Gros Probleme avec rundll32.exe

Lydia -  
Bonjour à tous,
Voila j'ai un gros problème avec mon pc, au faite à chaque fois que je veux exécuter un programme j'ai toujours la fenêtre" ouvrir avec:..." .Donc j'ai fait quelques recherches sur le web mais non fructueuses!! Au fait j'ai voulu accéder au gestionnaire des taches mais la plupart des applications dedans ne s'ouvrent pas et j'ai un message d'erreur qui s'affiche" application introuvable C:\WINDOWS..rundll32.exe ". je désepère car en vérifiant mon dossier System32 j'ai trouvé l'application en question! j'ai donc trouvé sur le net l'application et j'ai essayer de la copier/coller dans System32,sauf que la l'ancienne application persiste et supprime la nouvelle.

J'espère que j'etait claire et avoir des réponses très rapidement..
Merci a l'avance ;)
Configuration: Windows XP
Firefox 2.0.0.20

22 réponses

Résumé de la discussion

Problème récurrent sur Windows XP: à chaque exécution d’un programme, une fenêtre Ouvrir avec s’affiche et l’erreur « application introuvable C:\WINDOWS...\rundll32.exe » apparaît, suggérant une infection ou une corruption système. Des réponses proposées visent des réparations profondes: réinstaller ou réparer Windows depuis le CD et exécuter fixmbr via la console Recovery pour récupérer le MBR et le démarrage. D’autres conseils suggèrent d’utiliser un outil anti-malware comme Malwarebytes ou List_Kill'em et d’analyser le système, compte tenu des symptômes: processus indésirables, exécutions au démarrage et clés Run potentiellement modifiées. En dernier, des rapports détaillés et scans (GMER/Rootkit) apparaissent, indiquant une possible infection de type rootkit et demandant une approche de restauration plus poussée et une vérification des volumes et démarrages.

Bobot (l’IA à votre service)
  1. gamesharked
    fait une analyse antivirus immédiatement!
    0
    1. benurrr Contributeur sécurité
      salut

      a tu tester cette astuce ?

      https://www.commentcamarche.net/faq/2577-windows-erreur-de-chargement-rundll-rundll32-exe
      0
      1. Lydia
        Au fait j'ai déja fait un scan avec Spyhunter 3 et il m'a trouvé le malware Rogue.VISTA Antivirus! donc je l'ai supprimer, et la je vient de le restaurer pour voir et bein les programmes exécutables marchent sans probleme!
        aidez moi svp je ne sais plus quoi faire :(
        0
        1. benurrr Contributeur sécurité
          télécharge

          http://www.malwarebytes.org/mbam/program/mbam-setup.exe

          a l'installation vérifie que mise a jour et lancer programme et scan complet sont bien cocher

          Une fois a jour, le programme va se lancer; clic sur l´onglet paramètre, et coche la case : "Arrêter internet explorer pendant la suppression".

          A la fin du scan clique sur Afficher les résultats

          Vérifier si tout est coché et clic Supprimer la sélection

          S'il t'es demandé de redémarrer >>> clique sur "Yes"

          Et tu poste le rapport générer
          0
          1. Lydia
            Merci beaucoup de t'interesser au problème!
            Je suis entrain de faire le scan complet et cela prend du temps..esperant que cela sera fructif
            0
        3. Lydia
          Quand je fais le scan sur le mode normal; l'ordinateur se plante et je fais un redémarrage forcé!
          La je suis entrain de le faire sur le mode sans echec, j'espere que cela ne change rien?!
          en attente de votre confirmation
          0
          1. benurrr Contributeur sécurité
            c'est bon tu peut continuer en mode sans échec
            0
            1. Lydia
              J'ai du faire une recherche rapide car a deux reprises au bout de 30/40 mins l'ordi beug!! c'est très stressant
              bon voila le rapport, je précise que j'ai rien supprimé

              Malwarebytes' Anti-Malware 1.44
              Version de la base de données: 3734
              Windows 5.1.2600 Service Pack 3 (Safe Mode)
              Internet Explorer 8.0.6001.18702

              14/02/2010 14:09:32
              mbam-log-2010-02-14 (14-09-27).txt

              Type de recherche: Examen rapide
              Eléments examinés: 148255
              Temps écoulé: 7 minute(s), 30 second(s)

              Processus mémoire infecté(s): 0
              Module(s) mémoire infecté(s): 0
              Clé(s) du Registre infectée(s): 1
              Valeur(s) du Registre infectée(s): 0
              Elément(s) de données du Registre infecté(s): 3
              Dossier(s) infecté(s): 0
              Fichier(s) infecté(s): 12

              Processus mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Module(s) mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Clé(s) du Registre infectée(s):
              HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.

