Sujet Précédent Sujet Suivant

PC infecté

gateuse -  
 gateuse -
Bonjour,

Je suis infecté 39 fois par tout ça:

adware.Naviprom.H
Rogue.Eorezo,
Trojan.BHO
Adware. PlayMP3
Adware. EGDAccess,
Trojan. Agent,
Rogue.Residue
Trojan.Agent

Qui peut m'aidé,je suis novice en informatique
Merçi Gateuse
A voir également:

29 réponses

Précédent
  • 1
  • 2
Réponse 21 / 29
gateuse
 
List'em by g3n-h@ckm@n 1.0.5.2

Thx to Chiquitine29.....

User : Ghislaine (Administrateurs) # PC-FOSCHIA
Update on 07/11/2009 by g3n-h@ckm@n ::::: 20.00
Start at: 20:17:07 | 07/11/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local | 74,52 Go (39 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local | 111,76 Go (44,74 Go free) [WD Passport] | FAT32

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus en cours

C:\WINDOWS\System32\smss.exe 744
C:\WINDOWS\system32\csrss.exe 828
C:\WINDOWS\system32\winlogon.exe 852
C:\WINDOWS\system32\services.exe 896
C:\WINDOWS\system32\lsass.exe 908
C:\WINDOWS\system32\Ati2evxx.exe 1076
C:\WINDOWS\system32\svchost.exe 1092
C:\WINDOWS\system32\svchost.exe 1188
C:\WINDOWS\System32\svchost.exe 1332
C:\WINDOWS\system32\svchost.exe 1428
C:\WINDOWS\system32\svchost.exe 1660
C:\WINDOWS\system32\spoolsv.exe 1928
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe 1960
C:\Program Files\Avira\AntiVir Desktop\sched.exe 1988
C:\WINDOWS\system32\svchost.exe 136
C:\WINDOWS\Explorer.EXE 504
C:\WINDOWS\system32\Rundll32.exe 704
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe 712
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 764
C:\Program Files\Lexmark 3600-4600 Series\lxdxMsdMon.exe 912
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe 1228
C:\Program Files\Microsoft IntelliType Pro\type32.exe 1416
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe 1452
C:\Program Files\Java\jre6\bin\jusched.exe 1440
C:\Program Files\Analog Devices\Core\smax4pnp.exe 1560
C:\Program Files\PowerISO\PWRISOVM.EXE 1696
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe 1728
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1784
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe 1800
C:\WINDOWS\system32\CTsvcCDA.EXE 1848
C:\WINDOWS\system32\crypserv.exe 1872
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe 1840
C:\WINDOWS\system32\dlbtcoms.exe 1996
C:\WINDOWS\System32\FTRTSVC.exe 184
C:\Program Files\Java\jre6\bin\jqs.exe 284
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe 596
C:\Program Files\Microsoft IntelliPoint\point32.exe 664
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe 224
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe 1264
C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe 1364
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxserv.exe 1492
C:\WINDOWS\system32\lxdxcoms.exe 1508
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1580
C:\WINDOWS\system32\ctfmon.exe 724
C:\Program Files\Windows Media Player\WMPNSCFG.exe 2128
C:\WINDOWS\system32\svchost.exe 2180
C:\Program Files\Inventel\Gateway\wlancfg.exe 2296
C:\Program Files\Messenger\msmsgs.exe 2444
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 2480
C:\WINDOWS\system32\MsPMSPSv.exe 2508
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe 2672
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe 2736
C:\Documents and Settings\Ghislaine\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe 2840
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe 2984
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN 3148
C:\WINDOWS\System32\svchost.exe 3996
C:\Program Files\Windows Media Player\WMPNetwk.exe 2684
C:\WINDOWS\system32\wbem\wmiapsrv.exe 3540
C:\Program Files\Logitech\QuickCam10\COCIManager.exe 3808
C:\WINDOWS\System32\alg.exe 4084
C:\Program Files\Java\jre6\bin\jucheck.exe 6044
C:\WINDOWS\system32\wscntfy.exe 956
C:\Documents and Settings\Ghislaine\Bureau\List_Killem.exe 6116
C:\WINDOWS\system32\cmd.exe 1844
C:\WINDOWS\system32\wbem\wmiprvse.exe 1820
C:\Documents and Settings\Ghislaine\Local Settings\Temp\19.tmp\pv.exe 1360

