Sujet Précédent Sujet Suivant

Internet Explorer, page de démarrage modifiée

Fermé
patapock - 16 mars 2010 à 15:31
 Utilisateur anonyme - 21 mars 2010 à 12:58
Bonjour,

Je suis sous Windows 2000
Lorsque je lance Internet explorer, la page de démarrage est changée et pointe vers une adresse de type:
http://195.225.176.14

si dans option Internet, je change l'adresse pour mettons" www.google.fr", appliquer et Ok, c'est bien cette page qui devient ma page de demarrage, mais si je reboote mon PC, c'est reparti comme avant.

j'ai lancé spybot et ccleaner (y compris en mode sans echec), rien y fait
J'ai également lancé hijackthis en mode sans echec et supprimé les lignes:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://195.225.176.14/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://195.225.176.14/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.225.176.14/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://195.225.176.14/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://195.225.176.14/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/

ainsi que:
O13 - DefaultPrefix: http://195.225.176.14/pre.pl?
O13 - WWW Prefix: http://195.225.176.14/pre.pl?

mais au redémarrage, même problème. suis perdu. Voici le log complet de Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:41:42, on 16/03/2010
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\monitor.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://195.225.176.14/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.14/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://195.225.176.14/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.225.176.14/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://195.225.176.14/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://195.225.176.14/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.14/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe monitor.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [Goldensoft_MndlSvr] C:\PROGRA~1\GOLDEN~1\CDGHOS~1\MndlSvr.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [monitor] Explorer.exe monitor.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PPS32Tray.lnk = C:\Program Files\PPS32\PPS32Tray.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - DefaultPrefix: http://195.225.176.14/pre.pl?
O13 - WWW Prefix: http://195.225.176.14/pre.pl?
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
A voir également:

30 réponses

  • 1
  • 2
Réponse 1 / 30
Utilisateur anonyme
16 mars 2010 à 15:35
salut :

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

▶ Télécharge List_Kill'em et enregistre le sur ton bureau

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis choisis l'option Search

un icone blanc et noir va s'afficher sur le bureau , il te servira à rappeler le programme si besoin.

▶ laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"


0
Réponse 2 / 30
patapock
16 mars 2010 à 15:48
Salut gen-hackman

merci pour cette réponse ultra rapide. Je fais ta manip en fin d'apres midi (suis au bureau)

je suis pas sous Win 7 ou Vista, mais sous ce vieux Windows 2000. 

clic droit "executer en tant qu'administrateur"
marche sous cet OS?
0
Réponse 3 / 30
Utilisateur anonyme
16 mars 2010 à 15:49
double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 )
0
Réponse 4 / 30
patapock
16 mars 2010 à 17:11
voici le log genere en fin de scan:

List'em by g3n-h@ckm@n 1.5.0.1

User : Wischlen (Administrateurs)
Update on 16/03/2010 by g3n-h@ckm@n ::::: 15.00
Start at: 16:34:05 | 16/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) XP 2400+
Microsoft Windows 2000 Professionnel (5.0.2195 32-bit) # Service Pack 4
Internet Explorer 6.0.2800.1106
Windows Firewall Status : Enabled

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 74,52 Go (1,22 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible | 14,8 Go (7,92 Go free) [CORSAIR] | FAT32