              Valeur(s) du Registre infectée(s):
              (Aucun élément nuisible détecté)

              Elément(s) de données du Registre infecté(s):
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

              Dossier(s) infecté(s):
              (Aucun élément nuisible détecté)

              Fichier(s) infecté(s):
              C:\Documents and Settings\HelpAssistant\Local Settings\Temp\50.tmp (Trojan.Dropper) -> No action taken.
              C:\Documents and Settings\mazouz\Local Settings\Temp\50.tmp (Trojan.Dropper) -> No action taken.
              C:\Documents and Settings\mazouz\Local Settings\Temp\mvnpow.dll (Trojan.Dropper) -> No action taken.
              C:\Documents and Settings\mazouz\Local Settings\Temp\yMyB.dll (Trojan.Dropper) -> No action taken.
              C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> No action taken.
              C:\Documents and Settings\mazouz\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> No action taken.
              C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> No action taken.
              C:\WINDOWS\msa.exe (Trojan.Agent) -> No action taken.
              C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.
              C:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> No action taken.
              C:\Documents and Settings\HelpAssistant\Bureau\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
              C:\Documents and Settings\mazouz\Bureau\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
              0
          2. Lydia
            J'ai supprimé les fichiers en question mais au moment de l'écriture du rapport tout a planté et l'ordinateur a généré un bip continu et donc redémarrage forcé! là je suis entrain de refaire le scan; on verra ce que cela donnera!
            0
            1. Lydia
              voila le rapport; 4 éléments persistent!!! help me pleaaaaaaaaaaaaaaaaaase

              Malwarebytes' Anti-Malware 1.44
              Version de la base de données: 3734
              Windows 5.1.2600 Service Pack 3 (Safe Mode)
              Internet Explorer 8.0.6001.18702

              14/02/2010 14:28:49
              mbam-log-2010-02-14 (14-28-46).txt

              Type de recherche: Examen rapide
              Eléments examinés: 148270
              Temps écoulé: 7 minute(s), 35 second(s)

              Processus mémoire infecté(s): 0
              Module(s) mémoire infecté(s): 0
              Clé(s) du Registre infectée(s): 1
              Valeur(s) du Registre infectée(s): 0
              Elément(s) de données du Registre infecté(s): 3
              Dossier(s) infecté(s): 0
              Fichier(s) infecté(s): 0

              Processus mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Module(s) mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Clé(s) du Registre infectée(s):
              HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.

              Valeur(s) du Registre infectée(s):
              (Aucun élément nuisible détecté)

              Elément(s) de données du Registre infecté(s):
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

              Dossier(s) infecté(s):
              (Aucun élément nuisible détecté)

              Fichier(s) infecté(s):
              (Aucun élément nuisible détecté)
              0
              1. Lydia
                Cc il y'a quelq'un?
                voila une autre catastrophe, maintenant je ne peux plus ouvrir mais programmes exécutables, que dois je faire?
                aidez moi svp
                0
                1. Lydia
                  Svp aidez moi, ca m'ettone que personne ne réponde, j'ai vraiment besoin de votre aide so pleaaaaaaaaaaaase help me, je commence à désespérer!!
                  merci pour votre attention
                  0
                  1. gamesharked
                    Ne t'inquiéte pas , ca te met quoi comme erreur ?
                    0
                    1. benurrr Contributeur sécurité
                      voila de retour,esperant que c'est pas du virut (infection qui endommage gravement le system)

                      Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

                      Télécharge et installe List&Kill'em et enregistre le sur ton bureau

                      http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe

                      Branche clés usb , disques durs externes , mp3 , mp4 , etc..

                      double clique ( clic droit "exécuter en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

                      coche la case "créer une icône sur le bureau"

                      une fois terminée , clic sur "terminer" et le programme se lancera seul

                      choisis la langue puis choisis l'option 1 = Mode Recherche

                      laisse travailler l'outil

                      à l'apparition de la fenêtre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

                      un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

                      Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'écran "COMPLETED"
                      0
                      1. Lydia
                        voila le rapport, espérant qu'il n'ya pas de virut!!
                        la nouveauté de mon ordi est que maintenant il se bloque tout seul après chaque démarrage au bout d'un certain temps!! j'ai essayé de voir dans l'observateur des évènements mais rien de spéciale...

                        List'em by g3n-h@ckm@n 1.2.5.0

                        User : Administrateur (Administrateurs)
                        Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
                        Start at: 10:27:16 | 15/02/2010
                        Contact : https://forums.commentcamarche.net/forum/virus-securite-7

                        Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
                        Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
                        Internet Explorer 8.0.6001.18702
                        Windows Firewall Status : Enabled

                        C:\ -> Disque fixe local | 218,88 Go (158,35 Go free) | NTFS
                        D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
                        E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
                        F:\ -> Disque CD-ROM
                        G:\ -> Disque amovible
                        H:\ -> Disque amovible
                        I:\ -> Disque amovible
                        J:\ -> Disque amovible
                        M:\ -> Disque CD-ROM

                        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\csrss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\List_Kill'em\List_Kill'em.scr
                        C:\WINDOWS\system32\cmd.exe
                        C:\WINDOWS\system32\wbem\wmiprvse.exe
                        C:\Documents and Settings\Administrateur\Local Settings\Temp\3.tmp\pv.exe