======================
Cles de demarrage "Run"
======================
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"swg"="\"C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\""
"WOOKIT"="C:\\PROGRA~1\\Wanadoo\\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM="
"WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"
"MsnMsgr"="\"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe\" /background"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"P17Helper"="Rundll32 P17.dll,P17Helper"
"lxdxmon.exe"="\"C:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe\""
"lxdxamon"="\"C:\\Program Files\\Lexmark 3600-4600 Series\\lxdxamon.exe\""
"DLBTCATS"="rundll32 C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\DLBTtime.dll,_RunDLLEntry@16"
"avgnt"="\"C:\\Program Files\\Avira\\AntiVir Desktop\\avgnt.exe\" /min"
"TkBellExe"="\"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe\" -osboot"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"WOOWATCH"="C:\\PROGRA~1\\Wanadoo\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\Wanadoo\\GestMaj.exe TaskBarIcon.exe"
"VirusScan"="c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"UDC Integration"=""
"type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre6\\bin\\jusched.exe\""
"SoundMAXPnP"="C:\\Program Files\\Analog Devices\\Core\\smax4pnp.exe"
"SGPUpdater"="C:\\Program Files\\Search Guard PlusU\\sgpUpdaters.exe"
"PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
"msci"="C:\\DOCUME~1\\GHISLA~1\\LOCALS~1\\Temp\\200411303236_mcinfo.exe /insfin"
"LVCOMSX"="\"C:\\Program Files\\Fichiers communs\\Logitech\\LComMgr\\LVComSX.exe\""
"LogitechQuickCamRibbon"="\"C:\\Program Files\\Logitech\\QuickCam10\\QuickCam10.exe\" /hide"
"LogitechCommunicationsManager"="\"C:\\Program Files\\Fichiers communs\\Logitech\\LComMgr\\Communications_Helper.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"FBSearch"="C:\\Program Files\\Search Guard Plus\\SearchGuardPlus.exe"
"FaxCenterServer"="\"C:\\Program Files\\Lexmark Fax Solutions\\fm3032.exe\" /s"
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"CTSysVol"="C:\\Program Files\\Creative\\Sound Blaster Live! 24-bit\\Surround Mixer\\CTSysVol.exe /r"
"Cleanup"="C:\\DOCUME~1\\GHISLA~1\\LOCALS~1\\Temp\\2004113032310_mcappins.exe /v=3 /cleanup"
"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Elements 4.0\\apdproxy.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
@=""

=====================
cles additionnelles
=====================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"ConsentPromptBehaviorAdmin"=dword:00000002

===============
===============
===============
===============
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

===============
======
BHO :
======
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]
@=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
@="Search Helper"
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
@="Google Dictionary Compression sdch"
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
@="JQSIEStartDetectorImpl"
"NoExplorer"=dword:00000001

==========================

contenu des autoruns presents
-----------------------------

J:\Autorun.inf :
----------------
[autorun]
open=WD_Windows_Tools\setup.exe
ICON=AUTORUN\WDLOGO.ICO

===============
Path : c:\program files\imagemagick-6.4.2-q16;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem\
===============
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Program Files\AGI
C:\WINDOWS\System32\asdict.dat
C:\WINDOWS\System32\aspdict-en.dat
C:\WINDOWS\System32\drivers\etc\hosts.msn
C:\WINDOWS\system32\drivers\Sonyhcp.dll
C:\WINDOWS\System32\pc_sign.slf
C:\WINDOWS\System32\pcwords.dat

