Gros Probleme avec rundll32.exe

Lydia -  
benurrr Messages postés 9766 Statut Contributeur sécurité -
Bonjour à tous,
Voila j'ai un gros problème avec mon pc, au faite à chaque fois que je veux exécuter un programme j'ai toujours la fenêtre" ouvrir avec:..." .Donc j'ai fait quelques recherches sur le web mais non fructueuses!! Au fait j'ai voulu accéder au gestionnaire des taches mais la plupart des applications dedans ne s'ouvrent pas et j'ai un message d'erreur qui s'affiche" application introuvable C:\WINDOWS..rundll32.exe ". je désepère car en vérifiant mon dossier System32 j'ai trouvé l'application en question! j'ai donc trouvé sur le net l'application et j'ai essayer de la copier/coller dans System32,sauf que la l'ancienne application persiste et supprime la nouvelle.

J'espère que j'etait claire et avoir des réponses très rapidement..
Merci a l'avance ;)
Configuration: Windows XP
Firefox 2.0.0.20

22 réponses

  • 1
  • 2
  1. gamesharked Messages postés 415 Statut Membre 36
     
    fait une analyse antivirus immédiatement!
    0
  2. benurrr Messages postés 9766 Statut Contributeur sécurité 107
     
    salut

    a tu tester cette astuce ?

    https://www.commentcamarche.net/faq/2577-windows-erreur-de-chargement-rundll-rundll32-exe
    0
  3. Lydia
     
    Au fait j'ai déja fait un scan avec Spyhunter 3 et il m'a trouvé le malware Rogue.VISTA Antivirus! donc je l'ai supprimer, et la je vient de le restaurer pour voir et bein les programmes exécutables marchent sans probleme!
    aidez moi svp je ne sais plus quoi faire :(
    0
  4. benurrr Messages postés 9766 Statut Contributeur sécurité 107
     
    télécharge

    http://www.malwarebytes.org/mbam/program/mbam-setup.exe

    a l'installation vérifie que mise a jour et lancer programme et scan complet sont bien cocher

    Une fois a jour, le programme va se lancer; clic sur l´onglet paramètre, et coche la case : "Arrêter internet explorer pendant la suppression".

    A la fin du scan clique sur Afficher les résultats

    Vérifier si tout est coché et clic Supprimer la sélection

    S'il t'es demandé de redémarrer >>> clique sur "Yes"

    Et tu poste le rapport générer
    0
    1. Lydia
       
      Merci beaucoup de t'interesser au problème!
      Je suis entrain de faire le scan complet et cela prend du temps..esperant que cela sera fructif
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Lydia
     
    Quand je fais le scan sur le mode normal; l'ordinateur se plante et je fais un redémarrage forcé!
    La je suis entrain de le faire sur le mode sans echec, j'espere que cela ne change rien?!
    en attente de votre confirmation
    0
  7. benurrr Messages postés 9766 Statut Contributeur sécurité 107
     
    c'est bon tu peut continuer en mode sans échec
    0
    1. Lydia
       
      J'ai du faire une recherche rapide car a deux reprises au bout de 30/40 mins l'ordi beug!! c'est très stressant
      bon voila le rapport, je précise que j'ai rien supprimé


      Malwarebytes' Anti-Malware 1.44
      Version de la base de données: 3734
      Windows 5.1.2600 Service Pack 3 (Safe Mode)
      Internet Explorer 8.0.6001.18702

      14/02/2010 14:09:32
      mbam-log-2010-02-14 (14-09-27).txt

      Type de recherche: Examen rapide
      Eléments examinés: 148255
      Temps écoulé: 7 minute(s), 30 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 1
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 3
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 12

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\Documents and Settings\HelpAssistant\Local Settings\Temp\50.tmp (Trojan.Dropper) -> No action taken.
      C:\Documents and Settings\mazouz\Local Settings\Temp\50.tmp (Trojan.Dropper) -> No action taken.
      C:\Documents and Settings\mazouz\Local Settings\Temp\mvnpow.dll (Trojan.Dropper) -> No action taken.
      C:\Documents and Settings\mazouz\Local Settings\Temp\yMyB.dll (Trojan.Dropper) -> No action taken.
      C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> No action taken.
      C:\Documents and Settings\mazouz\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> No action taken.
      C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> No action taken.
      C:\WINDOWS\msa.exe (Trojan.Agent) -> No action taken.
      C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.
      C:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> No action taken.
      C:\Documents and Settings\HelpAssistant\Bureau\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
      C:\Documents and Settings\mazouz\Bureau\rundll32.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
      0
  8. Lydia
     
