Sujet Précédent Sujet Suivant

Gros Probleme avec rundll32.exe

Fermé
Lydia - 14 févr. 2010 à 10:37
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 - 17 févr. 2010 à 10:21
Bonjour à tous,
Voila j'ai un gros problème avec mon pc, au faite à chaque fois que je veux exécuter un programme j'ai toujours la fenêtre" ouvrir avec:..." .Donc j'ai fait quelques recherches sur le web mais non fructueuses!! Au fait j'ai voulu accéder au gestionnaire des taches mais la plupart des applications dedans ne s'ouvrent pas et j'ai un message d'erreur qui s'affiche" application introuvable C:\WINDOWS..rundll32.exe ". je désepère car en vérifiant mon dossier System32 j'ai trouvé l'application en question! j'ai donc trouvé sur le net l'application et j'ai essayer de la copier/coller dans System32,sauf que la l'ancienne application persiste et supprime la nouvelle.

J'espère que j'etait claire et avoir des réponses très rapidement..
Merci a l'avance ;)
A voir également:

22 réponses

  • 1
  • 2
Réponse 1 / 22
gamesharked Messages postés 361 Date d'inscription jeudi 26 novembre 2009 Statut Membre Dernière intervention 10 juin 2011 35
14 févr. 2010 à 10:40
fait une analyse antivirus immédiatement!
0
Réponse 2 / 22
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
14 févr. 2010 à 10:42
salut

a tu tester cette astuce ?

https://www.commentcamarche.net/faq/2577-windows-erreur-de-chargement-rundll-rundll32-exe
0
Réponse 3 / 22
Lydia
14 févr. 2010 à 10:54
Au fait j'ai déja fait un scan avec Spyhunter 3 et il m'a trouvé le malware Rogue.VISTA Antivirus! donc je l'ai supprimer, et la je vient de le restaurer pour voir et bein les programmes exécutables marchent sans probleme!
aidez moi svp je ne sais plus quoi faire :(
0
Réponse 4 / 22
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
14 févr. 2010 à 11:03
télécharge

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

a l'installation vérifie que mise a jour et lancer programme et scan complet sont bien cocher

Une fois a jour, le programme va se lancer; clic sur l´onglet paramètre, et coche la case : "Arrêter internet explorer pendant la suppression".

A la fin du scan clique sur Afficher les résultats

Vérifier si tout est coché et clic Supprimer la sélection

S'il t'es demandé de redémarrer >>> clique sur "Yes"

Et tu poste le rapport générer
0
Lydia
14 févr. 2010 à 12:05
Merci beaucoup de t'interesser au problème!
Je suis entrain de faire le scan complet et cela prend du temps..esperant que cela sera fructif
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 22
Lydia
14 févr. 2010 à 12:42
Quand je fais le scan sur le mode normal; l'ordinateur se plante et je fais un redémarrage forcé!
La je suis entrain de le faire sur le mode sans echec, j'espere que cela ne change rien?!
en attente de votre confirmation
0
Réponse 6 / 22
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
14 févr. 2010 à 12:59
c'est bon tu peut continuer en mode sans échec
0
Lydia
14 févr. 2010 à 14:10
J'ai du faire une recherche rapide car a deux reprises au bout de 30/40 mins l'ordi beug!! c'est très stressant
bon voila le rapport, je précise que j'ai rien supprimé


Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3734
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