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe

¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

ACRORD32.EXE-356875A2.pf
ACRORD32INFO.EXE-24548733.pf
AD-R.EXE-2B1CD4E4.pf
AD-R[1].EXE-1A75D14E.pf
ALERTM~1.EXE-1C0AE839.pf
ALG.EXE-0F138680.pf
ATIPRBXX.EXE-28AA41C0.pf
ATIPTAXX.EXE-18FE8D8B.pf
ATTRIB.EXE-39EAFB02.pf
AVCENTER.EXE-1A970FA0.pf
AVCONFIG.EXE-29873B78.pf
AVGNT.EXE-200FEF40.pf
AVWSC.EXE-0283F9DD.pf
BYPASS.EXE-3A13827B.pf
CHCP.COM-18156052.pf
CHKNTFS.EXE-31921D64.pf
CMD.EXE-087B4001.pf
COCIMANAGER.EXE-2B55032E.pf
COMCOMP.EXE-01668373.pf
COMCOMP.EXE-063CBADA.pf
CONTROL.EXE-013DBFB5.pf
CTFMON.EXE-0E17969B.pf
DLBTCOMS.EXE-1AC7AA5C.pf
DRWTSN32.EXE-2B4B52AC.pf
DUMPREP.EXE-1B46F901.pf
DWWIN.EXE-30875ADC.pf
ECHOX.EXE-0EC32D49.pf
EMBIRD.EXE-211CA26C.pf
ERUNT.COM-3A876921.pf
ESPACEWANADOO.EXE-037E253D.pf
ESPACEWANADOO.EXE-26D5ECCC.pf
EXPLORER.EXE-082F38A9.pf
FAV.EXE-2068B130.pf
FIND.EXE-0EC32F1E.pf
FINDSTR.EXE-0CA6274B.pf
GESTMAJ.EXE-26927B6B.pf
GESTMAJ.EXE-2B68B2D2.pf
GETPATHS.EXE-0651DA57.pf
GOOGLETOOLBARNOTIFIER.EXE-3629C61D.pf
GOOGLEUPDATE.EXE-1E123D86.pf
GREP.COM-30632777.pf
IEXPLORE.EXE-27122324.pf
IMAPI.EXE-0BF740A4.pf
INACTIVITY.EXE-054B684A.pf
ISADMIN.COM-2460FC13.pf
JAVA.EXE-0C263507.pf
JUCHECK.EXE-395165C8.pf
LADS.EXE-06335087.pf
Layout.ini
LDMCONF.EXE-2E2A6E1D.pf
LOGONUI.EXE-0AF22957.pf
LSNFIER.EXE-08049B4C.pf
LXDXAMON.EXE-078F6524.pf
LXDXMON.EXE-28A5EC75.pf
LXDXMSDMON.EXE-15BCCCCA.pf
MBAM.EXE-0BEE0439.pf
MODE.COM-31685BAE.pf
MSCONFIG.EXE-35E4DAE9.pf
MSI48.TMP-19FE9D25.pf
MSI49.TMP-1FCCF11B.pf
MSI4A.TMP-35004CAD.pf
MSI4B.TMP-04CB4193.pf
MSI4C.TMP-0E98D218.pf
MSI4D.TMP-2B32BC28.pf
MSI4E.TMP-23CC218A.pf
MSI4F.TMP-15FF6CB6.pf
MSI50.TMP-307E15B5.pf
MSI51.TMP-094D788B.pf
MSIEXEC.EXE-2F8A8CAE.pf
MSNMSGR.EXE-030AB647.pf
MSPMSPSV.EXE-159858D5.pf
NAVILOG1[1].EXE-1B26CF25.pf
NAVILOG1[1].EXE-3AFA5DBB.pf
NET.EXE-01A53C2F.pf
NET1.EXE-029B9DB4.pf
NIRCMD.COM-35BF857A.pf
NOTEPAD.EXE-189578DA.pf
NOTEPAD.EXE-336351A9.pf
NTOSBOOT-B00DFAAD.pf
OSV.EXE-02D60AAD.pf
POLLINGMODULE.EXE-2C738EAB.pf
PROCESS.COM-0458B762.pf
PV.COM-006EB813.pf
QTTASK.EXE-342507FB.pf
QUICKSTART.EXE-1CEE9C20.pf
REALPLAY.EXE-1BF219BD.pf
REALSCHED.EXE-04BEC5CC.pf
REG.EXE-0D2A95F7.pf
REGDACL.COM-3B1D4525.pf
REGEDIT.EXE-1B606482.pf
RESIDENCE.EXE-2ACE91B5.pf
RUNDLL32.EXE-16F0FDE6.pf
RUNDLL32.EXE-1714B23E.pf
RUNDLL32.EXE-1831A4F3.pf
RUNDLL32.EXE-2576181F.pf
RUNDLL32.EXE-2CF006FF.pf
RUNDLL32.EXE-4A6D2B33.pf
SED.COM-281CC846.pf
SETPATH.COM-048AD5CE.pf
SETPATH.EXE-2D3D2E76.pf
SHELL.EXE-3189A993.pf
SHUTDOWN.EXE-12DAD820.pf
SIGNCHECK.EXE-205B42F0.pf
SOFFICE.BIN-242AA534.pf
SOFFICE.EXE-2C1A3A5B.pf
SONYTRAY.EXE-106365F1.pf
SORT.EXE-194AE83C.pf
SS3DFO.SCR-373AD36C.pf
STCLIENT_WRAPPER.EXE-0FBCE9FC.pf
SUBINACL.EXE-17974576.pf
SVCHOST.EXE-3530F672.pf
SWREG.COM-3A277B41.pf
SWSC.COM-0DAE31A0.pf
TOASTER.EXE-1CBF7015.pf
UISCAN.EXE-194144E5.pf
USBFIX.EXE-322C8BAA.pf
VERCLSID.EXE-3667BD89.pf
WATCH.EXE-0DACDE18.pf
WATCH.EXE-31EDBDF6.pf
WINRAR.EXE-39C6DAD9.pf
WLCOMM.EXE-04AE9009.pf
WMIAPSRV.EXE-1E2270A5.pf
WMIPRVSE.EXE-28F301A9.pf
WMPNETWK.EXE-2C0727AF.pf
WSCNTFY.EXE-1B24F5EB.pf
WSCRIPT.EXE-32960AB9.pf
WUAUCLT.EXE-399A8E72.pf
ZHPDIAG.EXE-021B7932.pf
ZHPDIAG_1.24.22.EXE-28F6B5B7.pf
ZHPDIAG_1.24.22.TMP-36A07468.pf