    J'ai supprimé les fichiers en question mais au moment de l'écriture du rapport tout a planté et l'ordinateur a généré un bip continu et donc redémarrage forcé! là je suis entrain de refaire le scan; on verra ce que cela donnera!
    0
  9. Lydia
     
    voila le rapport; 4 éléments persistent!!! help me pleaaaaaaaaaaaaaaaaaase

    Malwarebytes' Anti-Malware 1.44
    Version de la base de données: 3734
    Windows 5.1.2600 Service Pack 3 (Safe Mode)
    Internet Explorer 8.0.6001.18702

    14/02/2010 14:28:49
    mbam-log-2010-02-14 (14-28-46).txt

    Type de recherche: Examen rapide
    Eléments examinés: 148270
    Temps écoulé: 7 minute(s), 35 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 1
    Valeur(s) du Registre infectée(s): 0
    Elément(s) de données du Registre infecté(s): 3
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 0

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.

    Valeur(s) du Registre infectée(s):
    (Aucun élément nuisible détecté)

    Elément(s) de données du Registre infecté(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    (Aucun élément nuisible détecté)
    0
  10. Lydia
     
    Cc il y'a quelq'un?
    voila une autre catastrophe, maintenant je ne peux plus ouvrir mais programmes exécutables, que dois je faire?
    aidez moi svp
    0
  11. Lydia
     
    Svp aidez moi, ca m'ettone que personne ne réponde, j'ai vraiment besoin de votre aide so pleaaaaaaaaaaaase help me, je commence à désespérer!!
    merci pour votre attention
    0
  12. gamesharked Messages postés 415 Statut Membre 36
     
    Ne t'inquiéte pas , ca te met quoi comme erreur ?
    0
  13. benurrr Messages postés 9766 Statut Contributeur sécurité 107
     
    voila de retour,esperant que c'est pas du virut (infection qui endommage gravement le system)

    Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

    Télécharge et installe List&Kill'em et enregistre le sur ton bureau

    http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe

    Branche clés usb , disques durs externes , mp3 , mp4 , etc..

    double clique ( clic droit "exécuter en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

    coche la case "créer une icône sur le bureau"

    une fois terminée , clic sur "terminer" et le programme se lancera seul

    choisis la langue puis choisis l'option 1 = Mode Recherche

    laisse travailler l'outil

    à l'apparition de la fenêtre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

    un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

    Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'écran "COMPLETED"
    0
  14. Lydia
     
    voila le rapport, espérant qu'il n'ya pas de virut!!
    la nouveauté de mon ordi est que maintenant il se bloque tout seul après chaque démarrage au bout d'un certain temps!! j'ai essayé de voir dans l'observateur des évènements mais rien de spéciale...

    List'em by g3n-h@ckm@n 1.2.5.0

    User : Administrateur (Administrateurs)
    Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
    Start at: 10:27:16 | 15/02/2010
    Contact : https://forums.commentcamarche.net/forum/virus-securite-7

    Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
    Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
    Internet Explorer 8.0.6001.18702
    Windows Firewall Status : Enabled

    C:\ -> Disque fixe local | 218,88 Go (158,35 Go free) | NTFS
    D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
    E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
    F:\ -> Disque CD-ROM
    G:\ -> Disque amovible
    H:\ -> Disque amovible
    I:\ -> Disque amovible
    J:\ -> Disque amovible
    M:\ -> Disque CD-ROM

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\List_Kill'em\List_Kill'em.scr
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Documents and Settings\Administrateur\Local Settings\Temp\3.tmp\pv.exe

