Antivirus Live

Question

Bonjour,

Je suis chez mes parents pour la période des fêtes et, surprise!, leur ordinateur semble très infecté par des virus. En bas à droite, un programme nommé Antivirus Live que je n'ai jamais installé semble faire la loi sur l'ordinateur. De nombreux avertissements de virus apparaissent et semblent louches.

Je commence par où?

gen-hackman · Answer

salut :

Télécharge OTL de OLDTimer

&#9654 enregistre le sur ton Bureau.

&#9654 Double clic ( pour vista => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

&#9654 Coche les 2 cases Lop et Purity

&#9654 Coche la case devant scan all users

&#9654 règle-le sur "60 Days"

&#9654 dans la colonne de gauche , mets tout sur all

ne modifie pas ceci : 

"files created whithin" et "files modified whithin" 

&#9654Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

&#9654&#9654 Tu feras la meme chose avec le "Extra.txt".

Frank · Answer

Impossible d'exécuter OTL «Application cannot be executed. The file otl1.exe is infected. Do you want to activate your antivrisu software now?»

gen-hackman · Answer

/!\ ATTENTION SUIVRE SCRUPULEUSEMENT A LA LETTRE CES INDICATIONS/!\

▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe"

_______________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
======================================================

▶ On va utiliser ComboFix.exe. Rends toi sur cette page web pour obtenir les liens de téléchargement, ainsi que des instructions pour exécuter l'outil:

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

ou renommé :

http://ww38.toofiles.com/fr/oip/documents/exe/reader_sl.html , puis telecharge reader_sl

http://www.cijoint.fr/cjlink.php?file=cj200912/cijrhf1tyT.zip (à dezipper)

Avant d'utiliser ComboFix :
______________________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

>> Reviens sur le forum, et

▶ copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

Frank · Answer

Impossible d'utiliser Combo Fix, la même erreur que précédemment apparaît, même en le renommant avant de le télécharger ou en suivant un autre des liens. Il commence à ouvrir puis se ferme.

Une autre idée?

gen-hackman · Answer

utilise-le en mode sans echec avec prise en charge reseau

Frank · Answer

Réussi!

ComboFix 09-12-25.02 - Frank 25/12/2009  13:51:53.3.1 - x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.2.1036.18.510.253 [GMT -5:00]
Lancé depuis: c:\documents and settings\Frank\Bureau\francis.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Frank\Mes documents\ZbThumbnail.info
c:\documents and settings\Max\Local Settings\Application Data\molmku
c:\documents and settings\Max\Local Settings\Application Data\molmku\ykcesysguard.exe
c:\documents and settings\Max\Mes documents\ZbThumbnail.info
c:\windows\system32\muzapp.exe

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-11-25 au 2009-12-25  ))))))))))))))))))))))))))))))))))))
.

