R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cndt R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cndt R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cndt R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe O1 - Hosts: ::1 localhost O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [DPService] "C:\Program Files\HP\DVDPlay\DPService.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [kqyicig] "c:\users\andre\appdata\local\kqyicig.exe" kqyicig O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: hpoddt01.exe.lnk = ? O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz plik wideo we Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Pobierz w Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Envoyer ŕ OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Envoyer ŕ OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe -- End of file - 8054 bytes

tu pewnie duzo syfu jest

aa dodam jeszcze jeden problem. Próbuje zainstalowac jakiegos antyvirusa ale przy klikaniu w install.exe windows w ogole nie rozpoczyna instalacji programu;/ nie wiem dlaczego

**Posty:** 18165 · przez **wojtas** 06 Lip 2009, 19:54

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 84 · przez **bandy** 06 Lip 2009, 20:19

oto log z combofixa

jak prosiłeś

opis jest po francusku bo jest na nim francuska vista ale to raczej nie problem bo to tylko godzina i takie tam

Kod: Zaznacz wszystko: ComboFix 09-07-05.04 - andre 06/07/2009 20:08.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.33.1036.18.1918.1227 [GMT 2:00] Lancé depuis: c:\users\andre\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1347411381-147541028-1793738660-500 c:\$recycle.bin\S-1-5-21-3327553885-3938062735-1467920761-1000 c:\$recycle.bin\S-1-5-21-4227231826-1027695528-279376433-500 c:\users\andre\AppData\Local\kqyicig.dat c:\users\andre\AppData\Local\kqyicig.exe c:\users\andre\AppData\Local\kqyicig_nav.dat c:\users\andre\AppData\Local\kqyicig_navps.dat . ((((((((((((((((((((((((((((( Fichiers créés du 2009-06-06 au 2009-07-06 )))))))))))))))))))))))))))))))))))) . 2009-07-06 18:12 . 2009-07-06 18:12 -------- d-----w- c:\users\andre\AppData\Local\temp 2009-07-06 15:27 . 2009-07-06 15:29 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-07-06 15:27 . 2009-07-06 15:41 -------- d-----w- c:\programdata\Avira 2009-07-06 14:02 . 2009-07-06 14:02 -------- d-----w- c:\program files\Trend Micro 2009-07-06 09:12 . 2009-07-06 09:12 -------- d-----w- c:\programdata\McAfee 2009-07-06 09:01 . 2009-07-06 09:10 -------- d-----w- c:\program files\SkanerOnline 2009-07-05 03:59 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll 2009-07-05 03:59 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2009-07-05 03:59 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll 2009-07-05 03:59 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll 2009-07-05 03:59 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe 2009-07-05 03:59 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll 2009-07-05 03:59 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe 2009-07-05 03:50 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll 2009-07-05 03:50 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll 2009-07-05 03:50 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll 2009-07-05 03:49 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll 2009-07-05 03:49 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll 2009-06-13 16:48 . 2009-06-13 16:48 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb9177.tmp.exe 2009-06-09 21:24 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys 2009-06-09 21:23 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-06 18:10 . 2008-07-26 08:25 669328 ----a-w- c:\windows\system32\perfh00C.dat 2009-07-06 18:10 . 2008-07-26 08:25 123350 ----a-w- c:\windows\system32\perfc00C.dat 2009-07-06 18:05 . 2008-10-30 16:39 -------- d-----w- c:\users\andre\AppData\Roaming\Skype 2009-07-06 18:03 . 2009-05-04 18:19 90 ----a-w- c:\users\andre\AppData\Local\iemme.bat 2009-07-06 16:16 . 2009-01-24 09:08 -------- d-----w- c:\users\andre\AppData\Roaming\Free Download Manager 2009-07-06 16:11 . 2008-10-31 10:56 206 ----a-w- c:\users\andre\AppData\Roaming\wklnhst.dat 2009-07-06 15:33 . 2008-10-30 17:19 -------- d-----w- c:\users\andre\AppData\Roaming\skypePM 2009-07-06 11:31 . 2008-07-25 22:46 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-06 10:58 . 2008-07-25 23:08 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-07-06 10:58 . 2008-12-13 08:00 -------- d-----w- c:\program files\Google 2009-07-06 10:58 . 2008-07-25 23:06 -------- d-----w- c:\program files\EasyBits For Kids 2009-07-06 10:34 . 2008-07-25 23:08 -------- d-----w- c:\programdata\Symantec 2009-07-06 09:23 . 2009-01-24 09:08 -------- d-----w- c:\program files\Free Download Manager 2009-07-06 08:58 . 2008-12-13 18:38 -------- d-----w- c:\users\andre\AppData\Roaming\LimeWire 2009-07-06 08:57 . 