    ======================
    Keys "Run"
    ======================
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    ehTray REG_SZ C:\WINDOWS\ehome\ehtray.exe
    SigmatelSysTrayApp REG_SZ stsystra.exe
    IAAnotif REG_SZ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
    ATICCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    DMXLauncher REG_SZ C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    Install5G REG_SZ E:\Install.exe /SI=100
    REGSHAVE REG_SZ C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    DLCCCATS REG_SZ rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
    LVCOMSX REG_SZ C:\WINDOWS\system32\LVCOMSX.EXE
    LogitechVideoRepair REG_SZ C:\Program Files\Logitech\Video\ISStart.exe
    IMJPMIG8.1 REG_SZ "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    IMEKRMIG6.1 REG_SZ C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    MSPY2002 REG_SZ C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    PHIME2002ASync REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    PHIME2002A REG_SZ C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    ISUSPM Startup REG_SZ C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    ISUSPM REG_SZ "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -scheduler
    SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
    QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
    iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    =====================
    Other Keys
    =====================
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    dontdisplaylastusername REG_DWORD 0 (0x0)
    legalnoticecaption REG_SZ
    legalnoticetext REG_SZ
    shutdownwithoutlogon REG_DWORD 1 (0x1)
    undockwithoutlogon REG_DWORD 1 (0x1)
    InstallVisualStyle REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    InstallTheme REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale.theme

    ===============
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    NoDriveTypeAutoRun REG_DWORD 145 (0x91)

    ===============
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    HonorAutoRunSetting REG_DWORD 1 (0x1)

    ===============
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    AppInit_DLLS REG_SZ

    ===============
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    AutoRestartShell REG_DWORD 1 (0x1)
    DefaultUserName REG_SZ Administrateur
    LegalNoticeCaption REG_SZ
    LegalNoticeText REG_SZ
    PowerdownAfterShutdown REG_SZ 0
    ReportBootOk REG_SZ 1
    Shell REG_SZ Explorer.exe
    ShutdownWithoutLogon REG_SZ 0
    System REG_SZ
    Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
    VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
    SfcQuota REG_DWORD -1 (0xffffffff)
    allocatecdroms REG_SZ 0
    allocatedasd REG_SZ 0
    allocatefloppies REG_SZ 0
    cachedlogonscount REG_SZ 10
    forceunlocklogon REG_DWORD 0 (0x0)
    passwordexpirywarning REG_DWORD 14 (0xe)
    scremoveoption REG_SZ 0
    AllowMultipleTSSessions REG_DWORD 1 (0x1)
    UIHost REG_EXPAND_SZ logonui.exe
    LogonType REG_DWORD 1 (0x1)
    Background REG_SZ 0 0 0
    DefaultPassword REG_SZ
    DebugServerCommand REG_SZ no
    SFCDisable REG_DWORD 0 (0x0)
    WinStationsDisabled REG_SZ 0
    HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
    ShowLogonOptions REG_DWORD 0 (0x0)
    AltDefaultUserName REG_SZ Administrateur
    AltDefaultDomainName REG_SZ MM
    DefaultDomainName REG_SZ MM
    ChangePasswordUseKerberos REG_DWORD 1 (0x1)
    EnableConcurrentSessions REG_DWORD 1 (0x1)

    ===============
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

    ===============
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

    ===============
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
    %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
    C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
    C:\Program Files\Yahoo!\Messenger\YServer.exe REG_SZ C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server
    C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
    C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
    C:\Program Files\Dell Network Assistant\ezi_hnm2.exe REG_SZ C:\Program Files\Dell Network Assistant\ezi_hnm2.exe:*:Disabled:Advanced Networking Application
    C:\Program Files\Veoh Networks\Veoh\VeohClient.exe REG_SZ C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client
    C:\Program Files\Microsoft ActiveSync\rapimgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe REG_SZ C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    C:\Program Files\Microsoft ActiveSync\WCESMgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
    C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
    C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe REG_SZ C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player
    C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe REG_SZ C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe:*:Enabled:CrazyTalk
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
    C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
    C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
    C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
    C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe REG_SZ C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Disabled:BlueSoleil
    C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour
    C:\Program Files\Logitech\Logitech Vid\Vid.exe REG_SZ C:\Program Files\Logitech\Logitech Vid\Vid.exe:*:Disabled:Logitech Vid