2009-12-22 19:17 . 2009-12-22 19:17	280832	----a-w-	c:\documents and settings\Max\Local Settings\Application Data\syssvc.exe
2009-12-18 21:15 . 2009-12-18 21:15	--------	d-sh--w-	c:\windows\system32\config\systemprofile\IETldCache
2009-12-18 20:54 . 2009-12-22 19:18	--------	d-----w-	c:\documents and settings\Jacques\Local Settings\Application Data\kdoasu
2009-12-18 00:09 . 2009-12-18 00:09	109568	--sha-r-	c:\windows\system32asmans8.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-22 19:59 . 2007-12-09 18:06	--------	d-----w-	c:\documents and settings\Max\Application Data\LimeWire
2009-12-14 23:42 . 2009-12-14 23:46	2065688	----a-w-	c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-12-09 20:32 . 2001-08-28 12:00	82350	----a-w-	c:\windows\system32\perfc00C.dat
2009-12-09 20:32 . 2001-08-28 12:00	503466	----a-w-	c:\windows\system32\perfh00C.dat
2009-12-04 20:00 . 2007-12-22 16:44	--------	d-----w-	c:\program files\Norton Security Scan
2009-11-29 18:30 . 2007-06-16 18:57	--------	d-----w-	c:\documents and settings\Jacques\Application Data\Apple Computer
2009-11-26 17:49 . 2009-12-14 23:46	3514648	----a-w-	c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-11-26 17:49 . 2009-12-14 23:46	2029336	----a-w-	c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-16 00:34 . 2009-07-03 19:10	--------	d-----w-	c:\documents and settings\Frank\Application Data\Skype
2009-11-15 23:08 . 2009-08-08 16:34	--------	d-----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-15 23:06 . 2009-07-03 19:11	--------	d-----w-	c:\documents and settings\Frank\Application Data\skypePM
2009-11-15 22:59 . 2009-09-14 02:54	0	----a-w-	c:\windows\system32\drivers\lvuvc.hs
2009-11-15 22:59 . 2009-09-14 02:52	0	----a-w-	c:\windows\system32\drivers\logiflt.iad
2009-11-14 20:17 . 2004-01-03 00:09	--------	d-----w-	c:\program files\Steam
2009-11-08 06:09 . 2009-11-08 06:07	--------	d-----w-	c:\program files\iTunes
2009-11-08 06:08 . 2009-11-08 06:08	--------	d-----w-	c:\program files\iPod
2009-11-08 06:08 . 2007-08-05 15:55	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-11-08 05:45 . 2009-11-08 05:45	--------	d-----w-	c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-11-07 20:20 . 2007-01-20 13:31	--------	d-----w-	c:\documents and settings\Max\Application Data\Apple Computer
2009-11-07 20:04 . 2007-12-09 17:57	--------	d-----w-	c:\program files\LimeWire
2009-11-06 22:47 . 2009-11-06 22:46	--------	d-----w-	c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-06 22:45 . 2009-11-06 22:45	--------	d-----w-	c:\program files\Bonjour
2009-11-06 22:44 . 2009-11-06 22:44	--------	d-----w-	c:\program files\QuickTime
2009-11-06 22:41 . 2007-08-05 15:55	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
2009-11-06 22:36 . 2009-11-06 22:36	--------	d-----w-	c:\program files\Safari
2009-11-06 13:42 . 2005-03-11 21:35	61960	----a-w-	c:\documents and settings\Jacques\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-29 07:42 . 2004-07-07 22:59	916480	----a-w-	c:\windows\system32\wininet.dll
2009-10-29 01:58 . 2009-10-29 01:58	79144	----a-w-	c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-21 05:39 . 2004-08-19 23:09	75776	----a-w-	c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-19 23:09	25088	----a-w-	c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00	265728	------w-	c:\windows\system32\drivers\http.sys
2009-10-13 10:33 . 2003-12-27 22:59	271360	----a-w-	c:\windows\system32\oakley.dll
2009-10-12 13:39 . 2003-12-27 22:59	150528	----a-w-	c:\windows\system32astls.dll
2009-10-12 13:39 . 2003-12-27 22:59	79872	----a-w-	c:\windows\system32aschap.dll
2009-09-30 19:17 . 2009-09-30 19:17	86576	----a-w-	c:\documents and settings\Max\Application Data\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
2009-09-30 19:17 . 2009-09-30 19:17	392728	----a-w-	c:\documents and settings\Max\Application Data\Microsoft\Services Windows Live\Services Windows Live.dll
2009-09-30 19:17 . 2009-09-30 19:17	132672	----a-w-	c:\documents and settings\Max\Application Data\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe
2009-09-28 18:31 . 2004-09-29 21:48	61960	----a-w-	c:\documents and settings\Max\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-12-14 2043160]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]
2009-08-30 15:25	11952	----a-w-	c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders	msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winty61.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NaturalColorLoad.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\NaturalColorLoad.lnk
backup=c:\windows\pss\NaturalColorLoad.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Frank^Menu Démarrer^Programmes^Démarrage^InterAct Profile Activator.lnk]
path=c:\documents and settings\Frank\Menu Démarrer\Programmes\Démarrage\InterAct Profile Activator.lnk
backup=c:\windows\pss\InterAct Profile Activator.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Max^Menu Démarrer^Programmes^Démarrage^Notification de cadeaux MSN.lnk]
path=c:\documents and settings\Max\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk
backup=c:\windows\pss\Notification de cadeaux MSN.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2smf35P
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\advap32
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoupd
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DirectX64

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pcylhjvbarsx

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 21:10	35696	----a-w-	c:\program files\Adobe\Reader 9.0\Readereader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33	15360	------w-	c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
1998-11-30 23:04	497376	----a-w-	c:\windows\p_981116.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2005-01-23 14:31	126976	----a-w-	c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-03-11 10:08	172032	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\hpztsb08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-01-23 14:36	155648	----a-w-	c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-29 01:21	141600	----a-w-	c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-05-08 14:35	2780432	----a-w-	c:\program files\Logitech\Logitech WebCam Software\LWS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MAAgent]
2007-01-31 00:36	57344	----a-w-	c:\program files\MarkAny\ContentSafer\MaAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2009-09-10 18:53	1312080	----a-w-	c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2003-06-07 11:32	50688	----a-w-	c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50	155648	----a-w-	c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 06:54	417792	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 18:11	25623336	----a-r-	c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
2007-02-23 20:32	126976	----a-w-	c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2003-04-24 21:53	54784	----a-w-	c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
2002-05-03 15:40	4341760	----a-w-	c:\program files\Alcatel\SpeedTouch USB\dragdiag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 20:07	2260480	--sha-r-	c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
2006-11-02 18:43	472632	----a-w-	c:\progra~1\Sony\SONICS~1\SSAAD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-11-14 19:36	1217808	----a-w-	c:\program files\Steam\steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-09-25 06:11	132496	----a-w-	c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-11-12 14:33	185896	----a-w-	c:\program files\Fichiers communs\Real\Update_OBealsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2006-06-21 17:14	35328	----a-w-	c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Grisoft\AVG7\avginet.exe"=
"c:\Program Files\Grisoft\AVG7\avgcc.exe"=
"c:\Program Files\Grisoft\AVG7\avgemc.exe"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\AVG\AVG8\avgemc.exe"=
"c:\Program Files\AVG\AVG8\avgupd.exe"=
"c:\Program Files\AVG\AVG8\avgnsx.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\WINDOWS\system32\dpvsetup.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Program Files\Steam\SteamApps\bora_vegeta@hotmail.com\day of defeat\hl.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=
"c:\Program Files\Skype\Plugin Manager\skypePM.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [04/05/2009 15:42 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [04/05/2009 15:42 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [04/05/2009 15:42 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [04/05/2009 15:42 297752]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [27/09/2009 14:46 54752]
S0 Winty61;Winty61;c:\windows\system32\Drivers\Winty61.sys --> c:\windows\system32\Drivers\Winty61.sys [?]
S3 alcan5ln;Alcatel SpeedTouch(tm) USB ADSL RFC1483 Networking Driver (NDIS);c:\windows\system32\drivers\alcan5ln.sys [26/12/2003 13:19 36960]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = hxxp://www.sympatico.ca/
IE: Chercher avec Copernic Agent - c:\program files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: {{6FDD5236-C9F0-49ef-935D-385F5E21991A} - c:\program files\Poker.com\poker.exe
Trusted Zone: desajrdins.com\www
TCP: {4CF69A35-1EF9-4DB2-96BE-5B97B162E572} = 67.69.235.1 207.164.234.193
Handler: copernicagent - {A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6} - c:\progra~1\COPERN~2\COPERN~1.DLL
Handler: copernicagentcache - {AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D} - c:\progra~1\COPERN~2\COPERN~1.DLL
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Frank\Application Data\Mozilla\Firefox\Profiles\adfa6ofx.default\
FF - plugin: c:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins
pqtplugin8.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
ppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
prjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6
prpjplug.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{F0FD7609-05B3-A5E8-6B96-55490478DE56} - (no file)
HKLM-Run-ngtqemet - c:\documents and settings\Jacques\Local Settings\Application Data\kdoasu\cgjtsysguard.exe
HKLM-Run-rbqoqlex - c:\documents and settings\Max\Local Settings\Application Data\molmku\ykcesysguard.exe
SafeBoot-Winch51.sys
SafeBoot-Winns61.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-25 14:03
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\WINDOWS\system32\FM20ENU.DLL"
.
Heure de fin: 2009-12-25  14:11:00
ComboFix-quarantined-files.txt  2009-12-25 19:10
ComboFix2.txt  2008-07-29 20:35
ComboFix3.txt  2008-07-29 19:18