14/02/2010 14:09:32
mbam-log-2010-02-14 (14-09-27).txt

Type de recherche: Examen rapide
Eléments examinés: 148255
Temps écoulé: 7 minute(s), 30 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\HelpAssistant\Local Settings\Temp\50.tmp (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\mazouz\Local Settings\Temp\50.tmp (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\mazouz\Local Settings\Temp\mvnpow.dll (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\mazouz\Local Settings\Temp\yMyB.dll (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> No action taken.
C:\Documents and Settings\mazouz\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> No action taken.
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> No action taken.
C:\WINDOWS\msa.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\HelpAssistant\Bureau\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
C:\Documents and Settings\mazouz\Bureau\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
0
Réponse 7 / 22
Lydia
14 févr. 2010 à 14:24
J'ai supprimé les fichiers en question mais au moment de l'écriture du rapport tout a planté et l'ordinateur a généré un bip continu et donc redémarrage forcé! là je suis entrain de refaire le scan; on verra ce que cela donnera!
0
Réponse 8 / 22
Lydia
14 févr. 2010 à 14:30
voila le rapport; 4 éléments persistent!!! help me pleaaaaaaaaaaaaaaaaaase

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3734
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

14/02/2010 14:28:49
mbam-log-2010-02-14 (14-28-46).txt

Type de recherche: Examen rapide
Eléments examinés: 148270
Temps écoulé: 7 minute(s), 35 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
0
Réponse 9 / 22
Lydia
14 févr. 2010 à 14:44
Cc il y'a quelq'un?
voila une autre catastrophe, maintenant je ne peux plus ouvrir mais programmes exécutables, que dois je faire?
aidez moi svp
0
Réponse 10 / 22
Lydia
14 févr. 2010 à 15:11
Svp aidez moi, ca m'ettone que personne ne réponde, j'ai vraiment besoin de votre aide so pleaaaaaaaaaaaase help me, je commence à désespérer!!
merci pour votre attention
0
Réponse 11 / 22
gamesharked Messages postés 361 Date d'inscription jeudi 26 novembre 2009 Statut Membre Dernière intervention 10 juin 2011 35
14 févr. 2010 à 19:07
Ne t'inquiéte pas , ca te met quoi comme erreur ?
0
Réponse 12 / 22
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
14 févr. 2010 à 19:20
voila de retour,esperant que c'est pas du virut (infection qui endommage gravement le system)

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

Télécharge et installe List&Kill'em et enregistre le sur ton bureau

http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe


Branche clés usb , disques durs externes , mp3 , mp4 , etc..

double clique ( clic droit "exécuter en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

coche la case "créer une icône sur le bureau"

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis la langue puis choisis l'option 1 = Mode Recherche

laisse travailler l'outil

à l'apparition de la fenêtre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'écran "COMPLETED"
0
Réponse 13 / 22
Lydia
15 févr. 2010 à 11:03
voila le rapport, espérant qu'il n'ya pas de virut!!
la nouveauté de mon ordi est que maintenant il se bloque tout seul après chaque démarrage au bout d'un certain temps!! j'ai essayé de voir dans l'observateur des évènements mais rien de spéciale...






List'em by g3n-h@ckm@n 1.2.5.0

User : Administrateur (Administrateurs)
Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
Start at: 10:27:16 | 15/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 218,88 Go (158,35 Go free) | NTFS
D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
M:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Administrateur\Local Settings\Temp\3.tmp\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ehTray REG_SZ C:\WINDOWS\ehome\ehtray.exe
SigmatelSysTrayApp REG_SZ stsystra.exe
IAAnotif REG_SZ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
ATICCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
DMXLauncher REG_SZ C:\Program Files\Dell\Media Experience\DMXLauncher.exe
Install5G REG_SZ E:\Install.exe /SI=100
REGSHAVE REG_SZ C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
DLCCCATS REG_SZ rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
LVCOMSX REG_SZ C:\WINDOWS\system32\LVCOMSX.EXE
LogitechVideoRepair REG_SZ C:\Program Files\Logitech\Video\ISStart.exe
IMJPMIG8.1 REG_SZ "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
IMEKRMIG6.1 REG_SZ C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
MSPY2002 REG_SZ C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
PHIME2002ASync REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
ISUSPM Startup REG_SZ C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
ISUSPM REG_SZ "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -scheduler
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
InstallVisualStyle REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
InstallTheme REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale.theme