2008-12-13 18:37 -------- d-----w- c:\program files\LimeWire 2009-07-06 08:57 . 2008-11-22 16:26 -------- d-----w- c:\programdata\eMule 2009-07-05 08:03 . 2008-10-30 16:09 78728 ----a-w- c:\users\andre\AppData\Local\GDIPFONTCACHEV1.DAT 2009-07-05 04:19 . 2008-11-01 08:23 -------- d-----w- c:\programdata\Microsoft Help 2009-06-20 15:16 . 2008-11-22 16:14 -------- d-----w- c:\users\andre\AppData\Roaming\uTorrent 2009-06-10 12:26 . 2008-10-30 16:02 -------- d-----w- c:\program files\Microsoft Works 2009-05-24 07:39 . 2009-05-04 18:28 -------- d-----w- c:\program files\FlyGimp Pro 2009-05-14 06:16 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-05-05 06:32 . 2009-05-05 06:30 131 ---ha-w- c:\programdata\hpothb07.dat 2009-05-05 06:31 . 2009-05-04 17:25 178 ---ha-w- c:\users\andre\hpothb07.dat 2009-05-04 17:20 . 2009-01-24 09:08 88 ----a-w- c:\users\andre\AppData\Local\rvzvz.bat 2009-05-04 17:16 . 2003-04-05 12:33 20458 ----a-w- c:\windows\hpoins01.dat 2009-05-04 17:15 . 2009-05-04 17:15 77004 ----a-w- c:\windows\system32\drivers\AFS.SYS 2009-04-24 16:05 . 2009-06-09 21:27 827904 ----a-w- c:\windows\system32\wininet.dll 2009-04-24 16:02 . 2009-06-09 21:27 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-24 13:44 . 2009-06-09 21:27 26624 ----a-w- c:\windows\system32\ieUnatt.exe 2009-04-23 12:43 . 2009-06-09 21:27 784896 ----a-w- c:\windows\system32\rpcrt4.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-04-14 972128] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-03-11 90112] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-04-07 132760] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984] "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-07-03 6266880] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2008-02-29 46416] c:\users\andre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) "HideFastUserSwitching"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{CD8C370B-FF34-4810-A4C3-538B2BF61207}"= c:\program files\HP\DVDPlay\DVDPlay.exe:DVD Play "{39A1BE29-9CB1-44E3-84A1-DF309ACACF7B}"= c:\program files\HP\DVDPlay\DPService.exe:DVD Play Resident Program "{88061566-051B-425A-A4FD-BA4EA27E2286}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{B12BF568-931F-473E-905E-7B919C5D7F75}"= c:\program files\Skype\Phone\Skype.exe:Skype "TCP Query User{47A08A15-9230-44EC-8363-D12967BC439E}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= UDP:c:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "UDP Query User{D8A3B188-3C70-482F-A04C-9AA80521C499}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= TCP:c:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "{6997AE42-0A31-49A2-BFA4-CD3DA03ABE52}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C4DC50AE-0D39-4697-BAB8-7EA840765B1C}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{4597444D-463A-4C9F-948B-6708A1C28D09}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{E5B28901-689F-4277-83BA-2E2A0F1B8F55}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{11A882D1-7674-418D-A41F-5A87EE494A38}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{E9D74CFA-7613-47DE-A88B-CCAC67117C97}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R0 AFS;AFS;c:\windows\System32\drivers\AFS.SYS [04/05/2009 19:15 77004] R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21/01/2008 04:33 21504] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ezSharedSvc . Contenu du dossier 'Tâches planifiées' 2009-07-06 c:\windows\Tasks\User_Feed_Synchronization-{91DFC034-88CB-41FF-9655-C453CD55F415}.job - c:\windows\system32\msfeedssync.exe [2008-01-21 02:34] . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-kqyicig - c:\users\andre\appdata\local\kqyicig.exe HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe . ------- Examen supplémentaire ------- . uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cndt mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cndt uInternet Settings,ProxyOverride = localhost IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Pobierz plik wideo we Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm IE: Pobierz w Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm IE: Pobierz wszystkie pliki w Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm IE: Pobierz zaznaczone w Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-06 20:12 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succčs Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2009-07-06 20:15 ComboFix-quarantined-files.txt 2009-07-06 18:15 Avant-CF: 170 936 229 888 octets libres Aprčs-CF: 171 629 023 232 octets libres 169 --- E O F --- 2009-07-06 08:14

**Posty:** 18165 · przez **wojtas** 07 Lip 2009, 19:32

Otworz notatnik i wklej w nim to:

Folder::
c:\users\andre\AppData\Roaming\Free Download Manager
c:\program files\Free Download Manager
c:\program files\EasyBits For Kids

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

Autor postu otrzymał pochwałę

**Posty:** 84 · przez **bandy** 08 Lip 2009, 11:04

oto log po:

Kod: Zaznacz wszystko: ComboFix 09-07-05.04 - andre 08/07/2009 10:54.2 - NTFSx86 Lancé depuis: c:\users\andre\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\andre\Desktop\CFScript.txt SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\EasyBits For Kids c:\program files\EasyBits For Kids\_BonusData.DB c:\program files\EasyBits For Kids\_ezBonus.dat c:\program files\EasyBits For Kids\_HotKeys.dat c:\program files\EasyBits For Kids\_Programs.DB c:\program files\EasyBits For Kids\_ShellSettings.dat c:\program files\EasyBits For Kids\_ss.dat c:\program files\EasyBits For Kids\_Users.dat c:\program files\EasyBits For Kids\Help\About EasyBits Mail\fra\_About.htm c:\program files\EasyBits For Kids\Programs\Easy Paint\_EasyPaint.ini c:\program files\EasyBits For Kids\Programs\Easy Write\_EasyWrite.ini c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\_ezPathMap.ini c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\address_book.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\Archive\index.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\Inbox\index.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\mail_accounts.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\mail_images.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\Outbox\index.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\RecycleBin\index.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\SentItems\index.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_1\user_prefs.dat c:\program files\EasyBits For Kids\Programs\EasyBits Magic Mail\Mail Root\_MailUsers.dat c:\program files\EasyBits For Kids\Programs\My First Browser\_browser.Dat c:\program files\EasyBits For Kids\Programs\My First Browser\_history.dat c:\program files\EasyBits For Kids\Programs\Talking Parrot\_ParrotSettings.ini c:\program files\EasyBits For Kids\Programs\Talking Parrot\_Talking Parrot.wav c:\program files\EasyBits For Kids\Programs\Talking Parrot\_VoiceMail.wav c:\program files\EasyBits For Kids\Upgrade\HTML\_upgrade.htm c:\program files\EasyBits For Kids\Users\_1\_EnabledSites.dat c:\program files\EasyBits For Kids\Users\_1\_ezValues.dat c:\program files\EasyBits For Kids\Users\_1\_FavoritePrograms.DB c:\program files\EasyBits For Kids\Users\_1\_HintsHistory.dat c:\program files\EasyBits For Kids\Users\_1\_inetStat.Dat c:\program files\EasyBits For Kids\Users\_1\_MessageLog.dat c:\program files\EasyBits For Kids\Users\_1\_Rejected.Dat c:\program files\EasyBits For Kids\Users\_1\Desktop\Internet Explorer.Link c:\program files\EasyBits For Kids\Users\_1\Easy Write\ (2).EasyWrite c:\program files\EasyBits For Kids\Users\_1\Easy Write\ (2).rtf c:\program files\EasyBits For Kids\Users\_1\Easy Write\ (3).EasyWrite c:\program files\EasyBits For Kids\Users\_1\Easy Write\ (3).rtf c:\program files\EasyBits For Kids\Users\_1\Easy Write\.EasyWrite c:\program files\EasyBits For Kids\Users\_1\Easy Write\.rtf c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (2).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (2).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (3).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (3).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (4).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (4).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (5).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (5).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (6).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008 (6).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008.bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0008.thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0019 (2).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0019 (2).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0019 (3).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0019 (3).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0019 (4).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0019 (4).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0019.bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\ColorUp_0019.thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681) (2).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681) (2).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-16 11.25.19.995).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-16 11.25.19.995).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-16 15.26.41.102).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-16 15.26.41.102).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-16 16.36.19.67).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-16 16.36.19.67).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-16 16.44.32.110).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-11-16 16.44.32.110).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-12-03 15.49.44.769).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-12-03 15.49.44.769).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-12-21 18.38.00.60).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-12-21 18.38.00.60).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-12-23 17.13.18.306).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-12-23 17.13.18.306).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-12-28 19.53.24.762).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2008-12-28 19.53.24.762).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2009-02-21 20.42.08.505).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2009-02-21 20.42.08.505).