Avant-CF: 101 550 780 416 octets libres
Après-CF: 102 446 899 200 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn

Current=1 Default=1 Failed=4 LastKnownGood=3 Sets=1,2,3,4
- - End Of File - - 5217524F2F9EE10536557E821305E7A2

gen-hackman · Answer

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

&#9654 Télécharge et installe List&Kill'em et enregistre le sur ton bureau 

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

coche la case "creer une icone sur le bureau"

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis la langue puis choisis l'option 1 = Mode Recherche

&#9654 laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

&#9654 Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

tu peux supprimer le rapport catchme.log de ton bureau maintenant.

Frank · Answer

Merci! J'ai fait le scan, mais je ne pourrai peut-être pas faire les autres opérations avant quelques heures ou quelques jours. Tu peux m'expliquer  quoi faire et je le ferai dès que possible?

List'em by g3n-h@ckm@n 1.1.6.1 

Thx to Chiquitine29.....& CCM team 

User : Frank (Administrateurs) # UNKNOWN-Z3WYBW6
Update on 24/12/2009 by g3n-h@ckm@n ::::: 20:30 
Start at: 14:39:09 | 25/12/2009
Contact : g3n-h@ckm@n sur CCM

              Intel(R) Pentium(R) 4 CPU 2.66GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AVG Anti-Virus Free 8.5 [ (!) Disabled | Updated ]
FW : ZoneAlarm Firewall[ (!) Disabled ]6.1.737.000

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 149,05 Go (95,42 Go free) | NTFS
D:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\WINDOWS\System32\smss.exe 544
C:\WINDOWS\system32\csrss.exe 608
C:\WINDOWS\system32\winlogon.exe 632
C:\WINDOWS\system32\services.exe 676
C:\WINDOWS\system32\lsass.exe 688
C:\WINDOWS\system32\svchost.exe 856
C:\WINDOWS\system32\svchost.exe 928
C:\WINDOWS\System32\svchost.exe 1024
C:\WINDOWS\system32\svchost.exe 1056
C:\WINDOWS\System32\svchost.exe 1208
C:\WINDOWS\system32\svchost.exe 1332
C:\WINDOWS\system32\spoolsv.exe 1488
C:\WINDOWS\System32\svchost.exe 2020
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 148
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe 164
C:\Program Files\Bonjour\mDNSResponder.exe 176
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 324
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 756
C:\PROGRA~1\AVG\AVG8\avgrsx.exe 992
C:\WINDOWS\System32\svchost.exe 1532
C:\PROGRA~1\AVG\AVG8\avgemc.exe 1552
C:\Program Files\AVG\AVG8\avgcsrvx.exe 1964
C:\Program Files\iTunes\iTunesHelper.exe 420
C:\WINDOWS\System32\alg.exe 2092
C:\Program Files\iPod\bin\iPodService.exe 2884
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe 1816
C:\WINDOWS\explorer.exe 2484
C:\Program Files\Mozilla Firefox\firefox.exe 3852
C:\PROGRA~1\AVG\AVG8\avgnsx.exe 3552
C:\Program Files\List_Kill'em\List_Kill'em.exe 2512
C:\WINDOWS\system32\cmd.exe 1092
C:\WINDOWS\system32\wbem\wmiprvse.exe 3444
C:\Documents and Settings\Frank\Local Settings	emp\23.tmp\pv.exe 3968