                        ======================
                        Keys "Run"
                        ======================
                        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        ehTray REG_SZ C:\WINDOWS\ehome\ehtray.exe
                        SigmatelSysTrayApp REG_SZ stsystra.exe
                        IAAnotif REG_SZ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
                        ATICCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
                        DMXLauncher REG_SZ C:\Program Files\Dell\Media Experience\DMXLauncher.exe
                        Install5G REG_SZ E:\Install.exe /SI=100
                        REGSHAVE REG_SZ C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
                        DLCCCATS REG_SZ rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
                        LVCOMSX REG_SZ C:\WINDOWS\system32\LVCOMSX.EXE
                        LogitechVideoRepair REG_SZ C:\Program Files\Logitech\Video\ISStart.exe
                        IMJPMIG8.1 REG_SZ "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                        IMEKRMIG6.1 REG_SZ C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                        MSPY2002 REG_SZ C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                        PHIME2002ASync REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                        PHIME2002A REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                        TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                        ISUSPM Startup REG_SZ C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
                        ISUSPM REG_SZ "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -scheduler
                        SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                        LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
                        QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

                        =====================
                        Other Keys
                        =====================
                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
                        dontdisplaylastusername REG_DWORD 0 (0x0)
                        legalnoticecaption REG_SZ
                        legalnoticetext REG_SZ
                        shutdownwithoutlogon REG_DWORD 1 (0x1)
                        undockwithoutlogon REG_DWORD 1 (0x1)
                        InstallVisualStyle REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
                        InstallTheme REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale.theme

                        ===============
                        [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                        NoDriveTypeAutoRun REG_DWORD 145 (0x91)

                        ===============
                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                        HonorAutoRunSetting REG_DWORD 1 (0x1)

                        ===============
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                        AppInit_DLLS REG_SZ

                        ===============
                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
                        AutoRestartShell REG_DWORD 1 (0x1)
                        DefaultUserName REG_SZ Administrateur
                        LegalNoticeCaption REG_SZ
                        LegalNoticeText REG_SZ
                        PowerdownAfterShutdown REG_SZ 0
                        ReportBootOk REG_SZ 1
                        Shell REG_SZ Explorer.exe
                        ShutdownWithoutLogon REG_SZ 0
                        System REG_SZ
                        Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
                        VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
                        SfcQuota REG_DWORD -1 (0xffffffff)
                        allocatecdroms REG_SZ 0
                        allocatedasd REG_SZ 0
                        allocatefloppies REG_SZ 0
                        cachedlogonscount REG_SZ 10
                        forceunlocklogon REG_DWORD 0 (0x0)
                        passwordexpirywarning REG_DWORD 14 (0xe)
                        scremoveoption REG_SZ 0
                        AllowMultipleTSSessions REG_DWORD 1 (0x1)
                        UIHost REG_EXPAND_SZ logonui.exe
                        LogonType REG_DWORD 1 (0x1)
                        Background REG_SZ 0 0 0
                        DefaultPassword REG_SZ
                        DebugServerCommand REG_SZ no
                        SFCDisable REG_DWORD 0 (0x0)
                        WinStationsDisabled REG_SZ 0
                        HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
                        ShowLogonOptions REG_DWORD 0 (0x0)
                        AltDefaultUserName REG_SZ Administrateur
                        AltDefaultDomainName REG_SZ MM
                        DefaultDomainName REG_SZ MM
                        ChangePasswordUseKerberos REG_DWORD 1 (0x1)
                        EnableConcurrentSessions REG_DWORD 1 (0x1)

                        ===============
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

                        ===============
                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
                        {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

                        ===============
                        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                        %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
                        %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
                        C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
                        C:\Program Files\Yahoo!\Messenger\YServer.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
                        C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
                        C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
                        C:\Program Files\Dell Network Assistant\ezi_hnm2.exe REG_SZ C:\Program Files\Dell Network Assistant\ezi_hnm2.exe:*:Disabled:Advanced Networking Application
                        C:\Program Files\Veoh Networks\Veoh\VeohClient.exe REG_SZ C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client
                        C:\Program Files\Microsoft ActiveSync\rapimgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
                        C:\Program Files\Microsoft ActiveSync\wcescomm.exe REG_SZ C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
                        C:\Program Files\Microsoft ActiveSync\WCESMgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
                        C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
                        C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
                        C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe REG_SZ C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player
                        C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe REG_SZ C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe:*:Enabled:CrazyTalk
                        C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
                        C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
                        C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
                        C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
                        C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe REG_SZ C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Disabled:BlueSoleil
                        C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour
                        C:\Program Files\Logitech\Logitech Vid\Vid.exe REG_SZ C:\Program Files\Logitech\Logitech Vid\Vid.exe:*:Disabled:Logitech Vid

