Sujet Précédent Sujet Suivant

Infection par Dr Guard

Résolu/Fermé
Arno - 6 mars 2010 à 17:44
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 - 18 mars 2010 à 00:27
Bonjour,

Je me suis fais malheureusement infecté par Dr Guard.
J'ai commencé à suivre la procédure que j'ai trouvé ici :
http://www.commentcamarche.net/faq/26988-dr-guard

Donc je vous poste ci-après le rapport généré par Malwarebytes'Anti Malware.
Et je vais entamé le scan avec List&Kill'em, et je vous posterais à la suite le rapport.

D'avance merci pour toute aide, j'attends vos futures instructions.
Arnaud


Rapport de Malwarebytes' Anti Malware :

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.13

06/03/2010 16:52:36
mbam-log-2010-03-06 (16-52-36).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 153445
Temps écoulé: 46 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 302

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7aa32fc7-133b-4ae7-998e-ced0d9829b12} (Trojan.Dialer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56b38f40-4e70-11d4-a076-0080ad86ba2f} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{56b38f40-4e70-11d4-a076-0080ad86ba2f} (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cbvcs (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer.exe (Trojan.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wsctf.exe (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\urretnd.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\autorun.inf (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\d1vmq.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP807\A0023783.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP807\A0023804.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP807\A0023805.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP808\A0023807.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP808\A0023825.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP808\A0023826.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP809\A0023828.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP810\A0023958.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP810\A0023959.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP810\A0023979.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP810\A0023980.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP811\A0023982.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP811\A0023998.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP811\A0023999.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP812\A0024001.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP812\A0024011.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP812\A0024012.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP813\A0024017.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP813\A0024025.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP813\A0024026.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP814\A0024035.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP814\A0024056.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP814\A0024057.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP815\A0024062.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP815\A0024072.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP815\A0024073.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP816\A0024077.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP816\A0024092.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP816\A0024093.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP817\A0024098.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP817\A0024106.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP817\A0024107.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP817\A0024115.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP817\A0024116.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP818\A0024123.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP818\A0024133.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP818\A0024134.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP819\A0024142.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP819\A0024150.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP819\A0024151.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP820\A0024220.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP820\A0024231.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP820\A0024233.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP821\A0024241.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP821\A0024250.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP821\A0024252.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP821\A0024280.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP821\A0024282.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP822\A0024284.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP822\A0024296.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP822\A0024298.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP823\A0024313.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP823\A0024336.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP823\A0024338.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP823\A0024357.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP823\A0024359.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP823\A0024389.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP823\A0024391.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP824\A0024393.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP824\A0024411.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP824\A0024413.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP825\A0024415.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP825\A0024433.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP825\A0024435.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP826\A0024443.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP826\A0024479.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP826\A0024481.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024496.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024511.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024513.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024524.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024526.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024547.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024549.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024604.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024609.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024624.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024626.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024640.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP827\A0024642.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP828\A0024646.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP828\A0024668.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP828\A0024669.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP829\A0024672.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP829\A0024710.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP829\A0024711.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP830\A0024720.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP830\A0024741.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP830\A0024743.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP831\A0024748.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP831\A0024773.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP831\A0024775.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP832\A0024777.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP832\A0024804.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP832\A0024806.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP833\A0024816.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP833\A0024835.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP833\A0024837.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP834\A0024879.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP834\A0024898.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP834\A0024899.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP834\A0024926.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP834\A0024928.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP835\A0024930.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP835\A0024972.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP835\A0024973.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP836\A0024979.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP836\A0025023.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP836\A0025025.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP837\A0025031.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP837\A0025065.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP837\A0025066.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP838\A0025068.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP838\A0025093.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP838\A0025095.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP838\A0025116.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP838\A0025118.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP839\A0025120.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP839\A0025149.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP839\A0025151.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP840\A0025153.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP840\A0025240.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP840\A0025241.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP840\A0025250.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP840\A0025252.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025295.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025368.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025370.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025381.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025383.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025403.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025405.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025421.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP841\A0025423.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP842\A0025425.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP842\A0025454.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP842\A0025456.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP843\A0025458.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP843\A0025483.