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2009-04-01 16.06.17.644).bmp c:\program files\EasyBits For Kids\Users\_1\My Pictures\EasyPaint Picture (2009-04-01 16.06.17.644).thumbnail c:\program files\EasyBits For Kids\Users\_1\My Programs\Internet Explorer.Link c:\program files\EasyBits For Kids\Users\_1\My Programs\Skype.Link c:\program files\EasyBits For Kids\Users\_1\Web Favorites\file~~~~C~~Program%20Files~EasyBits%20For%20Kids~Programs~My%20First%20Browser~StartPage~enu~StartPa.bmp c:\program files\EasyBits For Kids\Users\_1\Web Favorites\file~~~~C~~Program%20Files~EasyBits%20For%20Kids~Programs~My%20First%20Browser~StartPage~enu~StartPa.ezURL c:\program files\EasyBits For Kids\Users\All Users\_EnabledSites.dat c:\program files\EasyBits For Kids\Users\All Users\_News.dat c:\program files\EasyBits For Kids\Users\All Users\Easy Paint\0008.EasyPaint c:\program files\EasyBits For Kids\Users\All Users\Easy Paint\0019.EasyPaint c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (2).EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (2).rtf c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (3).EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (3).rtf c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (4).EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (4).rtf c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (5).EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (5).rtf c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (6).EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (6).rtf c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (7).EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (7).rtf c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (8).EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (8).rtf c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (9).EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\ (9).rtf c:\program files\EasyBits For Kids\Users\All Users\Easy Write\.EasyWrite c:\program files\EasyBits For Kids\Users\All Users\Easy Write\.rtf c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\For you.dat c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\For you.ezGreeting c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\For you.Thumbnail c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you dad.dat c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you dad.ezGreeting c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you dad.Thumbnail c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you mom.dat c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you mom.ezGreeting c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you mom.Thumbnail c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you.dat c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you.ezGreeting c:\program files\EasyBits For Kids\Users\All Users\Greeting Cards\I love you.Thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Music\Daddy.mid c:\program files\EasyBits For Kids\Users\All Users\My Music\Happy Birthday.mid c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0008 (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0008 (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0008 (3).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0008 (3).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0008.bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0008.thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (3).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (3).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (4).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (4).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (5).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (5).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (6).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019 (6).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019.bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\ColorUp_0019.thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681) (2) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681) (2) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681) (3).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681) (3).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-15 18.41.13.681).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.14.46.620) (2) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.14.46.620) (2) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.14.46.620) (2) (3).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.14.46.620) (2) (3).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.14.46.620) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.14.46.620) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.14.46.620).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.14.46.620).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.21.43.389).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.21.43.389).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.40.32.996).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 13.40.32.996).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 15.10.17.26) (2) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 15.10.17.26) (2) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 15.10.17.26) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 15.10.17.26) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 15.10.17.26).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 15.10.17.26).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 15.26.41.102).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 15.26.41.102).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 17.13.55.448).