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
0
Réponse 22 / 29
Xplode Messages postés 9212 Statut Contributeur sécurité 726
 
-+-+-+-> List&kill'em - Nettoyage <-+-+-+-

/!\ Redémarre ton PC en Mode sans échec ( suis la première procédure -> " Manuelle " ) /!\

[x] Relance List&kill'em mais choisis cette fois-ci l'option 2 ( Destruction )

[x] Laisse le scan s'opérer.

[x] Un premier rapport s'ouvrira, ferme le. Un deuxième rapport s'ouvrira, copie/colle son contenu dans ton prochain message.

[x] Note : Le rapport se trouve également sous C:\Kill'em.txt
0
Réponse 23 / 29
gateuse
 
Kill'em by g3n-h@ckm@n 1.0.5.2

User : Ghislaine () # PC-FOSCHIA
Update on 07/11/2009 by g3n-h@ckm@n ::::: 20.00
Start at: 20:43:00 | 07/11/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local | 74,52 Go (39,06 Go free) | NTFS
D:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local | 111,76 Go (44,74 Go free) [WD Passport] | FAT32

C:\WINDOWS\System32\smss.exe 132
C:\WINDOWS\system32\csrss.exe 180
C:\WINDOWS\system32\winlogon.exe 204
C:\WINDOWS\system32\services.exe 248
C:\WINDOWS\system32\lsass.exe 260
C:\WINDOWS\system32\svchost.exe 408
C:\WINDOWS\system32\svchost.exe 468
C:\WINDOWS\system32\svchost.exe 512
C:\WINDOWS\Explorer.EXE 780
C:\Documents and Settings\Ghislaine\Bureau\List_Killem.exe 916
C:\WINDOWS\system32\cmd.exe 928
C:\WINDOWS\system32\wbem\wmiprvse.exe 1032
C:\Documents and Settings\Ghislaine\Local Settings\Temp\1.tmp\pv.exe 1096

Fichiers analysés :
=================

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Program Files\AGI"
"C:\WINDOWS\System32\asdict.dat"
"C:\WINDOWS\System32\aspdict-en.dat"
"C:\WINDOWS\System32\drivers\etc\hosts.msn"
"C:\WINDOWS\system32\drivers\Sonyhcp.dll"
"C:\WINDOWS\System32\pc_sign.slf"
"C:\WINDOWS\System32\pcwords.dat"

¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :

Quarantaine :

AGI.Kill'em
asdict.dat.Kill'em
aspdict-en.dat.Kill'em
hosts.msn.Kill'em
pcwords.dat.Kill'em
pc_sign.slf.Kill'em
qmgr0.dat.Kill'em
qmgr1.dat.Kill'em
Sonyhcp.dll.Kill'em

===================================
tentative de correction du registre
===================================
¤¤¤¤¤¤¤¤¤¤ Verification :

===============
Path : c:\program files\imagemagick-6.4.2-q16;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem\
===============
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe

¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

Layout.ini
NTOSBOOT-B00DFAAD.pf

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
et la c'est bon on a fini ou pas?????????
0
Réponse 24 / 29
Xplode Messages postés 9212 Statut Contributeur sécurité 726
 
Bien, refais maintenant un rapport ZHPDiag
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 25 / 29
gateuse Messages postés 4 Statut Membre
 
Merçi Xplode ,le probleme semble résolu,merçi de votre patience
Je vous dit pas à bientôt
Gateuse
0
Réponse 26 / 29
gateuse Messages postés 4 Statut Membre
 
https://www.cjoint.com/?ljh308xdeu

Alors docteur,c'est grave??
0
Réponse 27 / 29
Xplode Messages postés 9212 Statut Contributeur sécurité 726
 
-+-+-+-> USBfix ( Infections USB ) <-+-+-+-

[x] Télécharge USBfix ( de Chiquitine29 )

[x] Un tutoriel est disponible ici

[x] Installe le

/!\ Branche tout tes médias amovibles ( clés USB, DD externe, Cartes SD ) /!\

[x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )

[x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.