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultUserName REG_SZ Administrateur
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DefaultPassword REG_SZ
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Administrateur
AltDefaultDomainName REG_SZ MM
DefaultDomainName REG_SZ MM
ChangePasswordUseKerberos REG_DWORD 1 (0x1)
EnableConcurrentSessions REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
C:\Program Files\Yahoo!\Messenger\YServer.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe REG_SZ C:\Program Files\Dell Network Assistant\ezi_hnm2.exe:*:Disabled:Advanced Networking Application
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe REG_SZ C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client
C:\Program Files\Microsoft ActiveSync\rapimgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
C:\Program Files\Microsoft ActiveSync\wcescomm.exe REG_SZ C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe REG_SZ C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player
C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe REG_SZ C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe:*:Enabled:CrazyTalk
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe REG_SZ C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Disabled:BlueSoleil
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour
C:\Program Files\Logitech\Logitech Vid\Vid.exe REG_SZ C:\Program Files\Logitech\Logitech Vid\Vid.exe:*:Disabled:Logitech Vid

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
C:\Program Files\Microsoft ActiveSync\rapimgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
C:\Program Files\Microsoft ActiveSync\wcescomm.exe REG_SZ C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E5F5D008-DD2C-4D32-977D-1A0ADF03058B}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{DFB17AA8-042A-429D-987C-26CE244A4189}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\KB910393
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0291E591-EA41-4c82-8106-3DC6CE7F7664}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1BC46932-21B2-4130-86E0-B4EB4F7A7A7B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{407408d4-94ed-4d86-ab69-a7f649d112ee}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BDE0FA43-6952-4BA8-8C58-09AF690F88E1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E8EA5BD6-D931-4001-ABF6-81BAA500360A}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EA29D410-CE41-4953-A862-2DE706A1DAD7}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061102

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\Administrateur\Local Settings\Temp\3.tmp
## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys


Sources
=======

C:\i386\atapi.sys
C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
C:\WINDOWS\ServicePackFiles\i386\atapi.sys
C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
219 Go total, 158 Go libre (72%), 4% fragment‚ (fragmentation du fichier 8%)

Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\WINDOWS\003000_.tmp
Present !! : C:\WINDOWS\jestertb.dll
Present !! : C:\WINDOWS\kb913800.exe
Present !! : C:\WINDOWS\System32\_*.dll
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\drivers\lvuvc.hs"
Present !! : C:\WINDOWS\System32\SET*.tmp

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : "HKLM\Software\Trymedia Systems"
Present !! : HKCR\OutlookAddin.Addin
Present !! : HKCR\OutlookAddin.Addin.1
Present !! : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-15 10:34:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
"khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
"khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
"khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x85F040F0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\iaStor -> 0x85f040f0
Warning: possible MBR rootkit infection !
user & kernel MBR OK
Use "Recovery Console" command "fixmbr" to clear infection !