                        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
                        %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
                        %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
                        C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
                        C:\Program Files\Microsoft ActiveSync\rapimgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
                        C:\Program Files\Microsoft ActiveSync\wcescomm.exe REG_SZ C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
                        C:\Program Files\Microsoft ActiveSync\WCESMgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
                        C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
                        C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
                        C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
                        C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

                        ===============
                        ActivX controls
                        ===============
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
                        HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E5F5D008-DD2C-4D32-977D-1A0ADF03058B}

                        ===============
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{DFB17AA8-042A-429D-987C-26CE244A4189}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\KB910393
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0291E591-EA41-4c82-8106-3DC6CE7F7664}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1BC46932-21B2-4130-86E0-B4EB4F7A7A7B}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{407408d4-94ed-4d86-ab69-a7f649d112ee}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BDE0FA43-6952-4BA8-8C58-09AF690F88E1}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E8EA5BD6-D931-4001-ABF6-81BAA500360A}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EA29D410-CE41-4953-A862-2DE706A1DAD7}
                        HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}

                        ==============
                        BHO :
                        ======
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
                        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

                        ================
                        Internet Explorer :
                        ================
                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                        Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

                        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                        Start Page REG_SZ www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061102

                        ========
                        Services
                        ========
                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

                        Ndisuio : 0x3 ( OK = 3 )
                        EapHost : 0x3 ( OK = 2 )
                        SharedAccess : 0x2 ( OK = 2 )
                        wuauserv : 0x2 ( OK = 2 )

                        =========
                        Atapi.sys
                        =========

                        %%%% HASHDEEP-1.0
                        %%%% size,md5,sha256,filename
                        ## Invoked from: C:\Documents and Settings\Administrateur\Local Settings\Temp\3.tmp
                        ## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys
                        ##
                        96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys

                        Sources
                        =======

                        C:\i386\atapi.sys
                        C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
                        C:\WINDOWS\ServicePackFiles\i386\atapi.sys
                        C:\WINDOWS\system32\drivers\atapi.sys

                        Référence :
                        ==========

                        Win XP_32b : a64013e98426e1877cb653685c5c0009
                        Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
                        Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
                        Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
                        Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
                        Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
                        Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
                        Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
                        Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

                        =======
                        Drive :
                        =======

                        D‚fragmenteur de disque Windows
                        Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

                        Rapport d'analyse
                        219 Go total, 158 Go libre (72%), 4% fragment‚ (fragmentation du fichier 8%)

                        Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

                        ¤¤¤¤¤¤¤¤¤¤ Files/folders :

                        Present !! : C:\WINDOWS\003000_.tmp
                        Present !! : C:\WINDOWS\jestertb.dll
                        Present !! : C:\WINDOWS\kb913800.exe
                        Present !! : C:\WINDOWS\System32\_*.dll
                        Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
                        Present !! : C:\WINDOWS\System32\drivers\lvuvc.hs"
                        Present !! : C:\WINDOWS\System32\SET*.tmp

                        ¤¤¤¤¤¤¤¤¤¤ Keys :

                        Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
                        Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
                        Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
                        Present !! : "HKLM\Software\Trymedia Systems"
                        Present !! : HKCR\OutlookAddin.Addin
                        Present !! : HKCR\OutlookAddin.Addin.1
                        Present !! : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}

                        ============

                        catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2010-02-15 10:34:42
                        Windows 5.1.2600 Service Pack 3 NTFS

                        scanning hidden processes ...

                        scanning hidden services & system hive ...

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
                        "s1"=dword:2df9c43f
                        "s2"=dword:110480d0
                        "h0"=dword:00000001

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                        "p0"="C:\Program Files\DAEMON Tools Lite\"
                        "h0"=dword:00000000
                        "khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                        "a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
                        "khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                        "khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..
                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                        "p0"="C:\Program Files\DAEMON Tools Lite\"
                        "h0"=dword:00000000
                        "khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                        "a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
                        "khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                        "khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..
                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
                        "p0"="C:\Program Files\DAEMON Tools Lite\"
                        "h0"=dword:00000000
                        "khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
                        "a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
                        "khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

                        [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
                        "khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..

                        scanning hidden registry entries ...

                        scanning hidden files ...

                        scan completed successfully
                        hidden processes: 0
                        hidden services: 0
                        hidden files: 0

                        Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

                        device: opened successfully
                        user: MBR read successfully
                        called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x85F040F0]<<
                        kernel: MBR read successfully
                        detected MBR rootkit hooks:
                        \Driver\iaStor -> 0x85f040f0
                        Warning: possible MBR rootkit infection !
                        user & kernel MBR OK
                        Use "Recovery Console" command "fixmbr" to clear infection !

