infecté par dr guard

Question

Bonjour,
apres que le logiciel dr guard ce soit installer automatiquement sur mon ordi me demandant un tas de truc now ma machine affiche un ecran bleu au demarrage some one to help me!!!!!

truecode · Answer

Bonjour,

Si tu arrive a accéder a ton bureau réalise cela : 

•Téléchargez Process Explorer (renommé) http://www3.malekal.com/hihi.exe sur votre bureau. 
•Double-cliquez dessus pour le lancer. 
•Dans la fenêtre cherchez le programme Dr.Guard. 
•Cliquez-droit dessus et tuez le processus et tous ses composants.

Puis : 


•Télécharge Malwarebytes' Anti-Malware (MBAM) http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Avant tous il faut brancher tous les supports amovibles que tu possède avant de faire ce scan ( disque dur externes , clé usb ... )

•Double clique sur le fichier téléchargé
•Dans l'onglet "Mise à jour", clique sur "Recherche de mise à jour": si ton parefeu te demande de d'autoriser MBAM accepte
•Quand la mise à jour est terminé va dans l'onglet
•Tu sélectionne "Exécuter un examen complet"
•Puis tu clique sur"Rechercher"

L'analyse démarre, le scan est relativement long, c'est normal.

A la fin de l'analyse, un message s'affiche :

•L'examen s'est terminé normalement. Il te reste a cliquer sur"Afficher les résultats" pour afficher tous les objets trouvés.
•Maintenant tu clique sur "Ok" pour poursuivre.
•Ferme tes navigateurs ( firefox , internet explorer , chrome , opéra...)
•Si MBAM à détecter des malwares, clique sur "Afficher les résultats".
•Sélectionne tout et clique sur"Supprimer la sélection",MBAM va supprimer tous les fichiers infectés.
•Le Bloc-notes va s'ouvrir avec le rapport d'analyse
•Fais un copier coller de ce rapport etposte-le dans ton prochain message.

hasmoul · Answer

est ce que cela est fesable en mode sans echec par ce que je n'arrive pas a avoir acces a mon bureau en mode normal merci de ta reponse

truecode · Answer

Réalise le scan avec malware bytes en mode sans echec avec prise en charge du réseau si tu peux , sinon il faudra télécharger l'utilitaire via un autre pc ainsi que cette  mise a jour  : http://www.malwarebytes.org/mbam/database/mbam-rules.exe

Voici le tuto pour mettre la mise a jour hors ligne : https://www.donnemoilinfo.com/sujet/Astuce/maj-malwarebytes.php

hasmoul · Answer

merci je vais l'essayer et je te tiens informé

hasmoul · Answer

voici le rapport de malwarebytes
Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3740
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

11/03/2010 11:01:03
mbam-log-2010-03-11 (11-01-03).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 158243
Temps écoulé: 17 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 13

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\_VOID (Rootkit.TDSS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom (Trojan.Patched) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\igfxtray (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\persistence (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\igfxtray.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\NS3E.tmp (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\NS4.tmp (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\_VOID7933.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\_VOIDc25f.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\_VOIDc74d.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\cdrom.sys (Trojan.Patched) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\cdrom.sys (Trojan.Patched) -> Quarantined and deleted successfully.
C:\WINDOWS\logfile32.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Archivos de programa\Internet Explorer\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\csrss.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Jordi\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
merci

hasmoul · Answer

voici le rapport de malwarebytes
Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3740
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

11/03/2010 11:01:03
mbam-log-2010-03-11 (11-01-03).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 158243
Temps écoulé: 17 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 13

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\_VOID (Rootkit.TDSS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom (Trojan.Patched) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\igfxtray (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\persistence (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\igfxtray.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\NS3E.tmp (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\NS4.tmp (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\_VOID7933.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\_VOIDc25f.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\_VOIDc74d.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\cdrom.sys (Trojan.Patched) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\cdrom.sys (Trojan.Patched) -> Quarantined and deleted successfully.
C:\WINDOWS\logfile32.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\Configuración local\Temp\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Archivos de programa\Internet Explorer\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordi\csrss.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Jordi\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.

hasmoul · Answer

que dois je faire maintenat?

truecode · Answer

Tu arrive a redémarrer en mode normal ?

hasmoul · Answer

j'utilise avast donc au demarage il a lancé un scan je suis dans l'attente de la fin du scan.
Et le rapport qu'est ce que tu en penses??

hasmoul · Answer

au demarage jai un programe (antivirus xp 2010 unregistered version) qui se lance automatiquement et scan mes fichiers puis me demende d'enregister le programme mais je n'ai aucune icones sur le bureau il est completement vide, je ne peux pas faire de ctrl alt supr ni avoir acces a ma base de registre non plus

truecode · Answer

Alors fais cela : 

Désactivez votre antivirus le temps de la manipulation ainsi que votre pare-feu si présent (car l'outil est détecté à tort comme infection). 