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP843\A0025485.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP844\A0025487.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP844\A0025524.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP844\A0025526.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP845\A0025528.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP846\A0025634.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP846\A0025636.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP846\A0025648.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP846\A0025650.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP847\A0025658.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP847\A0025667.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP847\A0025669.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP848\A0025671.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP848\A0025696.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP848\A0025698.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP848\A0025706.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP848\A0025708.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP849\A0025720.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP849\A0025745.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP849\A0025747.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP850\A0025755.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP850\A0025770.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP850\A0025772.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP850\A0025785.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP850\A0025787.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP851\A0025793.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP851\A0025802.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP851\A0025804.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP852\A0025810.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP852\A0025831.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP852\A0025833.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP853\A0025850.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP853\A0025877.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP853\A0025881.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP854\A0025892.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP854\A0025903.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP854\A0025904.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP854\A0025938.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP854\A0025940.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP855\A0025942.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP855\A0025969.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP855\A0025971.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP856\A0025973.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP856\A0026969.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP856\A0026971.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP857\A0026987.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP857\A0027017.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP857\A0027018.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP858\A0027023.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP858\A0027049.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP858\A0027050.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP859\A0027057.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP859\A0027075.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP859\A0027077.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP859\A0027097.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP859\A0027099.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP860\A0027105.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP860\A0027116.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP860\A0027118.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP861\A0027126.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP861\A0027138.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP861\A0027139.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP861\A0027157.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP861\A0027161.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027167.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027174.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027178.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027186.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027188.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027200.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027202.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027212.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP862\A0027214.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP863\A0027226.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP864\A0027298.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP864\A0027299.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP864\A0027332.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP864\A0027333.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP865\A0027342.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP865\A0027359.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP865\A0027361.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP866\A0027365.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP866\A0027384.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP866\A0027387.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP867\A0027394.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP867\A0027422.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP867\A0027424.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP867\A0027434.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP867\A0027436.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP868\A0027447.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP868\A0027489.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP868\A0027490.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP869\A0027495.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP869\A0027517.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP869\A0027518.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP869\A0027533.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP869\A0027537.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP870\A0027553.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP870\A0027581.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP870\A0027584.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP871\A0027601.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP871\A0027609.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP871\A0027611.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP872\A0027627.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP872\A0027641.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP872\A0027642.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP873\A0027645.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP873\A0027664.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP873\A0027666.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP874\A0027668.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP874\A0027677.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP874\A0027679.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP874\A0028677.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP874\A0028679.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP875\A0028683.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP875\A0028693.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP875\A0028695.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP875\A0028717.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP875\A0028718.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP876\A0028723.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP877\A0028740.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP877\A0028743.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP877\A0028754.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP877\A0028756.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP877\A0028789.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP877\A0028794.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP877\A0028805.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP877\A0028807.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP878\A0028870.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP878\A0028905.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP878\A0028906.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP879\A0028909.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP879\A0028932.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP879\A0028934.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP880\A0028940.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP880\A0028954.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP880\A0028956.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP880\A0028980.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP880\A0028983.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP881\A0028991.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP881\A0029004.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP881\A0029005.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP882\A0029028.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP882\A0029046.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP882\A0029047.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP883\A0029051.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP883\A0029060.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP883\A0029062.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP884\A0029082.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP884\A0029096.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP884\A0029097.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP885\A0029115.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP885\A0029136.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP885\A0029137.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP885\A0029151.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{832AB80E-718C-46E6-A56C-5C25F61905DD}\RP885\A0029153.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\optyhww0.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\optyhww1.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\U.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cgmopenbho.dll (Trojan.BHO) -> Quarantined and deleted successfully.