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 17.13.55.448).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 17.29.51.433).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 17.29.51.433).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 17.30.41.578) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 17.30.41.578) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 17.30.41.578).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-16 17.30.41.578).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-26 16.31.21.680) (2) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-26 16.31.21.680) (2) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-26 16.31.21.680) (2).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-26 16.31.21.680) (2).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-26 16.31.21.680).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-26 16.31.21.680).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-26 16.52.11.764).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-11-26 16.52.11.764).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-12-03 15.29.30.835).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-12-03 15.29.30.835).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-12-28 19.31.19.688).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-12-28 19.31.19.688).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-12-28 19.44.02.86).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2008-12-28 19.44.02.86).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2009-02-21 19.45.43.707).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2009-02-21 19.45.43.707).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2009-04-01 15.55.43.833).bmp c:\program files\EasyBits For Kids\Users\All Users\My Pictures\EasyPaint Picture (2009-04-01 15.55.43.833).thumbnail c:\program files\EasyBits For Kids\Users\All Users\My Programs\Easy Paint.Link c:\program files\EasyBits For Kids\Users\All Users\My Programs\Easy Write.Link c:\program files\EasyBits For Kids\Users\All Users\My Programs\Internet.Link c:\program files\EasyBits For Kids\Users\All Users\My Programs\Magic Mail.Link c:\program files\EasyBits For Kids\Users\All Users\My Programs\Talking Parrot.Link c:\program files\EasyBits For Kids\Users\All Users\Web Favorites\http~~~www.easybits4kids.com.bmp c:\program files\EasyBits For Kids\Users\All Users\Web Favorites\http~~~www.easybits4kids.com.ezURL c:\program files\EasyBits For Kids\Users\Easy Paint.Link c:\program files\EasyBits For Kids\Users\Easy Write.Link c:\program files\EasyBits For Kids\Users\Internet.Link c:\program files\EasyBits For Kids\Users\Magic Mail.Link c:\program files\EasyBits For Kids\Users\Talking Parrot.Link c:\program files\EasyBits For Kids\Users\Upgrade.Link c:\program files\Free Download Manager c:\program files\Free Download Manager\Archive\unrar.dll c:\program files\Free Download Manager\dbghelp.dll c:\program files\Free Download Manager\dlall.htm c:\program files\Free Download Manager\dlfvideo.htm c:\program files\Free Download Manager\dllink.htm c:\program files\Free Download Manager\dlpage.htm c:\program files\Free Download Manager\dlselected.htm c:\program files\Free Download Manager\fdm.exe c:\program files\Free Download Manager\fdm.tlb c:\program files\Free Download Manager\fdm.url c:\program files\Free Download Manager\fdm_01.gif c:\program files\Free Download Manager\fdmbtsupp.dll c:\program files\Free Download Manager\fdmcs.dat c:\program files\Free Download Manager\fdminno.dll c:\program files\Free Download Manager\fdmwi.exe c:\program files\Free Download Manager\Firefox\extension\chrome.manifest c:\program files\Free Download Manager\Firefox\extension\chrome\content\fdm_ffext.js c:\program files\Free Download Manager\Firefox\extension\chrome\content\fdm_ffext.xul c:\program files\Free Download Manager\Firefox\extension\chrome\content\fdm_ffextDM.js c:\program files\Free Download Manager\Firefox\extension\chrome\content\fdm_ffextDM.xul c:\program files\Free Download Manager\Firefox\extension\chrome\content\fdm_ffpxy.js c:\program files\Free Download Manager\Firefox\extension\components\.autoreg c:\program files\Free Download Manager\Firefox\extension\components\component.dll c:\program files\Free Download Manager\Firefox\extension\components\icomponent.xpt c:\program files\Free Download Manager\Firefox\extension\components\ivmsfdmff.xpt c:\program files\Free Download Manager\Firefox\extension\components\vmsfdmff.dll c:\program files\Free Download Manager\Firefox\extension\components\vmsfdmff.ilk c:\program files\Free Download Manager\Firefox\extension\install.rdf c:\program files\Free Download Manager\Help\Free Download Manager.chm c:\program files\Free Download Manager\iefdm.dll c:\program files\Free Download Manager\iefdm2.dll c:\program files\Free Download Manager\iefdmdm.dll c:\program files\Free Download Manager\Language\alb.lng c:\program files\Free Download Manager\Language\arb.lng c:\program files\Free Download Manager\Language\bul.lng c:\program files\Free Download Manager\Language\cat.lng c:\program files\Free Download Manager\Language\chs.lng c:\program files\Free Download Manager\Language\cht.lng c:\program files\Free Download Manager\Language\cro.lng c:\program files\Free Download Manager\Language\czk.lng c:\program files\Free Download Manager\Language\dan.lng c:\program files\Free Download Manager\Language\dut.lng c:\program files\Free Download Manager\Language\ell.lng c:\program files\Free Download Manager\Language\eng.lng c:\program files\Free Download Manager\Language\far.lng c:\program files\Free Download