Téléchargez et installez List&Kill'em et enregistrez le sur votre bureau. 

http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe 


Branchez clés usb, disques durs externes, mp3, mp4, etc à votre ordinateur. 

Double-cliquez (clic-droit "Exécuter en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur votre bureau pour lancer l'installation. 

Cochez la case "Créer une icône sur le bureau". 

Une fois terminé, cliquez sur "Terminer" et le programme se lancera tout seul. 

Choisissez la langue puis choisissez l'option 1 = Mode Recherche. 
Laissez travailler l'outil. 

A l'apparition de la fenêtre blanche - c'est un peu long mais c'est normal le programme n'est pas bloqué - un rapport du nom de catchme apparait sur votre bureau. Ignorez-le, ne le postez pas, mais ne le supprimez pas pour l'instant, le scan n'est pas fini. 

Postez le contenu du rapport qui s'ouvre aux 100 % du scan à l'écran "COMPLETED"

Utilisateur anonyme · Answer

bonjour trucode ,
désolé pour cette intrusion !

@ Hasmoul : 

tu as déjà 4 topics en cours : 
https://forums.commentcamarche.net/forum/s/u/hasmoul?forum_num=7

términe ta désinfection ici, je demande la suppression des autres 
Merci à toi

truecode · Answer

Bonjour Electricien 69,

Merci pour cette intrusion bien au contraire .

hasmoul · Answer

oups desoler j'ai bien fait e que tu m'as dis et voila le resultat de kill'em
aList'em by g3n-h@ckm@n 1.3.2.1

User : Administrador () 
Update on 10/03/2010 by g3n-h@ckm@n ::::: 17.30
Start at: 11:12:19 | 11/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

         Intel(R) Atom(TM) CPU N270   @ 1.60GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Dr. Guard 1.0 [ Enabled | (!) Outdated ]
AV : avast! antivirus 4.8.1368 [VPS 100310-1] 4.8.1368 [ Enabled | Updated ]

C:\ -> Disco fijo local | 122,74 Go (111 Go free) [BOOT] | NTFS
D:\ -> Disco fijo local | 26,29 Go (22,79 Go free) [RECOVER] | FAT32
E:\ -> Disco extraíble | 7,46 Go (7,15 Go free) [ELY] | FAT32
 
Boot: Safeboot 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\Archivos de programa\List_Kill'em\FxEx.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Archivos de programa\List_Kill'em\pv.exe

======================
Keys "Run" 
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE	REG_SZ         	C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
HotKeysCmds	REG_SZ         	C:\WINDOWS\system32\hkcmd.exe 
RTHDCPL	REG_SZ         	RTHDCPL.EXE 
Alcmtr	REG_SZ         	ALCMTR.EXE 
SynTPEnh	REG_SZ         	C:\Archivos de programa\Synaptics\SynTP\SynTPEnh.exe 
Adobe Reader Speed Launcher	REG_SZ         	"C:\Archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
RemoteControl	REG_SZ         	"C:\Archivos de programa\HomeCinema\PowerDVD\PDVDServ.exe" 
LanguageShortcut	REG_SZ         	"C:\Archivos de programa\HomeCinema\PowerDVD\Language\Language.exe" 
UCam_Menu	REG_SZ         	"C:\Archivos de programa\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Archivos de programa\HomeCinema\YouCam" update "Software\CyberLink\YouCam\1.0" 
SunJavaUpdateSched	REG_SZ         	"C:\Archivos de programa\Java\jre1.6.0_05\bin\jusched.exe" 
MGSysCtrl	REG_SZ         	C:\Archivos de programa\System Control Manager\MGSysCtrl.exe 
QuickFinder Scheduler	REG_SZ         	"C:\Archivos de programa\WordPerfect Office X3\Programs\QFSCHD130.EXE" 
Google Desktop Search	REG_SZ         	"C:\Archivos de programa\Google\Google Desktop Search\GoogleDesktop.exe" /startup 
toolbar_eula_launcher	REG_SZ         	C:\Program Files\GoogleEULA\EULALauncher.exe 
avast!	REG_SZ         	C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe 
iPrint Tray	REG_SZ         	C:\WINDOWS\system32\iprntctl.exe TRAY_ICON 
iPrint Event Monitor	REG_SZ         	C:\WINDOWS\system32\iprntlgn.exe 
SyncMan	REG_SZ         	C:\WINDOWS\system32\SyncMan.exe 
Malwarebytes Anti-Malware (reboot)	REG_SZ         	"C:\Archivos de programa\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
Malwarebytes' Anti-Malware	REG_SZ         	C:\Archivos de programa\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
DisableTaskMgr	REG_DWORD      	0 (0x0) 