Boot: Normal


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hidserv.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\stisvc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\mspmspsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\monitor.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\PROGRA~1\GOLDEN~1\CDGHOS~1\MndlSvr.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\internat.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\PPS32\PPS32Tray.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
internat.exe REG_SZ internat.exe
ATI Launchpad REG_SZ
WebCamRT.exe REG_SZ
monitor REG_SZ Explorer.exe monitor.exe
Picasa Media Detector REG_SZ C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Synchronization Manager REG_SZ mobsync.exe /logon
pccguide.exe REG_SZ "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
PCCClient.exe REG_SZ "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
Pop3trap.exe REG_SZ "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
Goldensoft_MndlSvr REG_SZ C:\PROGRA~1\GOLDEN~1\CDGHOS~1\MndlSvr.exe
ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
NeroCheck REG_SZ C:\WINDOWS\system32\\NeroCheck.exe
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 0 (0x0)
CDRAutoRun REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ PC
DefaultUserName REG_SZ wischlen
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe monitor.exe
ShutdownWithoutLogon REG_SZ 1
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AutoAdminLogon REG_SZ 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
ShowLogonOptions REG_DWORD 1 (0x1)
AltDefaultUserName REG_SZ wischlen
AltDefaultDomainName REG_SZ PC
BufferPolicyReads REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wzcnotif]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\DirectAnimation Java Classes]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{02f78298-8af6-495c-9ecb-b6ae68678186}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{03F998B2-0E00-11D3-A498-00104B6EB52E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{04d6265d-6b5d-41c3-9e7c-48be15919643}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08a00762-7c1e-42c2-87f0-ca3600045cd7}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0fde1f56-0d59-4fd7-9624-e3df6b419d0e}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0fde1f56-0d59-4fd7-9624-e3df6b419d0f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{110e3a85-a9d6-4220-a14a-d39588fa4763}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1b0357b8-e3fb-4918-915c-a8eb232c273e}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1d939273-21ce-4e7f-be14-490866ec66c2}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1F328542-A57F-4B24-844A-4984487EF03D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2298d453-bcae-4519-bf33-1cbf3faf1524}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2337076a-dd0c-43a6-8d85-54070578a42f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28023b22-f71e-43e8-8ea4-de315462878d}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2cc9d512-6db6-4f1c-8979-9a41fae88de0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3c0d61fe-1db3-4d0b-8477-3cb53eab9469}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3e7bb08a-a7a3-4692-8eac-ac5e7895755b}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3e843540-63b3-42d7-9f4d-812ffd1e767a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4d64f3ba-f112-4efe-a02e-96680859937c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4fbff6eb-7540-4f56-a35e-50ff06f9d941}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5c9ff2bf-938d-47fe-85d9-9dbab4f65018}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5f3c70b3-ac2f-432c-8f9c-1624df61f54f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{685e3910-1f77-49b9-9434-50bcd95c51ab}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{689e5762-8d75-4346-90cf-bc1902c32d63}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6A5110B5-E14B-4268-A065-EF89FF33C325}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{795d0712-722c-43ec-906a-fc5e678eada9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{79844cfb-ac65-4e10-a06a-c974234f40d0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{80b81c71-14cd-41c3-9e8c-08b9e06d02ef}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{82ced0ff-a00d-4405-ba5f-ef4699159333}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{839117ee-2132-4bae-a56a-42b50204c9b9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8ade8c02-8da6-4ec1-a9ee-ec00ff73ce98}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{90b0bef8-22d6-40a8-92c8-155434fc112f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9311e53c-4c8c-4b8f-aa80-6b16de179d70}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{95177e6d-aaa9-44d1-bebd-b380bce3be79}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A00BF2EB-56EE-4fde-B5EA-6A8FA425B2A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{a5653fdf-8d3a-451b-937f-6c7534804953}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{a99b636e-f3ca-4adc-bcde-a4b451cd65d4}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{abd13515-07e0-476a-9b25-211dbe6d1c21}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ae594d5e-dd07-4e54-8252-daa5aebbd4ec}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{b6609c7e-4ad5-4b8b-9da5-9edbc50f7592}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{c1f0071f-505e-40bc-babe-3240af80b5cf}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{da53c936-c804-4f62-a1d2-6cf6d1591b66}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{dc0d5f50-5f0b-46bf-8683-93ac61c67001}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{dd772a76-bef3-44d7-8b39-502c8504c1f1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{e41091c0-06d5-474f-836e-dd190348ea18}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{eb6ab742-eb17-446b-8ce7-dff2bc7cbf93}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{eddbec60-89cb-44ef-8291-0850fd28ff6a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f156e5b2-f52e-4094-800c-e7392fe62314}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f15ee071-deb7-4cbb-951f-431c98338d8e}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f351bc8e-a11b-44ba-a436-cee0d27e3abb}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f3d9c2d1-579f-4d41-95ba-5354eeb398d0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f4de1058-dafc-4d16-b294-6ea1125bf3d3}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f5173cf0-1dfb-4978-8e50-a90169ee7ca9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f54910c7-a2f3-4ca4-81b2-4a43a5e2680a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5776D81-AE53-4935-8E84-B0B283D8BCEF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{fd4aedf6-1163-4f9c-bbf2-11aec5b873b0}]

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3BBCD1BF-307E-44C2-8400-0A1D42E34FBF}: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3BBCD1BF-307E-44C2-8400-0A1D42E34FBF}: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3BBCD1BF-307E-44C2-8400-0A1D42E34FBF}: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=213.166.201.1 213.166.201.2