======================
Keys "Run" 
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
AVG8_TRAY	REG_SZ         	C:\PROGRA~1\AVG\AVG8\avgtray.exe 
Malwarebytes Anti-Malware (reboot)	REG_SZ         	"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript 
QuickTime Task	REG_SZ         	"C:\Program Files\QuickTime\QTTask.exe" -atboottime 
iTunesHelper	REG_SZ         	"C:\Program Files\iTunes\iTunesHelper.exe" 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
Malwarebytes' Anti-Malware	REG_SZ         	C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
DisableRegistryTools	REG_DWORD      	0 (0x0) 

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
CDRAutoRun	REG_DWORD      	0 (0x0) 
NoDrives	REG_DWORD      	0 (0x0) 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
NoDrives	REG_DWORD      	0 (0x0) 
HonorAutoRunSetting	REG_DWORD      	1 (0x1) 

=============== 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify	ermsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 
{88485281-8b4b-4f8d-9ede-82e29a064277}	REG_SZ         	MarkAny Contents Safer Manager 1.0 

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Messenger\msmsgs.exe	REG_SZ         	C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Grisoft\AVG7\avginet.exe	REG_SZ         	C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe	REG_SZ         	C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe
C:\Program Files\Grisoft\AVG7\avgemc.exe	REG_SZ         	C:\Program Files\Grisoft\AVG7\avgemc.exe:*:Enabled:avgemc.exe
C:\Program Files\LimeWire\LimeWire.exe	REG_SZ         	C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
C:\Program Files\AVG\AVG8\avgemc.exe	REG_SZ         	C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe
C:\Program Files\AVG\AVG8\avgupd.exe	REG_SZ         	C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe
C:\Program Files\AVG\AVG8\avgnsx.exe	REG_SZ         	C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe	REG_SZ         	C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\WINDOWS\system32\dpvsetup.exe	REG_SZ         	C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
C:\Program Files\Bonjour\mDNSResponder.exe	REG_SZ         	C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\Program Files\iTunes\iTunes.exe	REG_SZ         	C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\Program Files\Steam\SteamApps\bora_vegeta@hotmail.com\day of defeat\hl.exe	REG_SZ         	C:\Program Files\Steam\SteamApps\bora_vegeta@hotmail.com\day of defeat\hl.exe:*:Enabled:Half-Life Launcher
C:\Program Files\Skype\Phone\Skype.exe	REG_SZ         	C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
C:\Program Files\Skype\Plugin Manager\skypePM.exe	REG_SZ         	C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\MSN Messenger\msncall.exe	REG_SZ         	C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\MSN Messenger\livecall.exe	REG_SZ         	C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe	REG_SZ         	C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

=============== 
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.ca/?gws_rd=ssl

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x3 
EapHost : 0x3 
SharedAccess : 0x2 
wuauserv : 0x2 

=========
 
=======
Drive :
=======

Défragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse                 	 
    149 Go total,  95,42 Go libre (64%),  6% fragmenté (fragmentation du fichier 13%)

Il ne vous est pas nécessaire de défragmenter ce volume. 	 

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache  
C:\WINDOWS\Fonts\GRGAREF.TTF  
C:\WINDOWS\mbr.exe  
C:\WINDOWS\System32\drivers\etc\hosts.msn  
C:\WINDOWS\System32\drivers\lvuvc.hs  
C:\Documents and Settings\Frank\Application Data\GDIPFONTCACHEV1.DAT  
C:\Documents and Settings\Frank\Application Data\wklnhst.dat  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
"HKLM\Software\Trymedia Systems"  
HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}  

================
Other infections
================

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-25 14:41:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK 

==========
Programs
==========

a2 free
Adobe
Age Of Empires II
Age of Mythology
Ahead
AIDEAFE
Aladdin Systems
Alcatel
Anti-virus temporaire
Apple Software Update
ArcSoft
AVG
AVIcodec
AvRack
Bonjour
Call of Duty
Canon
CCleaner
Civilization III
Civilization III - Play the World
CivilizationII
CM3000
Copernic Agent
Creative Labs
directx
DivX
EA SPORTS
Esperanto
Fichiers communs
FileSee
FileZilla
fsupport
Google
Grisoft
Infogrames Interactive
InstallShield Installation Information
Intel
Internet Explorer
iPod
iTunes
Java
Kazaa Lite
Lame MP3 Codec
Lavasoft
LimeWire
List_Kill'em
Logitech
LucasArts
Macromedia
Malwarebytes' Anti-Malware
MarkAny
Messenger
Messenger Plus! 3
Messenger Plus! Live
Microsoft
Microsoft ActiveSync
Microsoft CAPICOM 2.1.0.2
microsoft frontpage
Microsoft Games
Microsoft Money
Microsoft Office
Microsoft Picture It! 9
Microsoft Silverlight
Microsoft SQL Server Compact Edition
Microsoft Sync Framework
Microsoft Works
Microsoft Works Suite 2004
mIRC
Movie Maker
Mozilla Firefox
MSBuild
msn
MSN Gaming Zone
MSN Messenger
MSXML 4.0
MultiProxy
NetMeeting
NoAds
Norton Security Scan
NOS
Notify
OfficeUpdate11
Opera
Outlook Express
PacificPoker
PDF Creator Plus 4.0
Poker.com
Psycle
PT Software
QuickTime
Real
Realtek Sound Manager
Red Storm Entertainment
Reference Assemblies
RiskII
Rockstar Games
Safari
Samsung
Screen Recorder
SEC
Services en ligne
SigmaTel
Sim City 3
Skype
Sony
Sony Corporation
Spybot - Search & Destroy
Steam
Symantec
Tap'Touche
Uninstall Information
Vilma
Winamp
Windows Journal Viewer
Windows Live
Windows Live SkyDrive
Windows Media Components
Windows Media Connect 2
Windows Media Player
Windows NT
WindowsUpdate
WinRAR
WinZip
XemiComputers
xerox
XviD
Yahoo!
Zone Labs