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	REG_DWORD      	145 (0x91) 

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
HonorAutoRunSetting	REG_DWORD      	1 (0x1) 

=============== 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS	REG_SZ         	C:\ARCHIV~1\Google\GOOGLE~2\GOEC62~1.DLL

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 AutoRestartShell	REG_DWORD      	1 (0x1) 
 DefaultDomainName	REG_SZ         	JORDIMINI 
 DefaultUserName	REG_SZ         	Jordi 
 LegalNoticeCaption	REG_SZ         	 
 LegalNoticeText	REG_SZ         	 
 PowerdownAfterShutdown	REG_SZ         	0 
 ReportBootOk	REG_SZ         	1 
 Shell	REG_SZ         	Explorer.exe 
 ShutdownWithoutLogon	REG_SZ         	0 
 System	REG_SZ         	 
 Userinit	REG_SZ         	C:\WINDOWS\system32\userinit.exe, 
 VmApplet	REG_SZ         	rundll32 shell32,Control_RunDLL "sysdm.cpl" 
 SfcQuota	REG_DWORD      	-1 (0xffffffff) 
 allocatecdroms	REG_SZ         	0 
 allocatedasd	REG_SZ         	0 
 allocatefloppies	REG_SZ         	0 
 cachedlogonscount	REG_SZ         	10 
 forceunlocklogon	REG_DWORD      	0 (0x0) 
 passwordexpirywarning	REG_DWORD      	14 (0xe) 
 scremoveoption	REG_SZ         	0 
 AllowMultipleTSSessions	REG_DWORD      	1 (0x1) 
 UIHost	REG_EXPAND_SZ  	logonui.exe 
 LogonType	REG_DWORD      	1 (0x1) 
 Background	REG_SZ         	0 0 0 
 DebugServerCommand	REG_SZ         	no 
 SFCDisable	REG_DWORD      	0 (0x0) 
 WinStationsDisabled	REG_SZ         	0 
 HibernationPreviouslyEnabled	REG_DWORD      	1 (0x1) 
 ShowLogonOptions	REG_DWORD      	0 (0x0) 
 AltDefaultUserName	REG_SZ         	Administrador 
 AltDefaultDomainName	REG_SZ         	JORDIMINI 
 Taskman	REG_SZ         	C:\Documents and Settings\Jordi\csrss.exe 

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\igfxcui]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify	ermsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 
{56F9679E-7826-4C84-81F3-532071A8BCC5}	REG_SZ         	 

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Archivos de programa\Windows Live\Messenger\livecall.exe	REG_SZ         	C:\Archivos de programa\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)
C:\WINDOWS\system32\usmt\migwiz.exe	REG_SZ         	C:\WINDOWS\system32\usmt\migwiz.exe:*:Disabled:Asistente para transferencia de archivos y configuraciones
C:\Archivos de programa\VoipCheap.co.uk\VoipCheap\VoipCheap.exe	REG_SZ         	C:\Archivos de programa\VoipCheap.co.uk\VoipCheap\VoipCheap.exe:*:Enabled:VoipCheap
C:\Archivos de programa\Skype\Plugin Manager\skypePM.exe	REG_SZ         	C:\Archivos de programa\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
C:\Archivos de programa\Skype\Phone\Skype.exe	REG_SZ         	C:\Archivos de programa\Skype\Phone\Skype.exe:*:Enabled:Skype

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Archivos de programa\Windows Live\Messenger\livecall.exe	REG_SZ         	C:\Archivos de programa\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)

===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{405C32CF-9C6F-49B3-9436-3F5FDBE7B3CE}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{83169D43-4660-4347-BC95-E9D6E6BE65CE}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}]

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

===
DNS
===

HKLM\SYSTEM\CS3\Services\Tcpip\..\{DFEB9648-1833-4EFD-9A2D-72D2BC257841}: DhcpNameServer=196.200.57.6 196.200.57.7 
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=196.200.57.6 196.200.57.7 

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	http://www.medion.com

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Archivos de programa\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win 2000_SP2   : ff953a8f08ca3f822127654375786bbe
Win XP_32b     : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b      : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b  : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b  : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b  : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b  : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b  : 02062C0B390B7729EDC9E69C680A6F3C
 
=======
Drive :
=======

Desfragmentador de disco de Windows
Copyright (c)2001 Microsoft Corp. y Executive Software International Inc.