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://195.225.176.14/

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://195.225.176.14/

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]


=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
##
86672,8c718aa8c77041b3285d55a0ce980867,57c342b828f192374085c57756cb1286cbb60450c01051c45128839553f60138,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
##
86672,8c718aa8c77041b3285d55a0ce980867,57c342b828f192374085c57756cb1286cbb60450c01051c45128839553f60138,C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======


¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Present !! : C:\Program Files\MSN Messenger\riched20.dll
Present !! : C:\WINDOWS\SET38.tmp
Present !! : C:\WINDOWS\SET74.tmp
Present !! : C:\WINDOWS\_delis32.ini
Present !! : C:\WINDOWS\inf\nt5java.inf
Present !! : C:\WINDOWS\iun6002.exe
Present !! : C:\WINDOWS\System32\drivers\Sonyhcp.dll"
Present !! : C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\Administrateur\Application Data\Hotbar

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NeroCheck
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_IPRIP
Present !! : HKLM\SYSTEM\ControlSet001\Services\Iprip
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_IPRIP
Present !! : HKLM\SYSTEM\ControlSet002\Services\Iprip
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_IPRIP
Present !! : HKLM\SYSTEM\CurrentControlSet\Services\Iprip

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-16 16:41:39
Windows 5.0.2195 Service Pack 4 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK


¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Program Files\Trend Micro\PC-cillin 2002\Patch.exe




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 16:41:50,09
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 30
Utilisateur anonyme
16 mars 2010 à 22:10
▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :

▶ choisis l'option clean

ton PC va redemarrer,

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

▶ colle le contenu dans ta reponse
0
Réponse 6 / 30
patapock
17 mars 2010 à 08:40
Oups ! suis bloqué

Quand je clique sur "clean" une fenêtre Dos s'ouvre et dit:

'shutdown.exe' n'est pas reconnu en tant que commande interne ou externe, un programme excecutable ou un fichier de commande
C:\Program Files\List_Kill'em

je re-demarre le PC par la manière classique et une fois Windows 2000 lancé, j'ai une fenêtre d'erreur qui dit:

"Le ficher C:\Program Files\List_Kill'em\del_reg.bat (ou un de ses composants est introuvable
Verifiez que le chemin et le nom de fichier sont corrects et que les bibliotèques requises sont disponibles

P.S. Le log que j'ai précdement post est le contenu du fichier "Kill'em.txt" généré lors du "search"
apres "clean", c'est un autre fichier "Kill'em.txt" ?
0
Réponse 7 / 30
Utilisateur anonyme
17 mars 2010 à 08:52
ok execute ce debugger :

http://sd-1.archive-host.com/membres/up/829108531491024/debug.bat
0
Réponse 8 / 30
patapock
17 mars 2010 à 11:10
Ok, j'ai exécuté le debugger
le fichier texte généré dit cici:

List'em by g3n-h@ckm@n 1.5.0.1

User : Wischlen (Administrateurs)
Update on 16/03/2010 by g3n-h@ckm@n ::::: 15.00
Start at: 10:31:21 | 17/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) XP 2400+
Microsoft Windows 2000 Professionnel (5.0.2195 32-bit) # Service Pack 4
Internet Explorer 6.0.2800.1106
Windows Firewall Status : Enabled

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 74,52 Go (1,22 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible | 14,8 Go (7,92 Go free) [CORSAIR] | FAT32