Manager\Language\fin.lng c:\program files\Free Download Manager\Language\fre.lng c:\program files\Free Download Manager\Language\ger.lng c:\program files\Free Download Manager\Language\heb.lng c:\program files\Free Download Manager\Language\hun.lng c:\program files\Free Download Manager\Language\ita.lng c:\program files\Free Download Manager\Language\jpn.lng c:\program files\Free Download Manager\Language\kor.lng c:\program files\Free Download Manager\Language\lt.lng c:\program files\Free Download Manager\Language\mac.lng c:\program files\Free Download Manager\Language\nor.LNG c:\program files\Free Download Manager\Language\pol.lng c:\program files\Free Download Manager\Language\pt_PT.lng c:\program files\Free Download Manager\Language\ptbr.lng c:\program files\Free Download Manager\Language\rom.lng c:\program files\Free Download Manager\Language\rus.lng c:\program files\Free Download Manager\Language\slo.lng c:\program files\Free Download Manager\Language\spn.lng c:\program files\Free Download Manager\Language\srb.lng c:\program files\Free Download Manager\Language\svk.lng c:\program files\Free Download Manager\Language\swe.lng c:\program files\Free Download Manager\Language\tur.lng c:\program files\Free Download Manager\Language\ukr.lng c:\program files\Free Download Manager\Language\uzb.lng c:\program files\Free Download Manager\Language\vie.lng c:\program files\Free Download Manager\license.txt c:\program files\Free Download Manager\MediaConverter.dll c:\program files\Free Download Manager\Microsoft.VC80.CRT.manifest c:\program files\Free Download Manager\msvcp60.dll c:\program files\Free Download Manager\msvcp80.dll c:\program files\Free Download Manager\msvcr80.dll c:\program files\Free Download Manager\npfdm.dll c:\program files\Free Download Manager\player.swf c:\program files\Free Download Manager\Server\adddownloadres_err.html c:\program files\Free Download Manager\Server\adddownloadres_ok.html c:\program files\Free Download Manager\Server\compdlds.html c:\program files\Free Download Manager\Server\index.html c:\program files\Free Download Manager\Skins\howto.url c:\program files\Free Download Manager\Skins\old style\back.bmp c:\program files\Free Download Manager\Skins\old style\back_d.bmp c:\program files\Free Download Manager\Skins\old style\checks.bmp c:\program files\Free Download Manager\Skins\old style\choosefolder.ico c:\program files\Free Download Manager\Skins\old style\creategroup.ico c:\program files\Free Download Manager\Skins\old style\dldtasks.bmp c:\program files\Free Download Manager\Skins\old style\dldtasks_sel.bmp c:\program files\Free Download Manager\Skins\old style\dlinfo.bmp c:\program files\Free Download Manager\Skins\old style\dropbox.ico c:\program files\Free Download Manager\Skins\old style\filelist.bmp c:\program files\Free Download Manager\Skins\old style\filelist_sel.bmp c:\program files\Free Download Manager\Skins\old style\go.bmp c:\program files\Free Download Manager\Skins\old style\groups.bmp c:\program files\Free Download Manager\Skins\old style\groupsmenu.bmp c:\program files\Free Download Manager\Skins\old style\groupsmenu_d.bmp c:\program files\Free Download Manager\Skins\old style\login.ico c:\program files\Free Download Manager\Skins\old style\logstat.bmp c:\program files\Free Download Manager\Skins\old style\mute.bmp c:\program files\Free Download Manager\Skins\old style\scheduler.bmp c:\program files\Free Download Manager\Skins\old style\scheduler_sel.bmp c:\program files\Free Download Manager\Skins\old style\settime.ico c:\program files\Free Download Manager\Skins\old style\sitelist.bmp c:\program files\Free Download Manager\Skins\old style\sitelist_sel.bmp c:\program files\Free Download Manager\Skins\old style\skin.ini c:\program files\Free Download Manager\Skins\old style\tool_bt.bmp c:\program files\Free Download Manager\Skins\old style\tool_bt_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_bt_small.bmp c:\program files\Free Download Manager\Skins\old style\tool_bt_small_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_dld.bmp c:\program files\Free Download Manager\Skins\old style\tool_dld_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_dld_small.bmp c:\program files\Free Download Manager\Skins\old style\tool_dld_small_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_hfe.bmp c:\program files\Free Download Manager\Skins\old style\tool_hfe_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_hfe_small.bmp c:\program files\Free Download Manager\Skins\old style\tool_hfe_small_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_sch.bmp c:\program files\Free Download Manager\Skins\old style\tool_sch_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_sch_small.bmp c:\program files\Free Download Manager\Skins\old style\tool_sch_small_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_sites.bmp c:\program files\Free Download Manager\Skins\old style\tool_sites_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_sites_small.bmp c:\program files\Free Download Manager\Skins\old style\tool_sites_small_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_spider.bmp c:\program files\Free Download Manager\Skins\old style\tool_spider_d.bmp c:\program files\Free Download Manager\Skins\old style\tool_spider_small.bmp c:\program files\Free Download Manager\Skins\old style\tool_spider_small_d.bmp c:\program files\Free Download Manager\Skins\old style\tool0.bmp c:\program files\Free Download Manager\Skins\old style\tool0_d.bmp c:\program files\Free Download Manager\Skins\old style\tool0_small.bmp c:\program files\Free Download Manager\Skins\old style\tool0_small_d.bmp