============
Lecteur C:
============

$AVG8.VAULT$
45.wmv
Boot.bak
boot.ini
Bootfont.bin
Cavedog
cmdcons
cmldr
ComboFix.txt
Config.Msi
CONFIG.SYS
devicetable.log
Documents and Settings
e1a6e0469778cef8976b
hpfr3600.log
IntelPRO
IO.SYS
Kill'em
List'em.txt
MSDOS.SYS
MSOCache
NTDETECT.COM
ntldr
pagefile.sys
Program Files
QooBox
rapport.txt
Sierra
sqmdata00.sqm
sqmdata01.sqm
sqmdata02.sqm
sqmdata03.sqm
sqmdata04.sqm
sqmdata05.sqm
sqmdata06.sqm
sqmdata07.sqm
sqmdata08.sqm
sqmdata09.sqm
sqmdata10.sqm
sqmdata11.sqm
sqmdata12.sqm
sqmdata13.sqm
sqmdata14.sqm
sqmdata15.sqm
sqmdata16.sqm
sqmdata17.sqm
sqmdata18.sqm
sqmdata19.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
sqmnoopt06.sqm
sqmnoopt07.sqm
sqmnoopt08.sqm
sqmnoopt09.sqm
sqmnoopt10.sqm
sqmnoopt11.sqm
sqmnoopt12.sqm
sqmnoopt13.sqm
sqmnoopt14.sqm
sqmnoopt15.sqm
sqmnoopt16.sqm
sqmnoopt17.sqm
sqmnoopt18.sqm
sqmnoopt19.sqm
System Volume Information
TB.txt
TEMP
Toolbar SD
WINDOWS
 
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials 
 
C:\Documents and Settings\Frank\Mes documents\Dreamweaver.MX.2004\Dreamweaver.MX.2004\Serial.txt 
C:\Program Files\Adobe\Photoshop 7\Serial#.txt 
C:\Program Files\Adobe\Photoshop 7.0\Plug-Ins\Effects\Patchwork.8BF 
C:\Program Files\Age Of Empires II\crack.zip 
C:\Documents and Settings\Frank\Mes documents\Download\Age2XPatch.exe 
C:\Program Files\Age Of Empires II\crack.zip 
C:\Program Files\Civilization III\Install.exe 
C:\Program Files\Civilization III - Play the World\Install.exe 
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Frank · Answer

Salut! Bon, il me semblait avoir poster cela hier, mais comme le message n'apparait plus, je reposte le rapport :

List'em by g3n-h@ckm@n 1.1.6.1 

Thx to Chiquitine29.....& CCM team 

User : Frank (Administrateurs) # UNKNOWN-Z3WYBW6
Update on 24/12/2009 by g3n-h@ckm@n ::::: 20:30 
Start at: 10:25:25 | 26/12/2009
Contact : g3n-h@ckm@n sur CCM

              Intel(R) Pentium(R) 4 CPU 2.66GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AVG Anti-Virus Free 8.5 [ (!) Disabled | Updated ]
FW : ZoneAlarm Firewall[ (!) Disabled ]6.1.737.000

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 149,05 Go (95,39 Go free) | NTFS
D:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\WINDOWS\System32\smss.exe 544
C:\WINDOWS\system32\csrss.exe 608
C:\WINDOWS\system32\winlogon.exe 632
C:\WINDOWS\system32\services.exe 676
C:\WINDOWS\system32\lsass.exe 688
C:\WINDOWS\system32\svchost.exe 856
C:\WINDOWS\system32\svchost.exe 928
C:\WINDOWS\System32\svchost.exe 1024
C:\WINDOWS\system32\svchost.exe 1056
C:\WINDOWS\System32\svchost.exe 1208
C:\WINDOWS\system32\svchost.exe 1332
C:\WINDOWS\system32\spoolsv.exe 1488
C:\WINDOWS\System32\svchost.exe 2020
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 148
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe 164
C:\Program Files\Bonjour\mDNSResponder.exe 176
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 324
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 756
C:\PROGRA~1\AVG\AVG8\avgrsx.exe 992
C:\WINDOWS\System32\svchost.exe 1532
C:\PROGRA~1\AVG\AVG8\avgemc.exe 1552
C:\Program Files\AVG\AVG8\avgcsrvx.exe 1964
C:\Program Files\iTunes\iTunesHelper.exe 420
C:\WINDOWS\System32\alg.exe 2092
C:\Program Files\iPod\bin\iPodService.exe 2884
C:\WINDOWS\explorer.exe 2484
C:\PROGRA~1\AVG\AVG8\avgnsx.exe 3552
C:\Program Files\TeamViewer\Version5\TeamViewer.exe 2548
C:\Program Files\List_Kill'em\List_Kill'em.exe 2776
C:\WINDOWS\system32\cmd.exe 2772
C:\WINDOWS\system32\wbem\wmiprvse.exe 2712
C:\Documents and Settings\Frank\Local Settings	emp\38.tmp\pv.exe 192