[x] Au menu principal, choisis l'option 2

[x] Laisse l'outil travailler puis poste le rapport dans ton prochain message
0
Réponse 28 / 29
gateuse
 
Je ne parviens pas à teléchargé USBfix<ça m'écrit
Not Found
The requested URL /download/Chiquitine29/UsbFix.exe was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

--------------------------------------------------------------------------------

Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8 Server at forum-aide-contre-virus.be Port 80
0
Réponse 29 / 29
gateuse
 
j'y suis arrivé autrement,voici le rapport:

############################## | UsbFix V6.050 |

User : Ghislaine (Administrateurs) # PC-FOSCHIA
Update on 09/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 22:34:42 | 09/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) 4 CPU 3.20GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local # 74,52 Go (38,84 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local # 111,76 Go (44,71 Go free) [WD Passport] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 556
C:\WINDOWS\system32\csrss.exe 824
C:\WINDOWS\system32\winlogon.exe 848
C:\WINDOWS\system32\services.exe 892
C:\WINDOWS\system32\lsass.exe 904
C:\WINDOWS\system32\Ati2evxx.exe 1072
C:\WINDOWS\system32\svchost.exe 1084
C:\WINDOWS\system32\svchost.exe 1184
C:\WINDOWS\System32\svchost.exe 1328
C:\WINDOWS\system32\svchost.exe 1428
C:\WINDOWS\system32\svchost.exe 1660
C:\WINDOWS\system32\spoolsv.exe 1956
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe 1996
C:\Program Files\Avira\AntiVir Desktop\sched.exe 2016
C:\WINDOWS\system32\svchost.exe 172
C:\WINDOWS\Explorer.EXE 520
C:\WINDOWS\system32\Rundll32.exe 720
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe 728
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 752
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe 1012
C:\Program Files\Lexmark 3600-4600 Series\lxdxMsdMon.exe 1224
C:\Program Files\Microsoft IntelliType Pro\type32.exe 1288
C:\Program Files\Analog Devices\Core\smax4pnp.exe 1300
C:\Program Files\PowerISO\PWRISOVM.EXE 1308
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe 1316
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe 1160
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe 1500
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe 1532
C:\Program Files\Microsoft IntelliPoint\point32.exe 1548
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe 1648
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe 1720
C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe 1788
C:\Program Files\Java\jre6\bin\jusched.exe 1840
C:\WINDOWS\system32\ctfmon.exe 1880
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe 1904
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1528
C:\WINDOWS\system32\CTsvcCDA.EXE 320
C:\WINDOWS\system32\crypserv.exe 424
C:\Program Files\Windows Media Player\WMPNSCFG.exe 436
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 468
C:\WINDOWS\system32\dlbtcoms.exe 492
C:\Program Files\Messenger\msmsgs.exe 1176
C:\WINDOWS\System32\FTRTSVC.exe 868
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 1268
C:\Program Files\Java\jre6\bin\jqs.exe 1752
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe 2096
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe 2216
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxserv.exe 2344
C:\WINDOWS\system32\lxdxcoms.exe 2436
C:\Documents and Settings\Ghislaine\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe 2444
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2492
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe 2732
C:\WINDOWS\system32\svchost.exe 2928
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN 2940
C:\Program Files\Inventel\Gateway\wlancfg.exe 2960
C:\WINDOWS\system32\MsPMSPSv.exe 3244
C:\WINDOWS\System32\svchost.exe 412
C:\Program Files\Windows Media Player\WMPNetwk.exe 288
C:\WINDOWS\system32\wbem\wmiapsrv.exe 2268
C:\WINDOWS\System32\alg.exe 2688
C:\Program Files\Logitech\QuickCam10\COCIManager.exe 1408
C:\Program Files\Windows Live\Contacts\wlcomm.exe 1656
C:\WINDOWS\system32\wbem\wmiprvse.exe 3272