Boot: Normal


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hidserv.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\stisvc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\mspmspsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\PROGRA~1\GOLDEN~1\CDGHOS~1\MndlSvr.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\internat.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\PPS32\PPS32Tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
internat.exe REG_SZ internat.exe
ATI Launchpad REG_SZ
WebCamRT.exe REG_SZ
monitor REG_SZ Explorer.exe monitor.exe
Picasa Media Detector REG_SZ C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Synchronization Manager REG_SZ mobsync.exe /logon
pccguide.exe REG_SZ "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
PCCClient.exe REG_SZ "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
Pop3trap.exe REG_SZ "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
Goldensoft_MndlSvr REG_SZ C:\PROGRA~1\GOLDEN~1\CDGHOS~1\MndlSvr.exe
ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
NeroCheck REG_SZ C:\WINDOWS\system32\\NeroCheck.exe
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 0 (0x0)
CDRAutoRun REG_DWORD 0 (0x0)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ PC
DefaultUserName REG_SZ wischlen
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe monitor.exe
ShutdownWithoutLogon REG_SZ 1
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AutoAdminLogon REG_SZ 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
ShowLogonOptions REG_DWORD 1 (0x1)
AltDefaultUserName REG_SZ wischlen
AltDefaultDomainName REG_SZ PC
BufferPolicyReads REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wzcnotif]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\DirectAnimation Java Classes]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{02f78298-8af6-495c-9ecb-b6ae68678186}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{03F998B2-0E00-11D3-A498-00104B6EB52E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{04d6265d-6b5d-41c3-9e7c-48be15919643}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08a00762-7c1e-42c2-87f0-ca3600045cd7}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0fde1f56-0d59-4fd7-9624-e3df6b419d0e}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0fde1f56-0d59-4fd7-9624-e3df6b419d0f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{110e3a85-a9d6-4220-a14a-d39588fa4763}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1b0357b8-e3fb-4918-915c-a8eb232c273e}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1d939273-21ce-4e7f-be14-490866ec66c2}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1F328542-A57F-4B24-844A-4984487EF03D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2298d453-bcae-4519-bf33-1cbf3faf1524}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2337076a-dd0c-43a6-8d85-54070578a42f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28023b22-f71e-43e8-8ea4-de315462878d}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2cc9d512-6db6-4f1c-8979-9a41fae88de0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3c0d61fe-1db3-4d0b-8477-3cb53eab9469}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3e7bb08a-a7a3-4692-8eac-ac5e7895755b}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3e843540-63b3-42d7-9f4d-812ffd1e767a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4d64f3ba-f112-4efe-a02e-96680859937c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4fbff6eb-7540-4f56-a35e-50ff06f9d941}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5c9ff2bf-938d-47fe-85d9-9dbab4f65018}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5f3c70b3-ac2f-432c-8f9c-1624df61f54f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{685e3910-1f77-49b9-9434-50bcd95c51ab}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{689e5762-8d75-4346-90cf-bc1902c32d63}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6A5110B5-E14B-4268-A065-EF89FF33C325}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{795d0712-722c-43ec-906a-fc5e678eada9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{79844cfb-ac65-4e10-a06a-c974234f40d0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{80b81c71-14cd-41c3-9e8c-08b9e06d02ef}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{82ced0ff-a00d-4405-ba5f-ef4699159333}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{839117ee-2132-4bae-a56a-42b50204c9b9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8ade8c02-8da6-4ec1-a9ee-ec00ff73ce98}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{90b0bef8-22d6-40a8-92c8-155434fc112f}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9311e53c-4c8c-4b8f-aa80-6b16de179d70}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{95177e6d-aaa9-44d1-bebd-b380bce3be79}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A00BF2EB-56EE-4fde-B5EA-6A8FA425B2A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{a5653fdf-8d3a-451b-937f-6c7534804953}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{a99b636e-f3ca-4adc-bcde-a4b451cd65d4}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{abd13515-07e0-476a-9b25-211dbe6d1c21}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ae594d5e-dd07-4e54-8252-daa5aebbd4ec}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{b6609c7e-4ad5-4b8b-9da5-9edbc50f7592}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{c1f0071f-505e-40bc-babe-3240af80b5cf}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{da53c936-c804-4f62-a1d2-6cf6d1591b66}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{dc0d5f50-5f0b-46bf-8683-93ac61c67001}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{dd772a76-bef3-44d7-8b39-502c8504c1f1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{e41091c0-06d5-474f-836e-dd190348ea18}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{eb6ab742-eb17-446b-8ce7-dff2bc7cbf93}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{eddbec60-89cb-44ef-8291-0850fd28ff6a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f156e5b2-f52e-4094-800c-e7392fe62314}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f15ee071-deb7-4cbb-951f-431c98338d8e}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f351bc8e-a11b-44ba-a436-cee0d27e3abb}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f3d9c2d1-579f-4d41-95ba-5354eeb398d0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f4de1058-dafc-4d16-b294-6ea1125bf3d3}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f5173cf0-1dfb-4978-8e50-a90169ee7ca9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f54910c7-a2f3-4ca4-81b2-4a43a5e2680a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5776D81-AE53-4935-8E84-B0B283D8BCEF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{fd4aedf6-1163-4f9c-bbf2-11aec5b873b0}]