======================
Keys "Run" 
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
AVG8_TRAY	REG_SZ         	C:\PROGRA~1\AVG\AVG8\avgtray.exe 
Malwarebytes Anti-Malware (reboot)	REG_SZ         	"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript 
QuickTime Task	REG_SZ         	"C:\Program Files\QuickTime\QTTask.exe" -atboottime 
iTunesHelper	REG_SZ         	"C:\Program Files\iTunes\iTunesHelper.exe" 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
Malwarebytes' Anti-Malware	REG_SZ         	C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
DisableRegistryTools	REG_DWORD      	0 (0x0) 

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
CDRAutoRun	REG_DWORD      	0 (0x0) 
NoDrives	REG_DWORD      	0 (0x0) 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveAutoRun	REG_DWORD      	67108863 (0x3ffffff) 
NoDriveTypeAutoRun	REG_DWORD      	323 (0x143) 
NoDrives	REG_DWORD      	0 (0x0) 
HonorAutoRunSetting	REG_DWORD      	1 (0x1) 

=============== 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify	ermsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 
{88485281-8b4b-4f8d-9ede-82e29a064277}	REG_SZ         	MarkAny Contents Safer Manager 1.0 

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Messenger\msmsgs.exe	REG_SZ         	C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Grisoft\AVG7\avginet.exe	REG_SZ         	C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe	REG_SZ         	C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe
C:\Program Files\Grisoft\AVG7\avgemc.exe	REG_SZ         	C:\Program Files\Grisoft\AVG7\avgemc.exe:*:Enabled:avgemc.exe
C:\Program Files\LimeWire\LimeWire.exe	REG_SZ         	C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
C:\Program Files\AVG\AVG8\avgemc.exe	REG_SZ         	C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe
C:\Program Files\AVG\AVG8\avgupd.exe	REG_SZ         	C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe
C:\Program Files\AVG\AVG8\avgnsx.exe	REG_SZ         	C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe	REG_SZ         	C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\WINDOWS\system32\dpvsetup.exe	REG_SZ         	C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
C:\Program Files\Bonjour\mDNSResponder.exe	REG_SZ         	C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\Program Files\iTunes\iTunes.exe	REG_SZ         	C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\Program Files\Steam\SteamApps\bora_vegeta@hotmail.com\day of defeat\hl.exe	REG_SZ         	C:\Program Files\Steam\SteamApps\bora_vegeta@hotmail.com\day of defeat\hl.exe:*:Enabled:Half-Life Launcher
C:\Program Files\Skype\Phone\Skype.exe	REG_SZ         	C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
C:\Program Files\Skype\Plugin Manager\skypePM.exe	REG_SZ         	C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
C:\Program Files\TeamViewer\Version5\TeamViewer.exe	REG_SZ         	C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\MSN Messenger\msncall.exe	REG_SZ         	C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\MSN Messenger\livecall.exe	REG_SZ         	C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe	REG_SZ         	C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

=============== 
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.ca/?gws_rd=ssl

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x3 
EapHost : 0x3 
SharedAccess : 0x2 
wuauserv : 0x2 

=========
 
=======
Drive :
=======

Défragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse                 	 
    149 Go total,  95,39 Go libre (63%),  6% fragmenté (fragmentation du fichier 13%)

Il ne vous est pas nécessaire de défragmenter ce volume. 	 

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache  
C:\WINDOWS\Fonts\GRGAREF.TTF  
C:\WINDOWS\mbr.exe  
C:\WINDOWS\System32\drivers\etc\hosts.msn  
C:\WINDOWS\System32\drivers\lvuvc.hs  
C:\Documents and Settings\Frank\Application Data\GDIPFONTCACHEV1.DAT  
C:\Documents and Settings\Frank\Application Data\wklnhst.dat  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
"HKLM\Software\Trymedia Systems"  
HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}  

================
Other infections
================

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-26 10:28:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK 