################## | Fichiers # Dossiers infectieux |

################## | Registre # Clés Run infectieuses |

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{18084ec2-427a-11d9-8083-0011431f4a9b}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[07/11/2009 15:13|--a------|2800] C:\Ad-Report-CLEAN[1].log
[07/11/2009 18:15|--a------|522] C:\Ad-Report-CLEAN[2].log
[07/11/2009 18:46|--a------|1518] C:\Ad-Report-CLEAN[3].log
[07/11/2009 19:10|--a------|529] C:\Ad-Report-CLEAN[4].log
[28/06/2008 19:35|--a------|0] C:\AdobeDebug.txt
[07/11/2009 20:46|--a------|4] C:\AUTOEXEC.BAT
[07/11/2009 19:31|---hs----|216] C:\boot.ini
[05/08/2004 13:00|-rahs----|4952] C:\Bootfont.bin
[05/05/2009 05:54|--a------|384] C:\CKINFO.TXT
[07/11/2009 15:01|--a------|2168] C:\cleannavi.txt
[29/04/2008 16:50|--a------|0] C:\CONFIG.SYS
[29/04/2008 16:50|-rahs----|0] C:\IO.SYS
[07/11/2009 20:46|--a------|2915] C:\Kill'em.txt
[05/12/2004 20:02|--a------|9964] C:\lvcoinst.log
[29/04/2008 16:50|-rahs----|0] C:\MSDOS.SYS
[05/08/2004 13:00|-rahs----|47564] C:\NTDETECT.COM
[14/10/2008 18:30|-rahs----|252240] C:\ntldr
[?|?|?] C:\pagefile.sys
[09/11/2009 00:04|--a------|298] C:\password.klc
[09/11/2009 22:38|--a------|5500] C:\UsbFix.txt
[13/06/2009 08:45|--a------|79237] J:\diddl019.pes
[31/10/2009 10:31|--a------|35607] J:\Mouton1.jpg
[31/10/2009 22:45|--ahs----|53760] J:\Thumbs.db
[28/03/2009 10:57|--a------|45047] J:\010 peocock feather.pes
[09/06/2009 21:14|--a------|18826] J:\cuties2555189.SEW
[22/07/2009 21:19|--a------|19469518] J:\PRP-500165-.zip
[31/10/2009 19:33|--a------|27011] J:\MUBGuX0XYq.png
[26/08/2009 15:52|--a------|41042] J:\normal_fleurs_et_rubans.jpg
[03/09/2009 20:36|--a------|18626] J:\Edel017.hus
[03/09/2009 20:37|--a------|29622] J:\D104106.hus
[31/10/2009 19:36|--a------|14542] J:\sara49-213x312.jpg
[31/10/2009 19:36|--a------|13846] J:\sara48-184x288.jpg
[31/10/2009 19:36|--a------|16056] J:\sara47-195x288.jpg
[31/10/2009 20:34|--a------|72100] J:\werkwijzefloralpunchengels.jpg
[28/04/2008 21:53|--a------|1738306] J:\Clipartopolis_com - Digitizer's Heaven.mht
[28/04/2008 14:08|--a------|26] J:\CODE BOX.txt
[18/08/2008 00:37|--a------|363532] J:\Chat ballonxx.ecf
[13/06/2009 09:35|--a------|630] J:\Mes dossiers de partage.lnk
[30/04/2008 13:24|--a------|6715312] J:\pre-design3_setup.exe
[27/04/2008 04:18|--a------|2402832] J:\WLinstaller.exe
[11/05/2008 15:44|--a------|1271557] J:\wrar371fr.exe

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix.
# J:\autorun.inf -> Dossier créé par UsbFix.

################## | Suspect | https://www.virustotal.com/gui/ |

################## | Cracks / Keygens / Serials |

"J:\Embroidery Outlet\Embroidery Brother PE Design 5 with crack\Setup.exe"
04/09/2001 14:03 |Size 168448 |Crc32 85b09f74 |Md5 fb6674a519505cc93e28cf600bbc23a3

"J:\Embroidery Outlet\Embroidery Brother PE Design 5 with crack\PatchPE5\PatchPE5.exe"
21/02/2003 08:14 |Size 18113 |Crc32 78ce6523 |Md5 47f75816188834e5d065f1aac9d07eb7

################## | Upload |

Veuillez envoyer le fichier : C:\DOCUME~1\GHISLA~1\Bureau\UsbFix_Upload_Me_PC-FOSCHIA.zip : https://www.androidworld.fr/
Merci pour votre contribution .

################## | ! Fin du rapport # UsbFix V6.050 ! |
0