                        ==========
                        Programs
                        ==========

                        7-Zip
                        Abbyy FineReader 6.0 Sprint
                        Adobe
                        Ahead
                        Alwil Software
                        Apple Software Update
                        Atari
                        ATI Technologies
                        BAE
                        BitComet
                        Bonjour
                        ComPlus Applications
                        Corel
                        DAEMON Tools Lite
                        Dell
                        Dell Network Assistant
                        Dell Photo AIO Printer 924
                        Digital Camera
                        DivX
                        Dl_cats
                        Droppix
                        eMule
                        Enigma Software Group
                        Fichiers communs
                        FinePixViewer
                        FrenchOtto
                        GemMasterFrench
                        Google
                        Hercules
                        illiminable
                        InstallShield Installation Information
                        Intel
                        InterActual
                        Internet Explorer
                        Inventel
                        iPod
                        iTunes
                        IVT Corporation
                        Jasc Software Inc
                        Java
                        List_Kill'em
                        Logitech
                        Malwarebytes' Anti-Malware
                        McAfee
                        Messenger
                        Microsoft
                        Microsoft ActiveSync
                        Microsoft CAPICOM 2.1.0.2
                        microsoft frontpage
                        Microsoft Office
                        Microsoft Office Outlook Connector
                        Microsoft Picture It! PhotoPub
                        Microsoft Silverlight
                        Microsoft SQL Server Compact Edition
                        Microsoft Sync Framework
                        Microsoft Works
                        Microsoft.NET
                        Mobipocket.com
                        Movie Maker
                        Mozilla Firefox
                        MSBuild
                        MSN
                        MSN Gaming Zone
                        MSN Messenger
                        MSXML 4.0
                        NetMeeting
                        Nova-Intelligence
                        Online Services
                        Orange
                        Outlook Express
                        PIXELA
                        PowerQuest
                        QuickTime
                        Real
                        RealArcade
                        Reallusion
                        Reference Assemblies
                        Reflex Business
                        ReflexiveArcade
                        REGSHAVE
                        Roxio
                        SAGEM
                        Securitoo
                        Services en ligne
                        Sigmatel
                        Skype
                        Sonic
                        Sun
                        Symantec
                        Tiscali
                        Uninstall Information
                        Veoh Networks
                        Windows Live
                        Windows Live SkyDrive
                        Windows Live Toolbar
                        Windows Media Connect 2
                        Windows Media Player
                        Windows Mobile Device Handbook
                        Windows NT
                        Windows Plus
                        WindowsUpdate
                        WinZip
                        xerox
                        Yahoo!
                        Zylom Games

                        ============
                        Drive C:
                        ============

                        5813e13d5893f9cb84
                        AUTOEXEC.BAT
                        bec645826194be7ab6e54feb8f9c08
                        boot.ini
                        Bootfont.bin
                        Config.Msi
                        CONFIG.SYS
                        dell
                        dell.sdr
                        dlcc.log
                        dlccscan.log
                        Documents and Settings
                        Downloads
                        drivers
                        drvrtmp
                        f6f124d1579f37a55a544c825bec0c
                        found.000
                        GameHouse Games
                        i386
                        INFCACHE.1
                        IO.SYS
                        Kill'em
                        List'em.txt
                        LogiSetup.log
                        MSDOS.SYS
                        MSOCache
                        My Music
                        NTDETECT.COM
                        ntldr
                        P1010834.JPG
                        P1010835.JPG
                        P1010836.JPG
                        P1010837.JPG
                        P1010838.JPG
                        P1010839.JPG
                        P1010840.JPG
                        P1010841.JPG
                        P1010842.JPG
                        P1010844.JPG
                        P1010845.JPG
                        P1010846.JPG
                        P1010847.JPG
                        P1010848.JPG
                        P1010849.JPG
                        P1010887.JPG
                        P1010888.JPG
                        P1010890.JPG
                        P1010891.JPG
                        P1010892.JPG
                        P1010893.JPG
                        P1010894.JPG
                        pagefile.sys
                        partition_magic8.0FR
                        playground.log
                        Program Files
                        RECYCLER
                        Sites
                        sqmdata00.sqm
                        sqmdata01.sqm
                        sqmdata02.sqm
                        sqmdata03.sqm
                        sqmdata04.sqm
                        sqmdata05.sqm
                        sqmdata06.sqm
                        sqmdata07.sqm
                        sqmdata08.sqm
                        sqmdata09.sqm
                        sqmdata10.sqm
                        sqmdata11.sqm
                        sqmdata12.sqm
                        sqmdata13.sqm
                        sqmdata14.sqm
                        sqmdata15.sqm
                        sqmdata16.sqm
                        sqmdata17.sqm
                        sqmdata18.sqm
                        sqmdata19.sqm
                        sqmnoopt00.sqm
                        sqmnoopt01.sqm
                        sqmnoopt02.sqm
                        sqmnoopt03.sqm
                        sqmnoopt04.sqm
                        sqmnoopt05.sqm
                        sqmnoopt06.sqm
                        sqmnoopt07.sqm
                        sqmnoopt08.sqm
                        sqmnoopt09.sqm
                        sqmnoopt10.sqm
                        sqmnoopt11.sqm
                        sqmnoopt12.sqm
                        sqmnoopt13.sqm
                        sqmnoopt14.sqm
                        sqmnoopt15.sqm
                        sqmnoopt16.sqm
                        sqmnoopt17.sqm
                        sqmnoopt18.sqm
                        sqmnoopt19.sqm
                        System Volume Information
                        t
                        Temp
                        Thumbs.db
                        timestmp.tmp
                        WINDOWS
                        YServer.txt