==========
Programs
==========

a2 free
Adobe
Age Of Empires II
Age of Mythology
Ahead
AIDEAFE
Aladdin Systems
Alcatel
Anti-virus temporaire
Apple Software Update
ArcSoft
AVG
AVIcodec
AvRack
Bonjour
Call of Duty
Canon
CCleaner
Civilization III
Civilization III - Play the World
CivilizationII
CM3000
Copernic Agent
Creative Labs
directx
DivX
EA SPORTS
Esperanto
Fichiers communs
FileSee
FileZilla
fsupport
Google
Grisoft
Infogrames Interactive
InstallShield Installation Information
Intel
Internet Explorer
iPod
iTunes
Java
Kazaa Lite
Lame MP3 Codec
Lavasoft
LimeWire
List_Kill'em
Logitech
LucasArts
Macromedia
Malwarebytes' Anti-Malware
MarkAny
Messenger
Messenger Plus! 3
Messenger Plus! Live
Microsoft
Microsoft ActiveSync
Microsoft CAPICOM 2.1.0.2
microsoft frontpage
Microsoft Games
Microsoft Money
Microsoft Office
Microsoft Picture It! 9
Microsoft Silverlight
Microsoft SQL Server Compact Edition
Microsoft Sync Framework
Microsoft Works
Microsoft Works Suite 2004
mIRC
Movie Maker
Mozilla Firefox
MSBuild
msn
MSN Gaming Zone
MSN Messenger
MSXML 4.0
MultiProxy
NetMeeting
NoAds
Norton Security Scan
NOS
Notify
OfficeUpdate11
Opera
Outlook Express
PacificPoker
PDF Creator Plus 4.0
Poker.com
Psycle
PT Software
QuickTime
Real
Realtek Sound Manager
Red Storm Entertainment
Reference Assemblies
RiskII
Rockstar Games
Safari
Samsung
Screen Recorder
SEC
Services en ligne
SigmaTel
Sim City 3
Skype
Sony
Sony Corporation
Spybot - Search & Destroy
Steam
Symantec
Tap'Touche
TeamViewer
Uninstall Information
Vilma
Winamp
Windows Journal Viewer
Windows Live
Windows Live SkyDrive
Windows Media Components
Windows Media Connect 2
Windows Media Player
Windows NT
WindowsUpdate
WinRAR
WinZip
XemiComputers
xerox
XviD
Yahoo!
Zone Labs

============
Lecteur C:
============

$AVG8.VAULT$
45.wmv
Boot.bak
boot.ini
Bootfont.bin
Cavedog
cmdcons
cmldr
ComboFix.txt
Config.Msi
CONFIG.SYS
devicetable.log
Documents and Settings
e1a6e0469778cef8976b
hpfr3600.log
IntelPRO
IO.SYS
Kill'em
List'em.txt
MSDOS.SYS
MSOCache
NTDETECT.COM
ntldr
pagefile.sys
Program Files
QooBox
rapport.txt
Sierra
sqmdata00.sqm
sqmdata01.sqm
sqmdata02.sqm
sqmdata03.sqm
sqmdata04.sqm
sqmdata05.sqm
sqmdata06.sqm
sqmdata07.sqm
sqmdata08.sqm
sqmdata09.sqm
sqmdata10.sqm
sqmdata11.sqm
sqmdata12.sqm
sqmdata13.sqm
sqmdata14.sqm
sqmdata15.sqm
sqmdata16.sqm
sqmdata17.sqm
sqmdata18.sqm
sqmdata19.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
sqmnoopt06.sqm
sqmnoopt07.sqm
sqmnoopt08.sqm
sqmnoopt09.sqm
sqmnoopt10.sqm
sqmnoopt11.sqm
sqmnoopt12.sqm
sqmnoopt13.sqm
sqmnoopt14.sqm
sqmnoopt15.sqm
sqmnoopt16.sqm
sqmnoopt17.sqm
sqmnoopt18.sqm
sqmnoopt19.sqm
System Volume Information
TB.txt
TEMP
Toolbar SD
WINDOWS
 
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials 
 
C:\Documents and Settings\Frank\Mes documents\Dreamweaver.MX.2004\Dreamweaver.MX.2004\Serial.txt 
C:\Program Files\Adobe\Photoshop 7\Serial#.txt 
C:\Program Files\Adobe\Photoshop 7.0\Plug-Ins\Effects\Patchwork.8BF 
C:\Program Files\Age Of Empires II\crack.zip 
C:\Documents and Settings\Frank\Mes documents\Download\Age2XPatch.exe 
C:\Program Files\Age Of Empires II\crack.zip 
C:\Program Files\Civilization III\Install.exe 
C:\Program Files\Civilization III - Play the World\Install.exe 
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

gen-hackman · Answer

supprime ces cracks source d'infection puis :

&#9654 Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :

&#9654 choisis l'option 2 = Mode Suppression

laisse travailler l'outil.

en fin de scan un rapport s'ouvre 

&#9654 colle le contenu dans ta reponse

Francis · Answer

Kill'em by g3n-h@ckm@n 1.1.6.1 
 
User : Frank (Administrateurs) # UNKNOWN-Z3WYBW6
Update on 24/12/2009 by g3n-h@ckm@n ::::: 20:30 
Start at: 14:19:29 | 01/01/2010
Contact : g3n-h@ckm@n sur CCM

              Intel(R) Pentium(R) 4 CPU 2.66GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AVG Anti-Virus Free 9.0 [ (!) Disabled | Updated ]
FW : ZoneAlarm Firewall[ (!) Disabled ]6.1.737.000