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
    %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
    C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
    C:\Program Files\Microsoft ActiveSync\rapimgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe REG_SZ C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    C:\Program Files\Microsoft ActiveSync\WCESMgr.exe REG_SZ C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
    C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
    C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

    ===============
    ActivX controls
    ===============
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
    HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E5F5D008-DD2C-4D32-977D-1A0ADF03058B}

    ===============
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{DFB17AA8-042A-429D-987C-26CE244A4189}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\KB910393
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0291E591-EA41-4c82-8106-3DC6CE7F7664}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1BC46932-21B2-4130-86E0-B4EB4F7A7A7B}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{407408d4-94ed-4d86-ab69-a7f649d112ee}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BDE0FA43-6952-4BA8-8C58-09AF690F88E1}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E8EA5BD6-D931-4001-ABF6-81BAA500360A}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EA29D410-CE41-4953-A862-2DE706A1DAD7}
    HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}

    ==============
    BHO :
    ======
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

    ================
    Internet Explorer :
    ================
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
    Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
    Start Page REG_SZ www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=6061102

    ========
    Services
    ========
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

    Ndisuio : 0x3 ( OK = 3 )
    EapHost : 0x3 ( OK = 2 )
    SharedAccess : 0x2 ( OK = 2 )
    wuauserv : 0x2 ( OK = 2 )

    =========
    Atapi.sys
    =========

    %%%% HASHDEEP-1.0
    %%%% size,md5,sha256,filename
    ## Invoked from: C:\Documents and Settings\Administrateur\Local Settings\Temp\3.tmp
    ## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys
    ##
    96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys

    Sources
    =======

    C:\i386\atapi.sys
    C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
    C:\WINDOWS\ServicePackFiles\i386\atapi.sys
    C:\WINDOWS\system32\drivers\atapi.sys

    Référence :
    ==========

    Win XP_32b : a64013e98426e1877cb653685c5c0009
    Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
    Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
    Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
    Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
    Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
    Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
    Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
    Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

    =======
    Drive :
    =======

    D‚fragmenteur de disque Windows
    Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

    Rapport d'analyse
    219 Go total, 158 Go libre (72%), 4% fragment‚ (fragmentation du fichier 8%)

    Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

    ¤¤¤¤¤¤¤¤¤¤ Files/folders :

    Present !! : C:\WINDOWS\003000_.tmp
    Present !! : C:\WINDOWS\jestertb.dll
    Present !! : C:\WINDOWS\kb913800.exe
    Present !! : C:\WINDOWS\System32\_*.dll
    Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
    Present !! : C:\WINDOWS\System32\drivers\lvuvc.hs"
    Present !! : C:\WINDOWS\System32\SET*.tmp

    ¤¤¤¤¤¤¤¤¤¤ Keys :

    Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
    Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
    Present !! : "HKLM\Software\Trymedia Systems"
    Present !! : HKCR\OutlookAddin.Addin
    Present !! : HKCR\OutlookAddin.Addin.1
    Present !! : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}

    ============

    catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-02-15 10:34:42
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
    "khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
    "khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:21,ff,65,74,b8,ed,c0,7d,0c,8e,0f,c1,24,6c,d1,a2,1a,b5,68,3a,c0,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,72,da,a2,4d,cb,bc,4b,12,c6,5f,63,41,72,aa,13,11,c4,..
    "khjeh"=hex:3c,07,ba,99,b2,ff,d0,b9,91,77,9c,b5,e6,f5,e5,7e,26,cd,dd,77,c3,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:f0,05,cc,3f,61,e7,ea,37,8a,e8,09,69,f9,a1,c9,51,ca,a1,a8,76,c1,..

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x85F040F0]<<
    kernel: MBR read successfully
    detected MBR rootkit hooks:
    \Driver\iaStor -> 0x85f040f0
    Warning: possible MBR rootkit infection !
    user & kernel MBR OK
    Use "Recovery Console" command "fixmbr" to clear infection !