                        ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

                        C:\Program Files\Dell\Media Experience\IAPCSDK\Install.exe
                        C:\Program Files\Dell Photo AIO Printer 924\Install\exe
                        C:\Program Files\Dell Photo AIO Printer 924\Install\exe\Engine.dll
                        C:\Program Files\Dell Photo AIO Printer 924\Install\exe\Uninst.exe
                        C:\WINDOWS\Temp\McAfeeInstall\Install.exe

                        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

                        End of scan : 10:46:01,29
                        0
                        1. benurrr Contributeur sécurité
                          salut

                          ▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
                          mais cette fois-ci :

                          ▶ choisis l'option 2 = Mode Suppression

                          laisse travailler l'outil.

                          en fin de scan un rapport s'ouvre

                          ▶ colle le contenu dans ta reponse
                          0
                          1. Lydia
                            Execuse moi benurrr, mais est ce que ça sera possible de savoir en quoi consiste le mode suppression, j'ai peur de supprimer certain fichiers importants pour le fonctionnement du pc, est ce que tu pourra m'expliquer un peu,
                            je veux vraiment regler le probleme, je te remercie pour ton aide
                            0
                            1. benurrr Contributeur sécurité
                              sa va te supprimer des fichier qui sont infecter ou qui se sont incruster a ton system apparement c'est pas du virut il risque pas de te supprimer des fichier légitime de ton system
                              0
                              1. Lydia
                                voila le rapport:
                                ps:merci pour l'explication

                                Kill'em by g3n-h@ckm@n 1.2.5.0

                                User : mazouz (Administrateurs)
                                Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
                                Start at: 13:37:38 | 15/02/2010
                                Contact : https://forums.commentcamarche.net/forum/virus-securite-7

                                Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
                                Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
                                Internet Explorer 8.0.6001.18702
                                Windows Firewall Status : Enabled
                                AV : avast! Antivirus 5.0.83886498 [ Enabled | Updated ]

                                C:\ -> Disque fixe local | 218,88 Go (157,02 Go free) | NTFS
                                D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
                                E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
                                F:\ -> Disque CD-ROM
                                G:\ -> Disque amovible
                                H:\ -> Disque amovible
                                I:\ -> Disque amovible
                                J:\ -> Disque amovible
                                M:\ -> Disque CD-ROM

                                ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\csrss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\WINDOWS\ehome\ehtray.exe
                                C:\WINDOWS\stsystra.exe
                                C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
                                C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
                                C:\Program Files\Dell\Media Experience\DMXLauncher.exe
                                C:\WINDOWS\system32\LVCOMSX.EXE
                                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe
                                C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                                C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
                                C:\Program Files\iTunes\iTunesHelper.exe
                                C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
                                C:\WINDOWS\system32\ctfmon.exe
                                C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                                C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
                                C:\Program Files\Logitech\Logitech Vid\Vid.exe
                                C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                                C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                                C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
                                C:\Program Files\Bonjour\mDNSResponder.exe
                                C:\WINDOWS\eHome\ehRecvr.exe
                                C:\WINDOWS\eHome\ehSched.exe
                                C:\Program Files\Dell Network Assistant\hnm_svc.exe
                                C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
                                C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                                C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\ehome\mcrdsvc.exe
                                C:\WINDOWS\eHome\ehmsas.exe
                                C:\Program Files\iPod\bin\iPodService.exe
                                C:\WINDOWS\system32\dllhost.exe
                                C:\WINDOWS\System32\alg.exe
                                C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
                                C:\Program Files\Logitech\Logitech Vid\LU\LULnchr.exe
                                C:\Program Files\Logitech\Logitech Vid\LU\LogitechUpdate.exe
                                C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
                                C:\Program Files\List_Kill'em\List_Kill'em.scr
                                C:\WINDOWS\system32\cmd.exe
                                C:\WINDOWS\system32\wbem\wmiprvse.exe
                                C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\ERUNT.EXE
                                C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\pv.exe

                                Detections :
                                ==========

                                ¤¤¤¤¤¤¤¤¤¤ Files/folders :

                                Quarantined & Deleted !! : C:\WINDOWS\003000_.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\jestertb.dll
                                Quarantined & Deleted !! : C:\WINDOWS\kb913800.exe