39 réponses

  • 1
  • 2
Réponse 1 / 39
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
6 mars 2010 à 21:43
slt en passant MBAM n'a pas été mis à jour


Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510



et donc l'efficacité est limitée
1
Réponse 2 / 39
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
8 mars 2010 à 09:00
pour avancer benurr , branche tous tes supports externes (clé usb, disque dur externe carte de memoire)

et colle un rapport usbfix option 2




bonne suite à tous les deux
1
Réponse 3 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
6 mars 2010 à 17:46
Salut : mbam a bien travailler continue avec List&Kill'em

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

Télécharge et installe List&Kill'em et enregistre le sur ton bureau

http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe


Branche clés usb , disques durs externes , mp3 , mp4 , etc..

double clique ( clic droit "exécuter en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

coche la case "créer une icône sur le bureau"

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis la langue puis choisis l'option 1 = Mode Recherche

laisse travailler l'outil

à l'apparition de la fenêtre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini.

Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'écran "COMPLETED"
0
Arno
6 mars 2010 à 18:21
Merci benurrr de ta réponse rapide,

Alors, voilà ce que m'a pondu List'em :

List'em by g3n-h@ckm@n 1.3.0.0

User : rodon ()
Update on 06/03/2010 by g3n-h@ckm@n ::::: 14.00
Start at: 18:06:23 | 06/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) XP 2400+
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : Dr. Guard 1.0 [ Enabled | (!) Outdated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 149,04 Go (130,41 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM

Boot: Safeboot


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\EXPLORER.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\FxEx.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
updateMgr REG_SZ "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
asr64_ldm.exe REG_SZ C:\DOCUME~1\rodon\LOCALS~1\Temp\asr64_ldm.exe
Dr. Guard REG_SZ "C:\Program Files\Dr. Guard\drguard.exe" -noscan
wsctf.exe REG_SZ wsctf.exe
EXPLORER.EXE REG_SZ EXPLORER.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
HTpatch REG_SZ C:\WINDOWS\htpatch.exe
SiSUSBRG REG_SZ C:\WINDOWS\SiSUSBrg.exe
Cmaudio REG_SZ RunDll32 cmicnfg.cpl,CMICtrlWnd
ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
NWEReboot REG_SZ
NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
LogitechCommunicationsManager REG_SZ "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
LVCOMSX REG_SZ "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
53B8B6 REG_SZ C:\WINDOWS\system32\44A587\059BB7.EXE
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Malwarebytes Anti-Malware (reboot) REG_SZ "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ RODON-F9DE315D9
DefaultUserName REG_SZ rodon
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ userinit.exe,EXPLORER.EXE
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ rodon
AltDefaultDomainName REG_SZ RODON-F9DE315D9

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe REG_SZ C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Documents and Settings\rodon\Mes documents\Arno\eMule0.49c\eMule0.49c\emule.exe REG_SZ C:\Documents and Settings\rodon\Mes documents\Arno\eMule0.49c\eMule0.49c\emule.exe:*:Enabled:eMule
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
C:\Documents and Settings\rodon\Application Data\7c7e.exe REG_SZ C:\Documents and Settings\rodon\Application Data\7c7e.exe:*:Enabled:Win32load

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{A06BE318-C096-11D4-964F-0010A4D06F69}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
149 Go total, 130 Go libre (87%), 4% fragment‚ (fragmentation du fichier 8%)

Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Program Files\Dr. Guard
Present !! : C:\WINDOWS\SET3.tmp
Present !! : C:\WINDOWS\SET4.tmp
Present !! : C:\WINDOWS\SET8.tmp
Present !! : C:\WINDOWS\System32\_*.dll
Present !! : C:\WINDOWS\System32\404Fix.exe
Present !! : C:\WINDOWS\System32\dumphive.exe"
Present !! : C:\WINDOWS\System32\IEDFix.exe
Present !! : C:\WINDOWS\System32\Process.exe
Present !! : C:\WINDOWS\System32\SrchSTS.exe
Present !! : C:\WINDOWS\System32\tmp.reg"
Present !! : C:\WINDOWS\System32\VACFix.exe
Present !! : C:\WINDOWS\System32\VCCLSID.exe
Present !! : C:\WINDOWS\System32\WS2Fix.exe
Present !! : C:\Documents and Settings\rodon\Local Settings\Temp\drg.dat
Present !! : C:\Documents and Settings\rodon\LOCAL Settings\Temp\drg.dat
Present !! : C:\Documents and Settings\rodon\LOCAL Settings\Temp\drgr.dat

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\dr. guard"
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.exe
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\dr. guard"
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.exe
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\dr. guard"
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.exe
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : "HKCU\SOFTWARE\Dr. Guard"
Present !! : "HKCU\Software\Malware Defense"
Present !! : "HKLM\SOFTWARE\Dr. Guard"
Present !! : "HKLM\SOFTWARE\Malware Defense"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dr. guard"
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_KAVSYS
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_KAVSYS
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_KAVSYS

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-06 18:15:04
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HTpatch = C:\WINDOWS\htpatch.exe?ows\CurrentVersion\Run???\???/??[???????[???[???????????????????[???[?C?????[$??????[????????????S??[????????m??[???w????(???{??w???w???????w???w???[????????d???b6?[%??[???[????"??[A??[???[.??wZ??[?3?[?3?[????st.I?????? [????d???0=?[?K?[

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
kernel: MBR read successfully
user & kernel MBR OK


¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials





¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 18:15:15,95
0
Arno > Arno
6 mars 2010 à 18:23
Mince, j'avais pas vu ça :
"Windows Firewall Status : Enabled "

Tu disais de désactivé le firewall, est ce que c'est bon ou pas du coup? Comment faire pour le désactiver sinon?
Merci ;)
0
Réponse 4 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
6 mars 2010 à 19:21
# Aller dans le menu "Démarrer"
# Choisir "Panneau de configuration".
Dans "Pare-feu Windows", cliquer sur Paramètres, puis choisissez "Désactivé" afin d'activer ou de désactiver le pare-feu et enfin cliquer sur OK pour valider.

▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'option 2 = Mode Suppression

laisse travailler l'outil.

en fin de scan un rapport s'ouvre

▶ colle le contenu dans ta réponse

ensuite :

▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'option 6 = Restore MBR

laisse travailler l'outil.

en fin de scan un rapport s'ouvre

▶ colle le contenu dans ta réponse
0
Arno
6 mars 2010 à 19:34
Alors le truc c'est que je fais tourner Anti Malware & List'em en mode sans échec, car en mode normal soit ça ne se lance pas ou soit ça plante... Donc j'ai ré-essayé en désactivant le firewall windows (en mode normal car en mode sans échec impossible d'y accéder), et j'ai rédemarrer en mode sans échec pour lancer List'em. Ça va tu me suis? :)
Donc dans le rapport de List'em, ça me met toujours "Windows Firewall Status : Enabled"....

Je passe à la suite option 2 et option 6 dans list&kill'em.
Merci

Ci-dssous le "nouveau" rapport dont je parle ci-dessus :

List'em by g3n-h@ckm@n 1.3.0.0

User : rodon ()
Update on 06/03/2010 by g3n-h@ckm@n ::::: 14.00
Start at: 19:07:47 | 06/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) XP 2400+
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : Dr. Guard 1.0 [ Enabled | (!) Outdated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 149,04 Go (130,41 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM

Boot: Safeboot


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\EXPLORER.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\FxEx.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
updateMgr REG_SZ "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
asr64_ldm.exe REG_SZ C:\DOCUME~1\rodon\LOCALS~1\Temp\asr64_ldm.exe
Dr. Guard REG_SZ "C:\Program Files\Dr. Guard\drguard.exe" -noscan
wsctf.exe REG_SZ wsctf.exe
EXPLORER.EXE REG_SZ EXPLORER.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
HTpatch REG_SZ C:\WINDOWS\htpatch.exe
SiSUSBRG REG_SZ C:\WINDOWS\SiSUSBrg.exe
Cmaudio REG_SZ RunDll32 cmicnfg.cpl,CMICtrlWnd
ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
NWEReboot REG_SZ
NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
LogitechCommunicationsManager REG_SZ "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
LVCOMSX REG_SZ "C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
53B8B6 REG_SZ C:\WINDOWS\system32\44A587\059BB7.EXE
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Malwarebytes Anti-Malware (reboot) REG_SZ "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ RODON-F9DE315D9
DefaultUserName REG_SZ rodon
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ userinit.exe,EXPLORER.EXE
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ rodon
AltDefaultDomainName REG_SZ RODON-F9DE315D9

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe REG_SZ C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home
C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Documents and Settings\rodon\Mes documents\Arno\eMule0.49c\eMule0.49c\emule.exe REG_SZ C:\Documents and Settings\rodon\Mes documents\Arno\eMule0.49c\eMule0.49c\emule.exe:*:Enabled:eMule
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype
C:\Documents and Settings\rodon\Application Data\7c7e.exe REG_SZ C:\Documents and Settings\rodon\Application Data\7c7e.exe:*:Enabled:Win32load

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{A06BE318-C096-11D4-964F-0010A4D06F69}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.orange.fr/portail

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3 ( OK = 3 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse
149 Go total, 130 Go libre (87%), 4% fragment‚ (fragmentation du fichier 8%)

Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Program Files\Dr. Guard
Present !! : C:\WINDOWS\SET3.tmp
Present !! : C:\WINDOWS\SET4.tmp
Present !! : C:\WINDOWS\SET8.tmp
Present !! : C:\WINDOWS\System32\_*.dll
Present !! : C:\WINDOWS\System32\404Fix.exe
Present !! : C:\WINDOWS\System32\dumphive.exe"
Present !! : C:\WINDOWS\System32\IEDFix.exe
Present !! : C:\WINDOWS\System32\Process.exe
Present !! : C:\WINDOWS\System32\SrchSTS.exe
Present !! : C:\WINDOWS\System32\tmp.reg"
Present !! : C:\WINDOWS\System32\VACFix.exe
Present !! : C:\WINDOWS\System32\VCCLSID.exe
Present !! : C:\WINDOWS\System32\WS2Fix.exe
Present !! : C:\Documents and Settings\rodon\Local Settings\Temp\drg.dat
Present !! : C:\Documents and Settings\rodon\LOCAL Settings\Temp\drg.dat
Present !! : C:\Documents and Settings\rodon\LOCAL Settings\Temp\drgr.dat