    ==========
    Programs
    ==========

    7-Zip
    Abbyy FineReader 6.0 Sprint
    Adobe
    Ahead
    Alwil Software
    Apple Software Update
    Atari
    ATI Technologies
    BAE
    BitComet
    Bonjour
    ComPlus Applications
    Corel
    DAEMON Tools Lite
    Dell
    Dell Network Assistant
    Dell Photo AIO Printer 924
    Digital Camera
    DivX
    Dl_cats
    Droppix
    eMule
    Enigma Software Group
    Fichiers communs
    FinePixViewer
    FrenchOtto
    GemMasterFrench
    Google
    Hercules
    illiminable
    InstallShield Installation Information
    Intel
    InterActual
    Internet Explorer
    Inventel
    iPod
    iTunes
    IVT Corporation
    Jasc Software Inc
    Java
    List_Kill'em
    Logitech
    Malwarebytes' Anti-Malware
    McAfee
    Messenger
    Microsoft
    Microsoft ActiveSync
    Microsoft CAPICOM 2.1.0.2
    microsoft frontpage
    Microsoft Office
    Microsoft Office Outlook Connector
    Microsoft Picture It! PhotoPub
    Microsoft Silverlight
    Microsoft SQL Server Compact Edition
    Microsoft Sync Framework
    Microsoft Works
    Microsoft.NET
    Mobipocket.com
    Movie Maker
    Mozilla Firefox
    MSBuild
    MSN
    MSN Gaming Zone
    MSN Messenger
    MSXML 4.0
    NetMeeting
    Nova-Intelligence
    Online Services
    Orange
    Outlook Express
    PIXELA
    PowerQuest
    QuickTime
    Real
    RealArcade
    Reallusion
    Reference Assemblies
    Reflex Business
    ReflexiveArcade
    REGSHAVE
    Roxio
    SAGEM
    Securitoo
    Services en ligne
    Sigmatel
    Skype
    Sonic
    Sun
    Symantec
    Tiscali
    Uninstall Information
    Veoh Networks
    Windows Live
    Windows Live SkyDrive
    Windows Live Toolbar
    Windows Media Connect 2
    Windows Media Player
    Windows Mobile Device Handbook
    Windows NT
    Windows Plus
    WindowsUpdate
    WinZip
    xerox
    Yahoo!
    Zylom Games

    ============
    Drive C:
    ============

    5813e13d5893f9cb84
    AUTOEXEC.BAT
    bec645826194be7ab6e54feb8f9c08
    boot.ini
    Bootfont.bin
    Config.Msi
    CONFIG.SYS
    dell
    dell.sdr
    dlcc.log
    dlccscan.log
    Documents and Settings
    Downloads
    drivers
    drvrtmp
    f6f124d1579f37a55a544c825bec0c
    found.000
    GameHouse Games
    i386
    INFCACHE.1
    IO.SYS
    Kill'em
    List'em.txt
    LogiSetup.log
    MSDOS.SYS
    MSOCache
    My Music
    NTDETECT.COM
    ntldr
    P1010834.JPG
    P1010835.JPG
    P1010836.JPG
    P1010837.JPG
    P1010838.JPG
    P1010839.JPG
    P1010840.JPG
    P1010841.JPG
    P1010842.JPG
    P1010844.JPG
    P1010845.JPG
    P1010846.JPG
    P1010847.JPG
    P1010848.JPG
    P1010849.JPG
    P1010887.JPG
    P1010888.JPG
    P1010890.JPG
    P1010891.JPG
    P1010892.JPG
    P1010893.JPG
    P1010894.JPG
    pagefile.sys
    partition_magic8.0FR
    playground.log
    Program Files
    RECYCLER
    Sites
    sqmdata00.sqm
    sqmdata01.sqm
    sqmdata02.sqm
    sqmdata03.sqm
    sqmdata04.sqm
    sqmdata05.sqm
    sqmdata06.sqm
    sqmdata07.sqm
    sqmdata08.sqm
    sqmdata09.sqm
    sqmdata10.sqm
    sqmdata11.sqm
    sqmdata12.sqm
    sqmdata13.sqm
    sqmdata14.sqm
    sqmdata15.sqm
    sqmdata16.sqm
    sqmdata17.sqm
    sqmdata18.sqm
    sqmdata19.sqm
    sqmnoopt00.sqm
    sqmnoopt01.sqm
    sqmnoopt02.sqm
    sqmnoopt03.sqm
    sqmnoopt04.sqm
    sqmnoopt05.sqm
    sqmnoopt06.sqm
    sqmnoopt07.sqm
    sqmnoopt08.sqm
    sqmnoopt09.sqm
    sqmnoopt10.sqm
    sqmnoopt11.sqm
    sqmnoopt12.sqm
    sqmnoopt13.sqm
    sqmnoopt14.sqm
    sqmnoopt15.sqm
    sqmnoopt16.sqm
    sqmnoopt17.sqm
    sqmnoopt18.sqm
    sqmnoopt19.sqm
    System Volume Information
    t
    Temp
    Thumbs.db
    timestmp.tmp
    WINDOWS
    YServer.txt

    ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

    C:\Program Files\Dell\Media Experience\IAPCSDK\Install.exe
    C:\Program Files\Dell Photo AIO Printer 924\Install\exe
    C:\Program Files\Dell Photo AIO Printer 924\Install\exe\Engine.dll
    C:\Program Files\Dell Photo AIO Printer 924\Install\exe\Uninst.exe
    C:\WINDOWS\Temp\McAfeeInstall\Install.exe

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

    End of scan : 10:46:01,29
    0
  15. benurrr Messages postés 9766 Statut Contributeur sécurité 107
     
    salut

    ▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
    mais cette fois-ci :

    ▶ choisis l'option 2 = Mode Suppression

    laisse travailler l'outil.

    en fin de scan un rapport s'ouvre

    ▶ colle le contenu dans ta reponse
    0
  16. Lydia
     
    Execuse moi benurrr, mais est ce que ça sera possible de savoir en quoi consiste le mode suppression, j'ai peur de supprimer certain fichiers importants pour le fonctionnement du pc, est ce que tu pourra m'expliquer un peu,
    je veux vraiment regler le probleme, je te remercie pour ton aide
    0
  17. benurrr Messages postés 9766 Statut Contributeur sécurité 107
     
    sa va te supprimer des fichier qui sont infecter ou qui se sont incruster a ton system apparement c'est pas du virut il risque pas de te supprimer des fichier légitime de ton system
    0
  18. Lydia
     
    voila le rapport:
    ps:merci pour l'explication

    Kill'em by g3n-h@ckm@n 1.2.5.0

    User : mazouz (Administrateurs)
    Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
    Start at: 13:37:38 | 15/02/2010
    Contact : https://forums.commentcamarche.net/forum/virus-securite-7

    Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
    Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
    Internet Explorer 8.0.6001.18702
    Windows Firewall Status : Enabled
    AV : avast! Antivirus 5.0.83886498 [ Enabled | Updated ]

    C:\ -> Disque fixe local | 218,88 Go (157,02 Go free) | NTFS
    D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
    E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
    F:\ -> Disque CD-ROM
    G:\ -> Disque amovible
    H:\ -> Disque amovible
    I:\ -> Disque amovible
    J:\ -> Disque amovible
    M:\ -> Disque CD-ROM

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\Logitech\Logitech Vid\Vid.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Dell Network Assistant\hnm_svc.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\ehome\mcrdsvc.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Logitech\Logitech Vid\LU\LULnchr.exe
    C:\Program Files\Logitech\Logitech Vid\LU\LogitechUpdate.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    C:\Program Files\List_Kill'em\List_Kill'em.scr
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\ERUNT.EXE
    C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\pv.exe

    Detections :
    ==========

    ¤¤¤¤¤¤¤¤¤¤ Files/folders :

    Quarantined & Deleted !! : C:\WINDOWS\003000_.tmp
    Quarantined & Deleted !! : C:\WINDOWS\jestertb.dll
    Quarantined & Deleted !! : C:\WINDOWS\kb913800.exe