                                Quarantined & Deleted !! : C:\WINDOWS\System32\_000006_.tmp.dll
                                Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
                                Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\lvuvc.hs
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SET56.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SET67.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SET6D.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SET6E.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SET8C.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SET99.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SETA3.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SETAF.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SETB8.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SETB9.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SETBA.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SETBB.tmp
                                Quarantined & Deleted !! : C:\WINDOWS\System32\SETBD.tmp
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Application Data\wklnhst.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\003.zip
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\68.tmp
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\a.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\dw.log
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjv.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjw.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjx.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_Messenger.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_WLMessenger.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv_9cf01a2a.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lsnfier.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lvid_lvid.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lws_lws.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SHSetup.exe
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1008.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_10b8.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1120.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1268.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1354.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13c4.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13f4.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_14a0.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1734.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_174c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_4cc.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_50c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6d0.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6fc.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_718.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_798.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_7b8.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_82c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_84c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_8ac.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_95c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_9c0.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_a88.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_b4c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_bb8.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c0c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c38.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c78.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c84.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ca0.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cb0.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cf8.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d24.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d38.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d9c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_dc8.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_de4.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e20.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e6c.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ec0.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f14.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f28.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f38.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f8.dat
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SWFXXLRT.DLL
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\UninstallRC-8876480.dll
                                Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Internet_Antivirus_Pro_Fix.rar

                                ==============
                                host file OK !
                                ==============

                                ========
                                Registry
                                ========

                                Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
                                Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
                                Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
                                Deleted : "HKLM\Software\Trymedia Systems"
                                Deleted : HKCR\OutlookAddin.Addin
                                Deleted : HKCR\OutlookAddin.Addin.1
                                Deleted : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
                                ========
                                Services
                                =========

                                Ndisuio : Start = 3
                                EapHost : Start = 2
                                Ip6Fw : Start = 2
                                SharedAccess : Start = 2
                                wuauserv : Start = 2
                                wscsvc : Start = 2

                                ============
                                Disk Cleaned
                                ============

                                =================
                                anti-ver blaster : OK !!
                                =================

                                ================
                                Prefetch cleaned
                                ================

                                ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
                                0
                                1. Lydia
                                  voila le rapport:
                                  ps:merci pour l'explication

                                  Kill'em by g3n-h@ckm@n 1.2.5.0

                                  User : mazouz (Administrateurs)
                                  Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
                                  Start at: 13:37:38 | 15/02/2010
                                  Contact : https://forums.commentcamarche.net/forum/virus-securite-7

                                  Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
                                  Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
                                  Internet Explorer 8.0.6001.18702
                                  Windows Firewall Status : Enabled
                                  AV : avast! Antivirus 5.0.83886498 [ Enabled | Updated ]

                                  C:\ -> Disque fixe local | 218,88 Go (157,02 Go free) | NTFS
                                  D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
                                  E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
                                  F:\ -> Disque CD-ROM
                                  G:\ -> Disque amovible
                                  H:\ -> Disque amovible
                                  I:\ -> Disque amovible
                                  J:\ -> Disque amovible
                                  M:\ -> Disque CD-ROM

                                  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\csrss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\Ati2evxx.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\WINDOWS\ehome\ehtray.exe
                                  C:\WINDOWS\stsystra.exe
                                  C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
                                  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
                                  C:\Program Files\Dell\Media Experience\DMXLauncher.exe
                                  C:\WINDOWS\system32\LVCOMSX.EXE
                                  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                  C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe
                                  C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                                  C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
                                  C:\Program Files\iTunes\iTunesHelper.exe
                                  C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
                                  C:\WINDOWS\system32\ctfmon.exe
                                  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                                  C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
                                  C:\Program Files\Logitech\Logitech Vid\Vid.exe
                                  C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                                  C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                                  C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                  C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
                                  C:\Program Files\Bonjour\mDNSResponder.exe
                                  C:\WINDOWS\eHome\ehRecvr.exe
                                  C:\WINDOWS\eHome\ehSched.exe
                                  C:\Program Files\Dell Network Assistant\hnm_svc.exe
                                  C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
                                  C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                  C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                                  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\ehome\mcrdsvc.exe
                                  C:\WINDOWS\eHome\ehmsas.exe
                                  C:\Program Files\iPod\bin\iPodService.exe
                                  C:\WINDOWS\system32\dllhost.exe
                                  C:\WINDOWS\System32\alg.exe
                                  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
                                  C:\Program Files\Logitech\Logitech Vid\LU\LULnchr.exe
                                  C:\Program Files\Logitech\Logitech Vid\LU\LogitechUpdate.exe
                                  C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
                                  C:\Program Files\List_Kill'em\List_Kill'em.scr
                                  C:\WINDOWS\system32\cmd.exe
                                  C:\WINDOWS\system32\wbem\wmiprvse.exe
                                  C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\ERUNT.EXE
                                  C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\pv.exe

                                  Detections :
                                  ==========

                                  ¤¤¤¤¤¤¤¤¤¤ Files/folders :

                                  Quarantined & Deleted !! : C:\WINDOWS\003000_.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\jestertb.dll
                                  Quarantined & Deleted !! : C:\WINDOWS\kb913800.exe