c:\program files\Free Download Manager\Skins\old style\tosel.ico c:\program files\Free Download Manager\Skins\old style\tounsel.ico c:\program files\Free Download Manager\Skins\old style\tray.ico c:\program files\Free Download Manager\Skins\old style\tray_down.ico c:\program files\Free Download Manager\Skins\old style\tray_err.ico c:\program files\Free Download Manager\Skins\old style\tray_starting.ico c:\program files\Free Download Manager\Skins\old style\vidman.bmp c:\program files\Free Download Manager\Skins\old style\vidman_d.bmp c:\program files\Free Download Manager\Updater.exe c:\program files\Free Download Manager\vistafx.dll c:\users\andre\AppData\Roaming\Free Download Manager c:\users\andre\AppData\Roaming\Free Download Manager\dlmgrsi.sav c:\users\andre\AppData\Roaming\Free Download Manager\downloads.bak c:\users\andre\AppData\Roaming\Free Download Manager\downloads.del.sav c:\users\andre\AppData\Roaming\Free Download Manager\downloads.his.sav c:\users\andre\AppData\Roaming\Free Download Manager\downloads.sav c:\users\andre\AppData\Roaming\Free Download Manager\groups.sav c:\users\andre\AppData\Roaming\Free Download Manager\history.sav c:\users\andre\AppData\Roaming\Free Download Manager\mctasks.sav c:\users\andre\AppData\Roaming\Free Download Manager\schedules.sav c:\users\andre\AppData\Roaming\Free Download Manager\sites.sav c:\users\andre\AppData\Roaming\Free Download Manager\spider.sav c:\users\andre\AppData\Roaming\Free Download Manager\Update\proupd.lst . ((((((((((((((((((((((((((((( Fichiers créés du 2009-06-08 au 2009-07-08 )))))))))))))))))))))))))))))))))))) . 2009-07-06 18:15 . 2009-07-08 08:58 -------- d-----w- c:\users\andre\AppData\Local\temp 2009-07-06 15:27 . 2009-07-06 15:29 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-07-06 15:27 . 2009-07-06 15:41 -------- d-----w- c:\programdata\Avira 2009-07-06 14:02 . 2009-07-06 14:02 -------- d-----w- c:\program files\Trend Micro 2009-07-06 09:12 . 2009-07-06 09:12 -------- d-----w- c:\programdata\McAfee 2009-07-06 09:01 . 2009-07-06 09:10 -------- d-----w- c:\program files\SkanerOnline 2009-07-05 03:59 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll 2009-07-05 03:59 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2009-07-05 03:59 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll 2009-07-05 03:59 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll 2009-07-05 03:59 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe 2009-07-05 03:59 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll 2009-07-05 03:59 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe 2009-07-05 03:50 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll 2009-07-05 03:50 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll 2009-07-05 03:50 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll 2009-07-05 03:49 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll 2009-07-05 03:49 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll 2009-06-13 16:48 . 2009-06-13 16:48 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb9177.tmp.exe 2009-06-09 21:24 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys 2009-06-09 21:23 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-08 08:56 . 2008-07-26 08:25 669328 ----a-w- c:\windows\system32\perfh00C.dat 2009-07-08 08:56 . 2008-07-26 08:25 123350 ----a-w- c:\windows\system32\perfc00C.dat 2009-07-08 08:50 . 2008-10-30 16:39 -------- d-----w- c:\users\andre\AppData\Roaming\Skype 2009-07-08 08:49 . 2008-10-30 17:19 -------- d-----w- c:\users\andre\AppData\Roaming\skypePM 2009-07-06 18:03 . 2009-05-04 18:19 90 ----a-w- c:\users\andre\AppData\Local\iemme.bat 2009-07-06 16:11 . 2008-10-31 10:56 206 ----a-w- c:\users\andre\AppData\Roaming\wklnhst.dat 2009-07-06 11:31 . 2008-07-25 22:46 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-06 10:58 . 2008-07-25 23:08 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-07-06 10:58 . 2008-12-13 08:00 -------- d-----w- c:\program files\Google 2009-07-06 10:34 . 2008-07-25 23:08 -------- d-----w- c:\programdata\Symantec 2009-07-06 08:58 . 2008-12-13 18:38 -------- d-----w- c:\users\andre\AppData\Roaming\LimeWire 2009-07-06 08:57 . 2008-12-13 18:37 -------- d-----w- c:\program files\LimeWire 2009-07-06 08:57 . 2008-11-22 16:26 -------- d-----w- c:\programdata\eMule 2009-07-05 08:03 . 2008-10-30 16:09 78728 ----a-w- c:\users\andre\AppData\Local\GDIPFONTCACHEV1.DAT 2009-07-05 04:19 . 2008-11-01 08:23 -------- d-----w- c:\programdata\Microsoft Help 2009-06-20 15:16 . 2008-11-22 16:14 -------- d-----w- c:\users\andre\AppData\Roaming\uTorrent 2009-06-10 12:26 . 2008-10-30 16:02 -------- d-----w- c:\program files\Microsoft Works 2009-05-24 07:39 . 2009-05-04 18:28 -------- d-----w- c:\program files\FlyGimp Pro 2009-05-14 06:16 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-05-05 06:32 . 2009-05-05 06:30 131 ---ha-w- c:\programdata\hpothb07.dat 2009-05-05 06:31 . 2009-05-04 17:25 178 ---ha-w- c:\users\andre\hpothb07.dat 2009-05-04 17:20 . 2009-01-24 09:08 88 ----a-w- c:\users\andre\AppData\Local\rvzvz.bat 2009-05-04 17:16 . 2003-04-05 12:33 20458 ----a-w- c:\windows\hpoins01.dat 2009-05-04 17:15 . 2009-05-04 17:15 77004 ----a-w- c:\windows\system32\drivers\AFS.SYS 2009-04-24 16:05 . 2009-06-09 21:27 827904 ----a-w- c:\windows\system32\wininet.dll 2009-04-24 16:02 . 2009-06-09 21:27 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-24 13:44 . 2009-06-09 21:27 26624 ----a-w- c:\windows\system32\ieUnatt.exe 2009-04-23 12:43 . 2009-06-09 21:27 784896 ----a-w- c:\windows\system32\rpcrt4.dll . ((((((((((((((((((((((((((((( SnapShot@2009-07-06_18.12.56 ))))))))))))))))))))))))))))))))))))))))) . + 2008-01-21 01:58 . 