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\dr. guard"
Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.exe
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\dr. guard"
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.exe
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\dr. guard"
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.exe
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\dr. guard"
Present !! : HKU\S-1-5-21-583907252-1563985344-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.exe
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : "HKCU\SOFTWARE\Dr. Guard"
Present !! : "HKCU\Software\Malware Defense"
Present !! : "HKLM\SOFTWARE\Dr. Guard"
Present !! : "HKLM\SOFTWARE\Malware Defense"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dr. guard"
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_KAVSYS
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_KAVSYS
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_KAVSYS

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-06 19:16:46
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HTpatch = C:\WINDOWS\htpatch.exe?ows\CurrentVersion\Run???\???/??[???????[???[???????????????????[???[?C?????[$??????[????????????S??[????????m??[???w????(???{??w???w???????w???w???[????????d???b6?[%??[???[????"??[A??[???[.??wZ??[?3?[?3?[????st.I?????? [????d???0=?[?K?[

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
kernel: MBR read successfully
user & kernel MBR OK


¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials





¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 19:16:58,18
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
6 mars 2010 à 19:49
se rapport c'est le rapport de l'option 1

relance le et choisie l'option 2 et après l'option 6
0
Arno
6 mars 2010 à 21:10
Oui oui c'était bien l'option 1 que j'avais essayé de relancer avec le firewall désactivé en mode normal (mais il n'y a pas de différence avec le premier rapport).

Alors j'ai lancé l'option 2, mais elle plante vers les 75%, normalement les noms de fichiers défilent, et là à un moment, elle reste bloquée sur un fichier. J'ai essayé 3 fois, et 3 fois le même problème (avec plantage sur des noms de fichiers différents). Je vais essayé de faire un dernier essai en laissant tourner toute la nuit.

Si ça plante encore, dois-je passer à l'option 6?

Donc pour l'instant j'ai un fichier kill'em.txt à la racine du C: qui ressemble à ça :

Kill'em by g3n-h@ckm@n 1.3.0.0

User : rodon (Administrateurs)
Update on 06/03/2010 by g3n-h@ckm@n ::::: 14.00
Start at: 20:28:24 | 06/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) XP 2400+
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : Dr. Guard 1.0 [ Enabled | (!) Outdated ]

A:\ -> Disque amovible
C:\ -> Disque fixe local | 149,04 Go (129,92 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\EXPLORER.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :



==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\dr. guard"
Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\EXPLORER.exe
0
Réponse 6 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
6 mars 2010 à 21:34
c'est du coriace

fait le en mode sans échec si sa plante encore
0
Réponse 7 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
6 mars 2010 à 21:47
salut jlpjlp,sa fait un bail tu va bien j'espere

bien vue
0
Arno
6 mars 2010 à 22:00
C'est clair que c'est corriace là, ça commence à me pomper...
:)
Pour la version de MBAM, la 1.44 est la dernière de dispo sur le site de malwarebytes... Je fais comment du coup???

Et pour l'option 2 en mode sans échec.... tadam.... ça marche pas.... J'ai lancé l'option 2 en mode sans échec, donc ça reboot, normal quoi, mais quand je reviens en sans échec pour qu'il analyse les fichiers automatiquement (sans que je clic sur l'appli sur mon bureau), rien ne se passe...

Voilà voilà, merci pour votre aide réactive ;)
0
Réponse 8 / 39
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
6 mars 2010 à 21:56
slt benurrr effectivement cela fait un bout de temps ! moi ça va impec et toi?
0
Réponse 9 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
6 mars 2010 à 21:57
moi sa roule merci mon ami
0
Réponse 10 / 39
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
6 mars 2010 à 21:59
:)
0
Réponse 11 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
6 mars 2010 à 22:04
pour la mise a jour relance mbam va dans l'onglet mise jour et clic sur mise a jour
0
Réponse 12 / 39
Arno
6 mars 2010 à 22:21
Ok merci.
Du coup il faut que je recommence toute la procédure depuis l'étape MBAM?
0
Réponse 13 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
6 mars 2010 à 22:25
oui au cas ou il y'aurai des reste meme si il a virer plus de 300 merde
0
Réponse 14 / 39
Arno
6 mars 2010 à 22:30
Ok, bon bah il va faire ça cette nuit.
0
Réponse 15 / 39
Arno
6 mars 2010 à 22:47
Mouahah, impossible de lancer mbam en mode normal (ça m'était déjà arrivé tout à l'heure), et impossible de mettre à jour mbam en mode sans échec (j'ai une erreur n°blablablaquej'aipasnoté, et il semble que je n'ai pas de connexion internet en mode sans échec).... pffffffff