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 149,05 Go (94,69 Go free) | NTFS
D:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\WINDOWS\System32\smss.exe 552
C:\WINDOWS\system32\csrss.exe 616
C:\WINDOWS\system32\winlogon.exe 640
C:\WINDOWS\system32\services.exe 684
C:\WINDOWS\system32\lsass.exe 696
C:\WINDOWS\system32\svchost.exe 864
C:\WINDOWS\system32\svchost.exe 932
C:\WINDOWS\System32\svchost.exe 1028
C:\WINDOWS\system32\svchost.exe 1060
C:\Program Files\AVG\AVG9\avgchsvx.exe 1108
C:\Program Files\AVG\AVG9\avgrsx.exe 1116
C:\Program Files\AVG\AVG9\avgcsrvx.exe 1216
C:\WINDOWS\System32\svchost.exe 1300
C:\WINDOWS\system32\svchost.exe 1428
C:\WINDOWS\system32\spoolsv.exe 1700
C:\WINDOWS\system32undll32.exe 1744
C:\WINDOWS\System32\svchost.exe 1888
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1920
C:\Program Files\AVG\AVG9\avgwdsvc.exe 1932
C:\Program Files\Bonjour\mDNSResponder.exe 1944
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe 2028
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 192
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 356
C:\Program Files\AVG\AVG9\avgnsx.exe 404
C:\WINDOWS\System32\svchost.exe 800
C:\Program Files\AVG\AVG9\avgemc.exe 884
C:\Program Files\AVG\AVG9\avgcsrvx.exe 1080
C:\WINDOWS\System32\alg.exe 2080
C:\WINDOWS\Explorer.EXE 2840
C:\Program Files\iTunes\iTunesHelper.exe 3024
C:\PROGRA~1\AVG\AVG9\avgtray.exe 3044
C:\Program Files\iPod\bin\iPodService.exe 3592
C:\WINDOWS\system32\wscntfy.exe 2924
C:\Program Files\List_Kill'em\List_Kill'em.exe 3276
C:\WINDOWS\system32\cmd.exe 1452
C:\WINDOWS\system32\wbem\wmiprvse.exe 3820
C:\Documents and Settings\Frank\Local Settings	emp\65.tmp\pv.exe 3192
 
Detections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache  
"C:\WINDOWS\Fonts\GRGAREF.TTF"  
"C:\WINDOWS\mbr.exe"  
"C:\WINDOWS\System32\drivers\etc\hosts.msn"  
"C:\WINDOWS\System32\drivers\lvuvc.hs"  
 
 
¤¤¤¤¤¤¤¤¤¤ Files/folders deleted : 
  
Quarantine : 

GRGAREF.TTF.Kill'em
hosts.msn.Kill'em
lvuvc.hs.Kill'em
MBR.exe.Kill'em
QTSBandwidthCache.Kill'em

==============
host file OK !
==============

========
Registry
========
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe  
Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe  
Deleted : HKLM\Software\Trymedia Systems  
Deleted : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}  

============
Disk Cleaned
============
 
================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

gen-hackman · Answer

bonne année :)

&#9654 Télécharge FindyKill de Chiquitine29 sur ton bureau : 

http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

! Déconnecte toi et ferme toutes applications en cours ! 

&#9654 Double clique (clic droit "en tant qu'administrateur" pour Vista) sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut . 

&#9654 Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

&#9654 Double-clique (clic droit "en tant qu'administrateur" pour Vista)sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .
 
&#9654 Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

&#9654 Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée] 

&#9654 Laisse travailler l'outil et ne touche à rien ... 

&#9654 Poste le rapport qui apparait à la fin , sur le forum ...

( le rapport est sauvegardé aussi sous C:\FindyKill.txt ) 
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Francis · Answer

############################## | FindyKill V5.023 |

# User : Frank (Administrateurs) # UNKNOWN-Z3WYBW6
# Update on 31/12/2009 by El Desaparecido
# Start at: 21:25:22 | 01/01/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

#               Intel(R) Pentium(R) 4 CPU 2.66GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : AVG Anti-Virus Free 9.0 [ (!) Disabled | Updated ]
# FW : ZoneAlarm Firewall[ (!) Disabled ]6.1.737.000

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 149,05 Go (94,68 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Frank\Application Data |


################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |


################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.023 ! |

gen-hackman · Answer

########### [ Option 2  ( Suppression )  ] 



&#9654 Déconnecte toi et ferme toutes application en cours ( navigateur compris ) . 

&#9654 Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

&#9654 Relance "FindyKill" (clic droit "en tant qu'administrateur" pour Vista): au menu principal choisis l'option " F " pour français et tape sur [entrée] .

&#9654 Au second menu choisis l'option 2 (suppression) et tape sur [entrée] 

&#9654 Le pc va redémarrer automatiquement ...

&#9654 le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

&#9654 Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt ) 

&#9654 Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide

Frank · Answer

Vaut mieux tard que jamais (ça m'a pris quelque temps avant de retourner chez mes parents). L'oridnateur a planté pendant la suppression, je ne sais pas trop si ça a fonctionné:


############################## | FindyKill V5.023 |

# User : Frank (Administrateurs) # UNKNOWN-Z3WYBW6
# Update on 31/12/2009 by El Desaparecido
# Start at: 22:28:27 | 05/02/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

#               Intel(R) Pentium(R) 4 CPU 2.66GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : AVG Anti-Virus Free 9.0 [ (!) Disabled | Updated ]
# FW : ZoneAlarm Firewall[ (!) Disabled ]6.1.737.000

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 149,05 Go (93,23 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TeamViewer\Version5\TeamViewer.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE

################## | C: |


################## | C:\WINDOWS |

Supprimé ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-17681AA8.pf  

################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Frank\Application Data |


################## | Autres suppressions ... |

gen-hackman · Answer

euh il manque un bout

Antivirus Live

16 réponses

Discussions similaires

Newsletters