    Quarantined & Deleted !! : C:\WINDOWS\System32\_000006_.tmp.dll
    Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
    Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\lvuvc.hs
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET56.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET67.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET6D.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET6E.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET8C.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET99.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETA3.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETAF.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETB8.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETB9.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETBA.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETBB.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETBD.tmp
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Application Data\wklnhst.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\003.zip
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\68.tmp
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\a.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\dw.log
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjv.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjw.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjx.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_Messenger.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_WLMessenger.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv_9cf01a2a.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lsnfier.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lvid_lvid.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lws_lws.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SHSetup.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1008.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_10b8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1120.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1268.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1354.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13c4.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13f4.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_14a0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1734.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_174c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_4cc.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_50c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6d0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6fc.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_718.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_798.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_7b8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_82c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_84c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_8ac.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_95c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_9c0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_a88.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_b4c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_bb8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c0c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c38.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c78.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c84.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ca0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cb0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cf8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d24.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d38.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d9c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_dc8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_de4.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e20.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e6c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ec0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f14.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f28.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f38.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SWFXXLRT.DLL
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\UninstallRC-8876480.dll
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Internet_Antivirus_Pro_Fix.rar

    ==============
    host file OK !
    ==============

    ========
    Registry
    ========

    Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
    Deleted : "HKLM\Software\Trymedia Systems"
    Deleted : HKCR\OutlookAddin.Addin
    Deleted : HKCR\OutlookAddin.Addin.1
    Deleted : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
    ========
    Services
    =========

    Ndisuio : Start = 3
    EapHost : Start = 2
    Ip6Fw : Start = 2
    SharedAccess : Start = 2
    wuauserv : Start = 2
    wscsvc : Start = 2

    ============
    Disk Cleaned
    ============

    =================
    anti-ver blaster : OK !!
    =================

    ================
    Prefetch cleaned
    ================

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
    0
  19. Lydia
     
    voila le rapport:
    ps:merci pour l'explication

    Kill'em by g3n-h@ckm@n 1.2.5.0

    User : mazouz (Administrateurs)
    Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30
    Start at: 13:37:38 | 15/02/2010
    Contact : https://forums.commentcamarche.net/forum/virus-securite-7

    Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
    Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
    Internet Explorer 8.0.6001.18702
    Windows Firewall Status : Enabled
    AV : avast! Antivirus 5.0.83886498 [ Enabled | Updated ]

    C:\ -> Disque fixe local | 218,88 Go (157,02 Go free) | NTFS
    D:\ -> Disque fixe local | 74,5 Go (28,49 Go free) | NTFS
    E:\ -> Disque CD-ROM | 480,81 Mo (0 Mo free) [GHAMIDY] | CDFS
    F:\ -> Disque CD-ROM
    G:\ -> Disque amovible
    H:\ -> Disque amovible
    I:\ -> Disque amovible
    J:\ -> Disque amovible
    M:\ -> Disque CD-ROM

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\Logitech\Logitech Vid\Vid.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Dell Network Assistant\hnm_svc.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\ehome\mcrdsvc.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Logitech\Logitech Vid\LU\LULnchr.exe
    C:\Program Files\Logitech\Logitech Vid\LU\LogitechUpdate.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    C:\Program Files\List_Kill'em\List_Kill'em.scr
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\ERUNT.EXE
    C:\Documents and Settings\mazouz\Local Settings\Temp\32.tmp\pv.exe

    Detections :
    ==========

    ¤¤¤¤¤¤¤¤¤¤ Files/folders :

    Quarantined & Deleted !! : C:\WINDOWS\003000_.tmp
    Quarantined & Deleted !! : C:\WINDOWS\jestertb.dll
    Quarantined & Deleted !! : C:\WINDOWS\kb913800.exe

    Quarantined & Deleted !! : C:\WINDOWS\System32\_000006_.tmp.dll
    Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
    Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\lvuvc.hs
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET56.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET67.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET6D.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET6E.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET8C.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SET99.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETA3.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETAF.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETB8.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETB9.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETBA.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETBB.tmp
    Quarantined & Deleted !! : C:\WINDOWS\System32\SETBD.tmp
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Application Data\wklnhst.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\003.zip
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\68.tmp
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\a.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\dw.log
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjv.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjw.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\Local Settings\Temp\Hjx.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_Messenger.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Install_WLMessenger.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv_9cf01a2a.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lsnfier.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lvid_lvid.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\lws_lws.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SHSetup.exe
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1008.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_10b8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1120.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1268.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1354.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13c4.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_13f4.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_14a0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_1734.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_174c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_4cc.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_50c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6d0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_6fc.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_718.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_798.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_7b8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_82c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_84c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_8ac.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_95c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_9c0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_a88.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_b4c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_bb8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c0c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c38.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c78.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_c84.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ca0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cb0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_cf8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d24.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d38.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_d9c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_dc8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_de4.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e20.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_e6c.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_ec0.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f14.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f28.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f38.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Perflib_Perfdata_f8.dat
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\SWFXXLRT.DLL
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\UninstallRC-8876480.dll
    Quarantined & Deleted !! : C:\Documents and Settings\mazouz\LOCAL Settings\Temp\Internet_Antivirus_Pro_Fix.rar