Des solutions? Où je continue la procédure?
0
Réponse 16 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
7 mars 2010 à 10:49
Telecharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Note importante :tu est sous Vista

la désactivation du Contrôle des comptes utilisateurs est obligatoire

Tuto : https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac­er-l-uac

pour toute manipulation fait comme ceci( clic droit "exécuter en tant qu'administrateur" pour Vista/7 )

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

-Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. risque de figer l'ordi

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordi (plantage complet)

::Si combofix detecte quelque chose et de demande a redémarrer tu accepte
0
Réponse 17 / 39
Arno
7 mars 2010 à 13:56
Slaut benurrr,

Les liens vers combofix sont tous morts.... Comment faire?

Je suis sous XP, il faut que je désactive le Contrôle des comptes utilisateurs?
Merci
0
Réponse 18 / 39
Arno
7 mars 2010 à 18:52
Bon alors, après d'âpres recherches, j'ai trouvé combofix.
J'ai bien compris que j'avais pas besoin de désactiver le Contrôle des comptes utilisateurs car je suis sous XP.
J'ai essayé de lancé combofix en mode normal, ça marchait pas, il ne se lançait pas du tout. Donc du coup je l'ai lancé en mode sans échec. En le lançant il m'a dit que la version était expiré donc il s'est lancé en - Mode FONCTIONNALITES REDUITES -.

Et à la fin il me donne ça :

ComboFix 08-12-17.01 - rodon 2010-03-07 18:35:03.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.511.397 [GMT 1:00]
Lancé depuis: c:\documents and settings\rodon\Bureau\ComboFix.exe

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.
- Mode FONCTIONNALITES REDUITES -
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\explorer.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\o4Patch.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-07 au 2010-03-07 ))))))))))))))))))))))))))))))))))))
.