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3BBCD1BF-307E-44C2-8400-0A1D42E34FBF}: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3BBCD1BF-307E-44C2-8400-0A1D42E34FBF}: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3BBCD1BF-307E-44C2-8400-0A1D42E34FBF}: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=213.166.201.1 213.166.201.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=213.166.201.1 213.166.201.2

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://195.225.176.14/

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://195.225.176.14/

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]


=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
##
86672,8c718aa8c77041b3285d55a0ce980867,57c342b828f192374085c57756cb1286cbb60450c01051c45128839553f60138,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
##
86672,8c718aa8c77041b3285d55a0ce980867,57c342b828f192374085c57756cb1286cbb60450c01051c45128839553f60138,C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

=======
Drive :
=======


¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Present !! : C:\Program Files\MSN Messenger\riched20.dll
Present !! : C:\WINDOWS\SET38.tmp
Present !! : C:\WINDOWS\SET74.tmp
Present !! : C:\WINDOWS\_delis32.ini
Present !! : C:\WINDOWS\inf\nt5java.inf
Present !! : C:\WINDOWS\iun6002.exe
Present !! : C:\WINDOWS\System32\drivers\Sonyhcp.dll"
Present !! : C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\Administrateur\Application Data\Hotbar

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NeroCheck
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_IPRIP
Present !! : HKLM\SYSTEM\ControlSet001\Services\Iprip
Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_IPRIP
Present !! : HKLM\SYSTEM\ControlSet002\Services\Iprip
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_IPRIP
Present !! : HKLM\SYSTEM\CurrentControlSet\Services\Iprip

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 11:04:56
Windows 5.0.2195 Service Pack 4 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK


¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

C:\Program Files\Trend Micro\PC-cillin 2002\Patch.exe




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 11:05:10,40
0
Réponse 9 / 30
Utilisateur anonyme
17 mars 2010 à 11:17
ok

demarrer / executer , puis tape :

%ProgramFiles%\List_Kill'em\del_reg.bat

puis entrée
0
Réponse 10 / 30
patapock
17 mars 2010 à 12:25
Ca y est, je l'ai fait

j'ai éteint et redémarré le PC et lancé Internet explorer. Tout semble rentré dans l'ordre

Faut-il que je fasse d'autres opérations?

Au fait, mille merci de te pencher sur mon cas avec autant de patience, de rapidité et d'efficience. I apreciate.

ce Soft list_Kill'em semble formidable. Une de tes créations? pour quelles cas puis je l'utiliser (apprendre également) ?
0
Réponse 11 / 30
Utilisateur anonyme
17 mars 2010 à 13:28
c'est un outil encore assez generaliste que je m'efforce de recentrer sur les rogues et rootkits

il est mis a jour tous les jours , trois jours maxi

tu peux poster le rapport qui se trouve sur ton bureau du nom de Kill'em.txt ?
0
Réponse 12 / 30
patapock
17 mars 2010 à 17:21
Le voici:

Kill'em by g3n-h@ckm@n 1.5.0.1

User : Wischlen (Administrateurs)
Update on 16/03/2010 by g3n-h@ckm@n ::::: 15.00
Start at: 12:07:26 | 17/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) XP 2400+
Microsoft Windows 2000 Professionnel (5.0.2195 32-bit) # Service Pack 4
Internet Explorer 6.0.2800.1106
Windows Firewall Status : Enabled

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 74,52 Go (1,22 Go free) | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hidserv.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\stisvc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\mspmspsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\PROGRA~1\GOLDEN~1\CDGHOS~1\MndlSvr.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\internat.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\PPS32\PPS32Tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\pv.exe

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Quarantined & Deleted !! : C:\Program Files\MSN Messenger\riched20.dll
Quarantined & Deleted !! : C:\WINDOWS\SET38.tmp
Quarantined & Deleted !! : C:\WINDOWS\SET74.tmp
Quarantined & Deleted !! : C:\WINDOWS\_delis32.ini
Quarantined & Deleted !! : C:\WINDOWS\inf\nt5java.inf
Quarantined & Deleted !! : C:\WINDOWS\iun6002.exe

Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\Sonyhcp.dll
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
Quarantined & Deleted !! : C:\Documents and Settings\Administrateur\Application Data\Hotbar

==============
host file OK !
==============

========
Registry
========

Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NeroCheck
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_IPRIP
Deleted : HKLM\SYSTEM\ControlSet001\Services\Iprip
Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_IPRIP
Deleted : HKLM\SYSTEM\ControlSet002\Services\Iprip
========
Services
=========

Ndisuio : Start = 3
SharedAccess : Start = 3
wuauserv : Start = 2

============
Disk Cleaned
============

=================
anti-ver blaster : OK !!
=================

================
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
0
Réponse 13 / 30
Utilisateur anonyme
17 mars 2010 à 19:17
Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.