    ==============
    host file OK !
    ==============

    ========
    Registry
    ========

    Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
    Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
    Deleted : "HKLM\Software\Trymedia Systems"
    Deleted : HKCR\OutlookAddin.Addin
    Deleted : HKCR\OutlookAddin.Addin.1
    Deleted : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
    ========
    Services
    =========

    Ndisuio : Start = 3
    EapHost : Start = 2
    Ip6Fw : Start = 2
    SharedAccess : Start = 2
    wuauserv : Start = 2
    wscsvc : Start = 2

    ============
    Disk Cleaned
    ============

    =================
    anti-ver blaster : OK !!
    =================

    ================
    Prefetch cleaned
    ================

    ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
    0
  20. benurrr Messages postés 9766 Statut Contributeur sécurité 107
     
    possibilité de rootkit

    Télécharge mbr.exe de Gmer ici :
    http://www2.gmer.net/mbr/mbr.exe
    et enregistre le fichier sur le Bureau.

    Désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)
    Double clique sur mbr.exe
    Un rapport sera généré : mbr.log
    En cas d'infection, ce message "MBR rootkit code detected" va apparaitre.

    Si c'est le cas, continue comme ça :

    Dans le menu Démarrer- Exécuter tape : "%userprofile%\Bureau\mbr" -f
    Dans le mbr.log cette ligne apparaitra "original MBR restored successfully !"

    Réactive tes protections
    Poste ce rapport et supprimes-le ensuite.

    Pour vérifier

    Désactive tes protections et coupe la connexion. (Antivirus et antispywares, HIPS et autre résident)
    Relance mbr.exe

    Réactive tes protections.

    Le nouveau mbr.log devrait être celui-ci :

    Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

    device: opened successfully

    user: MBR read successfully

    kernel: MBR read successfully

    user & kernel MBR OK

    Sous Vista, ne pas oublier de lancer mbr.exe par clic droit et Exécuter en tant qu'administrateur.
    Note : Si le fichier mbr.exe se trouve dans Téléchargement, cela fonctionne aussi et mbr.log s'y inscrira.
    0
    1. Lydia
       
      voila le rapport




      Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

      device: opened successfully
      user: MBR read successfully
      kernel: MBR read successfully
      user & kernel MBR OK
      copy of MBR has been found in sector 0x02542D6C1
      malicious code @ sector 0x02542D6C4 !
      PE file found in sector at 0x02542D6DA !
      0
  21. benurrr Messages postés 9766 Statut Contributeur sécurité 107
     
    Dans le menu Démarrer- Exécuter tape : "%userprofile%\Bureau\mbr" -f

    Dans le mbr.log cette ligne apparaitra "original MBR restored successfully !"

    poste le
    0
    1. Lydia
       
      petit problème, il n' ya guerre de ligne indiquant "original MBR restored successfully !" malgrés que j'ai suivi la procédure a la lettre!


      Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

      device: opened successfully
      user: MBR read successfully
      kernel: MBR read successfully
      user & kernel MBR OK
      copy of MBR has been found in sector 0x02542D6C1
      malicious code @ sector 0x02542D6C4 !
      PE file found in sector at 0x02542D6DA !
      0
  • 1
  • 2

Discussions similaires

comment convertir un logiciel .exe en .dmg
omnisportdieng -
Utilisateur anonyme -

3 réponses
Exécuter un programme via l'invite de commande
pifou -
dty -

24 réponses
Convertir un fichier .exe en une application utilisable sur mac
Rosalie -
Rosalie -

2 réponses