2009-07-08 08:50 53850 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2008-01-21 01:58 . 2009-07-06 15:43 53850 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2006-11-02 13:02 . 2009-07-08 08:50 67154 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-08-05 07:09 . 2009-07-06 18:06 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-08-05 07:09 . 2009-07-08 08:50 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-08-05 07:12 . 2009-07-06 18:06 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-08-05 07:12 . 2009-07-08 08:50 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-08-05 07:12 . 2009-07-06 18:06 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-08-05 07:12 . 2009-07-08 08:50 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-10-30 16:35 . 2009-07-06 18:32 25792 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2008-10-30 16:01 . 2009-07-08 08:50 8410 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4227231826-1027695528-279376433-1000_UserData.bin - 2009-07-06 15:41 . 2009-07-06 18:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-07-08 08:49 . 2009-07-08 08:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-07-06 15:41 . 2009-07-06 18:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-08 08:49 . 2009-07-08 08:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2006-11-02 10:33 . 2009-07-08 08:56 586980 c:\windows\System32\perfh009.dat - 2006-11-02 10:33 . 2009-07-06 18:10 586980 c:\windows\System32\perfh009.dat + 2006-11-02 10:33 . 2009-07-08 08:56 101052 c:\windows\System32\perfc009.dat - 2006-11-02 10:33 . 2009-07-06 18:10 101052 c:\windows\System32\perfc009.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-04-14 972128] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-03-11 90112] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-04-07 132760] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984] "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-07-03 6266880] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2008-02-29 46416] c:\users\andre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) "HideFastUserSwitching"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{CD8C370B-FF34-4810-A4C3-538B2BF61207}"= c:\program files\HP\DVDPlay\DVDPlay.exe:DVD Play "{39A1BE29-9CB1-44E3-84A1-DF309ACACF7B}"= c:\program files\HP\DVDPlay\DPService.exe:DVD Play Resident Program "{88061566-051B-425A-A4FD-BA4EA27E2286}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{B12BF568-931F-473E-905E-7B919C5D7F75}"= c:\program files\Skype\Phone\Skype.exe:Skype "TCP Query User{47A08A15-9230-44EC-8363-D12967BC439E}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= UDP:c:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "UDP Query User{D8A3B188-3C70-482F-A04C-9AA80521C499}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= TCP:c:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "{6997AE42-0A31-49A2-BFA4-CD3DA03ABE52}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C4DC50AE-0D39-4697-BAB8-7EA840765B1C}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{4597444D-463A-4C9F-948B-6708A1C28D09}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{E5B28901-689F-4277-83BA-2E2A0F1B8F55}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{11A882D1-7674-418D-A41F-5A87EE494A38}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{E9D74CFA-7613-47DE-A88B-CCAC67117C97}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R0 AFS;AFS;c:\windows\System32\drivers\AFS.SYS [04/05/2009 19:15 77004] R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21/01/2008 04:33 21504] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ezSharedSvc . Contenu du dossier 'Tâches planifiées' 2009-07-08 c:\windows\Tasks\User_Feed_Synchronization-{91DFC034-88CB-41FF-9655-C453CD55F415}.job - c:\windows\system32\msfeedssync.exe [2008-01-21 02:34] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cndt mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Presario&pf=cndt uInternet Settings,ProxyOverride = localhost IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Pobierz plik wideo we Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm IE: Pobierz w Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm IE: Pobierz wszystkie pliki w Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm IE: Pobierz zaznaczone w Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-08 10:58 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succčs Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2009-07-08 11:00 ComboFix-quarantined-files.txt 2009-07-08 09:00 ComboFix2.txt 2009-07-06 18:15 Avant-CF: 171 493 380 096 octets libres Aprčs-CF: 171 414 372 352 octets libres 547 --- E O F --- 2009-07-06 08:14

ja tam widze wpisy jakies z free downloaderem:( nie wie czy to jzu koniec? a tak poza tym nie ma żadnych innych smieci?

Dodano 08.07.2009 11:38:54:
mam problem

po tych czynnościach wyłaczyłem kompa i teraz na nowo go właczam i pojawia sie blue screen windowsa

jakis bład

**Posty:** 1903 · przez **MichuPower** 09 Lip 2009, 18:37

bandy napisał(a):blue screen

Przepisz kod tego błędu i podaj nam go tutaj.

**Posty:** 84 · przez **bandy** 09 Lip 2009, 22:43

okej blue screen sie nie pojawia:) poradziem sobie z nim

czy log który zamieściłem powyzej jest czysty? czy cos trzeba jeszcze naprawic? program free downloader usuniety i sie nie włacza juz

za to dziekuje bardzo:) Wojtas jeszcze nigdy mnie nie zawiodłeś

tylko jesszcze czy log jest czysty i to by było wszystko chyba na razie

**Posty:** 18165 · przez **wojtas** 10 Lip 2009, 17:25

jest ok