==========
Programs
==========

7-Zip
Abbyy FineReader 6.0 Sprint
Adobe
Ahead
Alwil Software
Apple Software Update
Atari
ATI Technologies
BAE
BitComet
Bonjour
ComPlus Applications
Corel
DAEMON Tools Lite
Dell
Dell Network Assistant
Dell Photo AIO Printer 924
Digital Camera
DivX
Dl_cats
Droppix
eMule
Enigma Software Group
Fichiers communs
FinePixViewer
FrenchOtto
GemMasterFrench
Google
Hercules
illiminable
InstallShield Installation Information
Intel
InterActual
Internet Explorer
Inventel
iPod
iTunes
IVT Corporation
Jasc Software Inc
Java
List_Kill'em
Logitech
Malwarebytes' Anti-Malware
McAfee
Messenger
Microsoft
Microsoft ActiveSync
Microsoft CAPICOM 2.1.0.2
microsoft frontpage
Microsoft Office
Microsoft Office Outlook Connector
Microsoft Picture It! PhotoPub
Microsoft Silverlight
Microsoft SQL Server Compact Edition
Microsoft Sync Framework
Microsoft Works
Microsoft.NET
Mobipocket.com
Movie Maker
Mozilla Firefox
MSBuild
MSN
MSN Gaming Zone
MSN Messenger
MSXML 4.0
NetMeeting
Nova-Intelligence
Online Services
Orange
Outlook Express
PIXELA
PowerQuest
QuickTime
Real
RealArcade
Reallusion
Reference Assemblies
Reflex Business
ReflexiveArcade
REGSHAVE
Roxio
SAGEM
Securitoo
Services en ligne
Sigmatel
Skype
Sonic
Sun
Symantec
Tiscali
Uninstall Information
Veoh Networks
Windows Live
Windows Live SkyDrive
Windows Live Toolbar
Windows Media Connect 2
Windows Media Player
Windows Mobile Device Handbook
Windows NT
Windows Plus
WindowsUpdate
WinZip
xerox
Yahoo!
Zylom Games

============
Drive C:
============

5813e13d5893f9cb84
AUTOEXEC.BAT
bec645826194be7ab6e54feb8f9c08
boot.ini
Bootfont.bin
Config.Msi
CONFIG.SYS
dell
dell.sdr
dlcc.log
dlccscan.log
Documents and Settings
Downloads
drivers
drvrtmp
f6f124d1579f37a55a544c825bec0c
found.000
GameHouse Games
i386
INFCACHE.1
IO.SYS
Kill'em
List'em.txt
LogiSetup.log
MSDOS.SYS
MSOCache
My Music
NTDETECT.COM
ntldr
P1010834.JPG
P1010835.JPG
P1010836.JPG
P1010837.JPG
P1010838.JPG
P1010839.JPG
P1010840.JPG
P1010841.JPG
P1010842.JPG
P1010844.JPG
P1010845.JPG
P1010846.JPG
P1010847.JPG
P1010848.JPG
P1010849.JPG
P1010887.JPG
P1010888.JPG
P1010890.JPG
P1010891.JPG
P1010892.JPG
P1010893.JPG
P1010894.JPG
pagefile.sys
partition_magic8.0FR
playground.log
Program Files
RECYCLER
Sites
sqmdata00.sqm
sqmdata01.sqm
sqmdata02.sqm
sqmdata03.sqm
sqmdata04.sqm
sqmdata05.sqm
sqmdata06.sqm
sqmdata07.sqm
sqmdata08.sqm
sqmdata09.sqm
sqmdata10.sqm
sqmdata11.sqm
sqmdata12.sqm
sqmdata13.sqm
sqmdata14.sqm
sqmdata15.sqm
sqmdata16.sqm
sqmdata17.sqm
sqmdata18.sqm
sqmdata19.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
sqmnoopt06.sqm
sqmnoopt07.sqm
sqmnoopt08.sqm
sqmnoopt09.sqm
sqmnoopt10.sqm
sqmnoopt11.sqm
sqmnoopt12.sqm
sqmnoopt13.sqm
sqmnoopt14.sqm
sqmnoopt15.sqm
sqmnoopt16.sqm
sqmnoopt17.sqm
sqmnoopt18.sqm
sqmnoopt19.sqm
System Volume Information
t
Temp
Thumbs.db
timestmp.tmp
WINDOWS
YServer.txt

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Program Files\Dell\Media Experience\IAPCSDK\Install.exe
C:\Program Files\Dell Photo AIO Printer 924\Install\exe
C:\Program Files\Dell Photo AIO Printer 924\Install\exe\Engine.dll
C:\Program Files\Dell Photo AIO Printer 924\Install\exe\Uninst.exe
C:\WINDOWS\Temp\McAfeeInstall\Install.exe




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 10:46:01,29
0
Réponse 14 / 22
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
15 févr. 2010 à 11:52
salut

▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'option 2 = Mode Suppression

laisse travailler l'outil.

en fin de scan un rapport s'ouvre

▶ colle le contenu dans ta reponse
0
Réponse 15 / 22
Lydia
15 févr. 2010 à 12:22
Execuse moi benurrr, mais est ce que ça sera possible de savoir en quoi consiste le mode suppression, j'ai peur de supprimer certain fichiers importants pour le fonctionnement du pc, est ce que tu pourra m'expliquer un peu,
je veux vraiment regler le probleme, je te remercie pour ton aide
0
Réponse 16 / 22
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
15 févr. 2010 à 12:31
sa va te supprimer des fichier qui sont infecter ou qui se sont incruster a ton system apparement c'est pas du virut il risque pas de te supprimer des fichier légitime de ton system
0
Réponse 17 / 22
Lydia
15 févr. 2010 à 13:56
voila le rapport:
ps:merci pour l'explication


Kill'em by g3n-h@ckm@n 1.2.5.0

User : mazouz (Administrateurs)
Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
Start at: 13:37:38 | 15/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886498 [ Enabled | Updated ]

C:\ -> Disque fixe local | 218,88 Go (157,02 Go free) | NTFS
D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
M:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Logitech\Logitech Vid\Vid.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Logitech\Logitech Vid\LU\LULnchr.exe
C:\Program Files\Logitech\Logitech Vid\LU\LogitechUpdate.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\ERUNT.EXE
C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\WINDOWS\003000_.tmp
Quarantined & Deleted !! : C:\WINDOWS\jestertb.dll
Quarantined & Deleted !! : C:\WINDOWS\kb913800.exe

Quarantined & Deleted !! : C:\WINDOWS\System32\_000006_.tmp.dll
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\lvuvc.hs
Quarantined & Deleted !! : C:\WINDOWS\System32\SET56.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET67.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6D.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6E.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8C.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET99.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA3.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETAF.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB8.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB9.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBA.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBB.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBD.tmp
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Application Data\wklnhst.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\003.zip
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\68.tmp
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\a.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\dw.log
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjv.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjw.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjx.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_Messenger.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_WLMessenger.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv_9cf01a2a.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lsnfier.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lvid_lvid.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lws_lws.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SHSetup.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1008.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_10b8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1120.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1268.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1354.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13c4.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13f4.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_14a0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1734.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_174c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_4cc.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_50c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6d0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6fc.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_718.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_798.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_7b8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_82c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_84c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_8ac.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_95c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_9c0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_a88.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_b4c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_bb8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c0c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c38.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c78.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c84.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ca0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cb0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cf8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d24.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d38.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d9c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_dc8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_de4.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e20.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e6c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ec0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f14.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f28.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f38.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SWFXXLRT.DLL
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\UninstallRC-8876480.dll
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Internet_Antivirus_Pro_Fix.rar

==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : "HKLM\Software\Trymedia Systems"
Deleted : HKCR\OutlookAddin.Addin
Deleted : HKCR\OutlookAddin.Addin.1
Deleted : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
============

=================
anti-ver blaster : OK !!
=================

================
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
0
Réponse 18 / 22
Lydia
15 févr. 2010 à 13:56
voila le rapport:
ps:merci pour l'explication


Kill'em by g3n-h@ckm@n 1.2.5.0

User : mazouz (Administrateurs)
Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
Start at: 13:37:38 | 15/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886498 [ Enabled | Updated ]

C:\ -> Disque fixe local | 218,88 Go (157,02 Go free) | NTFS
D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
M:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Logitech\Logitech Vid\Vid.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Logitech\Logitech Vid\LU\LULnchr.exe
C:\Program Files\Logitech\Logitech Vid\LU\LogitechUpdate.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\ERUNT.EXE
C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\WINDOWS\003000_.tmp
Quarantined & Deleted !! : C:\WINDOWS\jestertb.dll
Quarantined & Deleted !! : C:\WINDOWS\kb913800.exe