2010-03-07 18:03 . 2010-03-07 18:04 <REP> d-------- c:\program files\QuickTime
2010-03-07 18:03 . 2010-03-07 18:03 <REP> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2010-03-07 18:02 . 2010-03-07 18:02 <REP> d-------- c:\program files\Fichiers communs\Apple
2010-03-07 17:43 . 2010-03-07 17:42 73,728 --a------ c:\windows\system32\javacpl.cpl
2010-03-07 13:56 . 2010-03-07 13:56 <REP> d-------- C:\Kill'em
2010-03-06 23:01 . 2010-03-06 23:02 <REP> d--h-c--- c:\windows\ie8
2010-03-06 22:58 . 2010-03-06 22:58 <REP> d-------- C:\d609d9bbb6f6b38490d3a642b47ac9
2010-03-06 21:34 . 2010-03-06 21:34 <REP> d-------- C:\6c9737f2f515420252982a8c48
2010-03-06 17:00 . 2010-03-07 14:00 <REP> d-------- c:\program files\List_Kill'em
2010-03-06 15:54 . 2010-03-06 22:42 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2010-03-06 15:54 . 2010-03-06 15:54 <REP> d-------- c:\documents and settings\rodon\Application Data\Malwarebytes
2010-03-06 15:54 . 2010-03-06 15:54 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-06 15:54 . 2010-01-07 16:07 38,224 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-06 15:54 . 2010-01-07 16:07 19,160 --a------ c:\windows\system32\drivers\mbam.sys
2010-03-06 15:19 . 2010-03-06 15:21 <REP> d-------- C:\FyK
2010-03-06 14:44 . 2008-12-12 01:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe
2010-03-06 14:41 . 2007-04-18 10:47 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage réseau
2010-03-06 14:41 . 2007-04-18 10:47 <REP> d--h----- c:\documents and settings\Administrateur\Voisinage d'impression
2010-03-06 14:41 . 2007-04-18 08:58 <REP> d--h----- c:\documents and settings\Administrateur\Modèles
2010-03-06 14:41 . 2007-04-18 10:47 <REP> d-------- c:\documents and settings\Administrateur\Mes documents
2010-03-06 14:41 . 2007-04-18 10:47 <REP> dr------- c:\documents and settings\Administrateur\Menu Démarrer
2010-03-06 14:41 . 2007-04-18 10:47 <REP> d-------- c:\documents and settings\Administrateur\Favoris
2010-03-06 14:41 . 2010-03-06 14:44 <REP> d-------- c:\documents and settings\Administrateur\Bureau
2010-03-06 14:41 . 2010-03-06 14:41 <REP> d-------- c:\documents and settings\Administrateur
2010-03-06 13:39 . 2010-03-07 13:46 1,539 --a------ c:\documents and settings\All Users\Application Data\_VOIDkrl32mainweq.dll
2010-03-06 13:38 . 2010-03-06 13:38 49,152 --a------ c:\windows\system32\_VOIDxfukneepcw.dll
2010-03-06 13:38 . 2010-03-06 13:38 34,304 --a------ c:\windows\system32\_VOIDnbemgirnip.dll
2010-03-06 13:38 . 2010-03-07 13:42 10,738 --a------ c:\documents and settings\All Users\Application Data\_VOIDmainqt.dll
2010-03-06 13:37 . 2010-03-06 13:37 <REP> d-------- c:\windows\_VOIDlbypdipmko
2010-03-06 13:37 . 2010-03-06 13:37 28,672 --a------ c:\windows\system32\_VOIDoqxwkbsodp.dll
2010-03-06 13:37 . 2010-03-06 13:37 18,432 --a------ c:\documents and settings\rodon\Application Data\7c7e.exe
2010-03-06 13:37 . 2010-03-07 18:27 272 --a------ c:\windows\system32\_VOIDcpevxehdti.dat
2010-02-15 18:50 . 2010-02-15 18:50 94,208 --a------ c:\windows\system32\QuickTimeVR.qtx
2010-02-15 18:50 . 2010-02-15 18:50 69,632 --a------ c:\windows\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-07 17:25 --------- d-----w c:\program files\Google
2010-03-07 16:56 --------- d-----w c:\documents and settings\rodon\Application Data\Skype
2010-03-07 16:42 411,368 ----a-w c:\windows\system32\deploytk.dll
2010-03-07 16:42 --------- d-----w c:\program files\Java
2010-03-07 16:37 --------- d-----w c:\program files\Fichiers communs\Java
2010-03-06 21:28 --------- d-----w c:\program files\Fichiers communs\Adobe
2010-03-05 21:57 --------- d-----w c:\documents and settings\rodon\Application Data\skypePM
2010-01-28 13:08 --------- d-----w c:\documents and settings\rodon\Application Data\Apple Computer
2010-01-05 09:56 832,512 ----a-w c:\windows\system32\wininet.dll
2010-01-05 09:56 78,336 ----a-w c:\windows\system32\ieencode.dll
2010-01-05 09:56 17,408 ------w c:\windows\system32\corpol.dll
2009-12-17 07:59 347,648 ----a-w c:\windows\system32\mspaint.exe
2009-12-14 07:36 33,280 ----a-w c:\windows\system32\csrsrv.dll
2009-12-09 10:26 2,182,400 ----a-w c:\windows\system32\ntoskrnl.exe
2009-12-09 10:26 2,059,776 ----a-w c:\windows\system32\ntkrnlpa.exe
2003-07-30 05:00 12,800 ----a-w c:\documents and settings\rodon\cnmss Canon i560 (Local).exe
2003-07-30 05:00 12,800 ----a-w c:\documents and settings\LocalService\cnmss Canon i560 (Local).exe
2001-11-23 04:08 712,704 ----a-w c:\windows\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"EXPLORER.EXE"="EXPLORER.EXE" [2007-06-13 c:\windows\explorer.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="c:\windows\htpatch.exe" [2002-10-30 28672]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-12 335872]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-17 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-11-17 86016]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 497200]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 614960]
"LVCOMSX"="c:\program files\Fichiers communs\Logitech\LComMgr\LVComSX.exe" [2006-06-26 243248]
"53B8B6"="c:\windows\system32\44A587\[u]0[/u]59BB7.EXE" [2009-12-20 17:26 1557237]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-01-11 246504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]
"nwiz"="nwiz.exe" [2006-11-17 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\rodon\Menu D‚marrer\Programmes\D‚marrage\
252277.lnk - c:\windows\system32\44A587\[u]0[/u]59BB7.EXE [2009-12-20 17:26:12 1557237]
BJ Status Monitor Canon i560.lnk - c:\documents and settings\rodon\cnmss Canon i560 (Local).exe [2008-04-09 12800]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe,EXPLORER.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\rodon\\Application Data\\7c7e.exe"=