                                  Quarantined & Deleted !! : C:\WINDOWS\System32\_000006_.tmp.dll
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\lvuvc.hs
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SET56.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SET67.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SET6D.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SET6E.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SET8C.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SET99.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SETA3.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SETAF.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SETB8.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SETB9.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SETBA.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SETBB.tmp
                                  Quarantined & Deleted !! : C:\WINDOWS\System32\SETBD.tmp
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Application Data\wklnhst.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\003.zip
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\68.tmp
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\a.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\dw.log
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjv.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjw.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjx.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_Messenger.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_WLMessenger.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv_9cf01a2a.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lsnfier.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lvid_lvid.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lws_lws.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SHSetup.exe
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1008.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_10b8.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1120.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1268.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1354.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13c4.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13f4.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_14a0.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1734.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_174c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_4cc.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_50c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6d0.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6fc.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_718.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_798.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_7b8.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_82c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_84c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_8ac.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_95c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_9c0.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_a88.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_b4c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_bb8.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c0c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c38.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c78.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c84.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ca0.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cb0.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cf8.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d24.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d38.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d9c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_dc8.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_de4.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e20.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e6c.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ec0.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f14.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f28.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f38.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f8.dat
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SWFXXLRT.DLL
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\UninstallRC-8876480.dll
                                  Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Internet_Antivirus_Pro_Fix.rar

                                  ==============
                                  host file OK !
                                  ==============

                                  ========
                                  Registry
                                  ========

                                  Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
                                  Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
                                  Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
                                  Deleted : "HKLM\Software\Trymedia Systems"
                                  Deleted : HKCR\OutlookAddin.Addin
                                  Deleted : HKCR\OutlookAddin.Addin.1
                                  Deleted : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
                                  ========
                                  Services
                                  =========

                                  Ndisuio : Start = 3
                                  EapHost : Start = 2
                                  Ip6Fw : Start = 2
                                  SharedAccess : Start = 2
                                  wuauserv : Start = 2
                                  wscsvc : Start = 2

                                  ============
                                  Disk Cleaned
                                  ============

                                  =================
                                  anti-ver blaster : OK !!
                                  =================

                                  ================
                                  Prefetch cleaned
                                  ================

                                  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
                                  0
                                  1. benurrr Contributeur sécurité
                                    possibilité de rootkit

                                    Télécharge mbr.exe de Gmer ici :
                                    http://www2.gmer.net/mbr/mbr.exe
                                    et enregistre le fichier sur le Bureau.

                                    Désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)
                                    Double clique sur mbr.exe
                                    Un rapport sera généré : mbr.log
                                    En cas d'infection, ce message "MBR rootkit code detected" va apparaitre.

                                    Si c'est le cas, continue comme ça :

                                    Dans le menu Démarrer- Exécuter tape : "%userprofile%\Bureau\mbr" -f
                                    Dans le mbr.log cette ligne apparaitra "original MBR restored successfully !"

                                    Réactive tes protections
                                    Poste ce rapport et supprimes-le ensuite.

                                    Pour vérifier

                                    Désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)
                                    Relance mbr.exe

                                    Réactive tes protections.

                                    Le nouveau mbr.log devrait être celui-ci :

                                    Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

                                    device: opened successfully

                                    user: MBR read successfully

                                    kernel: MBR read successfully

                                    user & kernel MBR OK

                                    Sous Vista, ne pas oublier de lancer mbr.exe par clic droit et Exécuter en tant qu'administrateur.
                                    Note : Si le fichier mbr.exe se trouve dans Téléchargement, cela fonctionne aussi et mbr.log s'y inscrira.
                                    0
                                    1. Lydia
                                      voila le rapport

                                      Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

                                      device: opened successfully
                                      user: MBR read successfully
                                      kernel: MBR read successfully
                                      user & kernel MBR OK
                                      copy of MBR has been found in sector 0x02542D6C1
                                      malicious code @ sector 0x02542D6C4 !
                                      PE file found in sector at 0x02542D6DA !
                                      0
                                  2. benurrr Contributeur sécurité
                                    Dans le menu Démarrer- Exécuter tape : "%userprofile%\Bureau\mbr" -f

                                    Dans le mbr.log cette ligne apparaitra "original MBR restored successfully !"

                                    poste le
                                    0
                                    1. Lydia
                                      petit problème, il n' ya guerre de ligne indiquant "original MBR restored successfully !" malgrés que j'ai suivi la procédure a la lettre!

                                      Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

                                      device: opened successfully
                                      user: MBR read successfully
                                      kernel: MBR read successfully
                                      user & kernel MBR OK
                                      copy of MBR has been found in sector 0x02542D6C1
                                      malicious code @ sector 0x02542D6C4 !
                                      PE file found in sector at 0x02542D6DA !
                                      0
                                  • 1
                                  • 2

                                  Discussions similaires

                                  comment convertir un logiciel .exe en .dmg
                                  omnisportdieng

                                  3 réponses
                                  Virus potentiel
                                  Ramon1

                                  29 réponses
                                  Convertir un fichier .exe en une application utilisable sur mac
                                  Rosalie

                                  2 réponses
                                  equivalence fichier dmg et exe
                                  bled01

                                  4 réponses
                                  J'ai toujours une fenêtre de Updater.exe
                                  Guy72

                                  7 réponses