Quarantined & Deleted !! : C:\WINDOWS\System32\_000006_.tmp.dll
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\lvuvc.hs
Quarantined & Deleted !! : C:\WINDOWS\System32\SET56.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET67.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6D.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6E.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8C.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET99.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA3.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETAF.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB8.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB9.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBA.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBB.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBD.tmp
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Application Data\wklnhst.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\003.zip
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\68.tmp
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\a.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\dw.log
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjv.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjw.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjx.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_Messenger.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_WLMessenger.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv_9cf01a2a.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lsnfier.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lvid_lvid.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lws_lws.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SHSetup.exe
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1008.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_10b8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1120.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1268.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1354.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13c4.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13f4.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_14a0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1734.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_174c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_4cc.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_50c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6d0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6fc.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_718.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_798.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_7b8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_82c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_84c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_8ac.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_95c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_9c0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_a88.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_b4c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_bb8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c0c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c38.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c78.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c84.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ca0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cb0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cf8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d24.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d38.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d9c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_dc8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_de4.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e20.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e6c.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ec0.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f14.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f28.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f38.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f8.dat
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SWFXXLRT.DLL
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\UninstallRC-8876480.dll
Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Internet_Antivirus_Pro_Fix.rar

==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : "HKLM\Software\Trymedia Systems"
Deleted : HKCR\OutlookAddin.Addin
Deleted : HKCR\OutlookAddin.Addin.1
Deleted : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
============

=================
anti-ver blaster : OK !!
=================

================
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
0
Réponse 19 / 22
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
15 févr. 2010 à 14:15
possibilité de rootkit

Télécharge mbr.exe de Gmer ici :
http://www2.gmer.net/mbr/mbr.exe
et enregistre le fichier sur le Bureau.


Désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)
Double clique sur mbr.exe
Un rapport sera généré : mbr.log
En cas d'infection, ce message "MBR rootkit code detected" va apparaitre.

Si c'est le cas, continue comme ça :

Dans le menu Démarrer- Exécuter tape : "%userprofile%\Bureau\mbr" -f
Dans le mbr.log cette ligne apparaitra "original MBR restored successfully !"

Réactive tes protections
Poste ce rapport et supprimes-le ensuite.

Pour vérifier

Désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)
Relance mbr.exe

Réactive tes protections.

Le nouveau mbr.log devrait être celui-ci :

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK


Sous Vista, ne pas oublier de lancer mbr.exe par clic droit et Exécuter en tant qu'administrateur.
Note : Si le fichier mbr.exe se trouve dans Téléchargement, cela fonctionne aussi et mbr.log s'y inscrira.
0
Lydia
15 févr. 2010 à 15:20
voila le rapport




Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x02542D6C1
malicious code @ sector 0x02542D6C4 !
PE file found in sector at 0x02542D6DA !
0
Réponse 20 / 22
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
15 févr. 2010 à 15:51
Dans le menu Démarrer- Exécuter tape : "%userprofile%\Bureau\mbr" -f

Dans le mbr.log cette ligne apparaitra "original MBR restored successfully !"

poste le
0
Lydia
15 févr. 2010 à 17:55
petit problème, il n' ya guerre de ligne indiquant "original MBR restored successfully !" malgrés que j'ai suivi la procédure a la lettre!


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x02542D6C1
malicious code @ sector 0x02542D6C4 !
PE file found in sector at 0x02542D6DA !
0

Discussions similaires

processus hote windows rundll32
ladypink13 -
flo39400 -

1 réponse
fichier exe du scrabble
mfils -
mfils -

5 réponses
comment convertir un logiciel .exe en .dmg
omnisportdieng -
Utilisateur anonyme -

3 réponses
WINDOWS\System32\rundll32.exe.
worex -
Allela -

49 réponses