S2 gupdate;Service Google Update (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc [2010-02-04 135664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3439b808-2023-11dd-9f3c-000b6a289b1d}]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4197c8d6-d9ba-11dd-a02b-000b6a289b1d}]
\Shell\AutoRun\command - F:\d1vmq.exe
\Shell\open\Command - F:\d1vmq.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{592e8a2f-9c44-11de-a135-000b6a289b1d}]
\Shell\AutoRun\command - F:\d1vmq.exe
\Shell\open\Command - F:\d1vmq.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e4cc67c-8c1e-11de-a118-000b6a289b1d}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72ba7372-c91d-11de-a171-000b6a289b1d}]
\Shell\AutoRun\command - F:\d1vmq.exe
\Shell\open\Command - F:\d1vmq.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73bd4bda-6572-11de-a0e2-000b6a289b1d}]
\Shell\AutoRun\command - F:\d1vmq.exe
\Shell\open\Command - F:\d1vmq.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{783baaa6-1a13-11df-a1ef-000b6a289b1d}]
\Shell\AutoRun\command - G:\EXPLORER.EXE
\Shell\explore\Command - G:\EXPLORER.EXE
\Shell\open\Command - G:\EXPLORER.EXE
.
Contenu du dossier 'Tâches planifiées'

2010-03-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 08:12]

2010-03-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 08:12]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
HKCU-Run-asr64_ldm.exe - c:\docume~1\rodon\LOCALS~1\Temp\asr64_ldm.exe
HKCU-Run-Dr. Guard - c:\program files\Dr. Guard\drguard.exe
HKCU-Run-wsctf.exe - wsctf.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
HKLM-Run-NWEReboot - (no file)


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
uInternet Connection Wizard,ShellNext = iexplore
IE: Easy-WebPrint Ajouter à la Liste à Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

c:\windows\system32\mfc42.dll - c:\windows\system32\msvcrt.dll
c:\windows\system32\olepro32.dll
c:\windows\Downloaded Program Files\TeleTVA.ocx
O16 -: {A06BE318-C096-11D4-964F-0010A4D06F69}
hxxps://tva.dgi.minefi.gouv.fr/activeX/TeleTVA.tva
c:\windows\Downloaded Program Files\teletva.inf
FF - ProfilePath - c:\documents and settings\rodon\Application Data\Mozilla\Firefox\Profiles\u8q1srcq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - plugin: c:\documents and settings\rodon\Application Data\Mozilla\Firefox\Profiles\u8q1srcq.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-07 18:35:28
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\???/??[???????[???[???????????????????[???[?C?????[$??????[????????????S??[????????m??[???w????(???{??w???w???????w???w???[????????d???b6?[%??[???[????"??[A??[???[.??wZ??[?3?[?3?[????st.I?????? [????d???0=?[?K?[

Recherche de fichiers cachés ...


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\_VOIDd.sys]
"imagepath"="\systemroot\system32\drivers\_VOIDqjxtqwwywm.sys"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(224)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2010-03-07 18:37:38
ComboFix-quarantined-files.txt 2010-03-07 17:36:22

Avant-CF: 139 783 032 832 octets libres
Après-CF: 139,821,563,904 octets libres

198 --- E O F --- 2010-03-06 21:34:53
0
Réponse 19 / 39
Arno
8 mars 2010 à 12:46
Merci à vous deux.
J'ai installé Antivir, j'ai lancé windows en mode sans échec, j'ai lancé une analyse par Antivir, il m'a trouvé 210 fichiers infectés. Après les avoir mis en quarantaine, et relancé windows en mode normal, il semble que tout aille mieux.
Antivir qui ne se lançait pas avant en mode normal au démarrage de windows, marche enfin, je l'ai mis à jour et relancé un scan, il m'a retrouvé une trentaine de fichiers infectés.
Avant au démarrage du bureau de windows, une fois sur deux ça se figeait. Là je n'ai plus ce problème.
Je vais désaciver et réactiver la restauration du système pour nettoyer une dernière fois, et j'espère que ça ira.
Si vous avez encore des infos, je suis preneur, car au point où le pc était infecté il peut surement resté des merdes.
Merci.
0
Réponse 20 / 39
benurrr Messages postés 9643 Date d'inscription samedi 24 mai 2008 Statut Contributeur sécurité Dernière intervention 11 janvier 2012 107
8 mars 2010 à 12:51
bonjour

fait se que jlpjlp,et après en voit avec combofix car tu a des trace de rootkit au premier passage
0

Discussions similaires

Musique Générique Dr House
Tekalex -
bloodist -

28 réponses
Musique Générique Dr.House
pitchounou38 -
vincent -

4 réponses
Quelle est la musique du generique: Dr House
Gogodam -
ekirafa -

1 réponse
Musique de fond Dr House
Claire -
Amanoine -

8 réponses
DR HOUSE SAISON 1 ET 2 SVP SVP
julie59610 -
moska -

13 réponses