Informe del an lisis              	 
    123 GB Total,  111 GB (90%) Libre,  6% Fragmentado (12% fragmentaci¢n de fichero)

Este volumen no necesita desfragmentaci¢n. 	 

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Archivos de programa\AskBarDis  
Present !! : C:\Archivos de programa\Dr. Guard  
Present !! : C:\WINDOWS\SET3.tmp  
Present !! : C:\WINDOWS\SET4.tmp  
Present !! : C:\WINDOWS\SET8.tmp  
Present !! : C:\WINDOWS\Tasks\At1.job  
Present !! : C:\WINDOWS\Tasks\At2.job  
Present !! : C:\WINDOWS\Tasks\At3.job  
Present !! : C:\WINDOWS\Tasks\At4.job  
Present !! : C:\WINDOWS\Tasks\At5.job  
Present !! : C:\WINDOWS\Tasks\At6.job  
Present !! : C:\WINDOWS\Tasks\At7.job  
Present !! : C:\WINDOWS\Tasks\At8.job  
Present !! : C:\WINDOWS\Tasks\At9.job  
Present !! : C:\WINDOWS\Tasks\At1.job  
Present !! : C:\WINDOWS\Tasks\At10.job  
Present !! : C:\WINDOWS\Tasks\At11.job  
Present !! : C:\WINDOWS\Tasks\At12.job  
Present !! : C:\WINDOWS\Tasks\At13.job  
Present !! : C:\WINDOWS\Tasks\At14.job  
Present !! : C:\WINDOWS\Tasks\At15.job  
Present !! : C:\WINDOWS\Tasks\At16.job  
Present !! : C:\WINDOWS\Tasks\At17.job  
Present !! : C:\WINDOWS\Tasks\At18.job  
Present !! : C:\WINDOWS\Tasks\At19.job  
Present !! : C:\WINDOWS\Tasks\At2.job  
Present !! : C:\WINDOWS\Tasks\At20.job  
Present !! : C:\WINDOWS\Tasks\At21.job  
Present !! : C:\WINDOWS\Tasks\At22.job  
Present !! : C:\WINDOWS\Tasks\At23.job  
Present !! : C:\WINDOWS\Tasks\At24.job  
Present !! : C:\WINDOWS\Tasks\At3.job  
Present !! : C:\WINDOWS\Tasks\At4.job  
Present !! : C:\WINDOWS\Tasks\At5.job  
Present !! : C:\WINDOWS\Tasks\At6.job  
Present !! : C:\WINDOWS\Tasks\At7.job  
Present !! : C:\WINDOWS\Tasks\At8.job  
Present !! : C:\WINDOWS\Tasks\At9.job  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Present !! : "HKCU\SOFTWARE\Dr. Guard"  
Present !! : "HKLM\SOFTWARE\Dr. Guard"  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}"  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dr. guard"  
Present !! : HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}  
Present !! : HKCR\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}  
Present !! : HKCR\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}  
Present !! : HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}  
Present !! : HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}  
Present !! : HKLM\Software\Classes\CLSID\{201F27D4-3704-41D6-89C1-AA35E39143ED}  
Present !! : HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
Present !! : HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}  
Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}  
Present !! : HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}  
Present !! : HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}  
Present !! : HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}  

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 11:22:59
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 
kernel: MBR read successfully
user & kernel MBR OK 

 
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials 
 
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 11:23:20,56

truecode · Answer

REDEMARRE EN MODE SANS ECHEC 

&#9654; Relance List&Kill'em  (clic droit pour vista), 

mais cette fois-ci : 

&#9654; choisis l'option 2 = Mode Destruction 

laisse travailler l'outil 

apres les verifications , un rapport va s'ouvrir. 

&#9654; ferme-le. 

un deuxieme rapport va s'ouvrir , 

&#9654; colle son contenu dans ta reponse apres avoir redemarré en mode normal

hasmoul · Answer

merci ca marche

Infecté par dr guard

16 réponses

Discussions similaires

Newsletters