▶ Télécharge :

Malwarebytes

ou :

Malwarebytes

▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

▶ Potasses le Tuto pour te familiariser avec le prg :


( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

▶ Lance Malwarebyte's .

Fais un examen dit "Complet" .

▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

0
Réponse 14 / 30
patapock
17 mars 2010 à 23:02
ok, j'ai suivi ta procédure et redémarré le pc avant de récupérer le log de Malwarebyte que voici:

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 5.0.2195 Service Pack 4
Internet Explorer 6.0.2800.1106

17/03/2010 23:02:37
mbam-log-2010-03-17 (23-02-37).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 132165
Temps écoulé: 34 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Kill'em\Quarantine\riched20.dll.Kill'em (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
0
Réponse 15 / 30
Utilisateur anonyme
17 mars 2010 à 23:24
Télécharge OTL de OLDTimer

▶ enregistre le sur ton Bureau.

▶ Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.

▶ Coche les 2 cases Lop et Purity

▶ Coche la case devant scan all users

▶ règle-le sur "60 Days"

▶ dans la colonne de gauche , mets tout sur "all"

ne modifie pas ceci :

"files created whithin" et "files modified whithin"

▶Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.
0
Réponse 16 / 30
patapock
18 mars 2010 à 08:47
pour le fichier OLT.Txt, le lien est:

http://www.cijoint.fr/cjlink.php?file=cj201003/cijgRqKbRR.txt

Pour le fichier Extras.Txt:

http://www.cijoint.fr/cjlink.php?file=cj201003/cijdGdMUE3.txt
0
Réponse 17 / 30
Utilisateur anonyme
18 mars 2010 à 09:10
▶ Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Coche Afficher les fichiers et dossiers cachés
* - Décoche Masquer les extensions des fichiers dont le type est connu
* - Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)

▶ clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

* Clique sur Parcourir en haut, choisis Poste de travail et cherche ces fichiers :

C:\WINDOWS\system32\drivers\netdtect.sys
C:\WINDOWS\System32\GlmanadSn.sys
C:\WINDOWS\nSdanamlG.sys
C:\WINDOWS\System32\fpwpp.dll

* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
* Une nouvelle fenêtre de ton navigateur va apparaître
* Clique alors sur les deux fleches
* Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
* Enfin colle le résultat dans ta prochaine réponse.

Note : Pour analyser un autre fichier, clique en bas sur Autre fichier.

ensuite :

▶ clic droit "executer en tant qu'administrateur" sur OTL.exe pour le lancer.


▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous Customs Scans/Fixes :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
O4 - HKU\S-1-5-21-527237240-789336058-839522115-500..\Run: [ATI Launchpad] File not found
O4 - HKU\S-1-5-21-527237240-789336058-839522115-500..\Run: [WebCamRT.exe] File not found
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
@Alternate Data Stream - 9792 bytes -> C:\Documents and Settings\Administrateur\Mes documents\CIMG0258.JPG:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 9764 bytes -> C:\Documents and Settings\Administrateur\Mes documents\CIMG0263.JPG:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 7944 bytes -> C:\Documents and Settings\Administrateur\Mes documents\CIMG0257.JPG:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 7420 bytes -> C:\Documents and Settings\Administrateur\Mes documents\CIMG0264.JPG:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 5556 bytes -> C:\Documents and Settings\Administrateur\Mes documents\CIMG0260.JPG:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 5504 bytes -> C:\Documents and Settings\Administrateur\Mes documents\CIMG0261.JPG:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 5156 bytes -> C:\Documents and Settings\Administrateur\Mes documents\CIMG0262.JPG:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 4876 bytes -> C:\Documents and Settings\Administrateur\Mes documents\CIMG0259.JPG:Q30lsldxJoudresxAaaqpcawXc

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"=-
"QuickTime Task"=-

:Files
C:\Documents and Settings\Administrateur\Bureau\catchme.zip
C:\WINDOWS\info147.sys

:commands
[emptytemp]
[start explorer]
[reboot]


▶ Clique sur RunFix pour lancer la suppression.


▶ Poste le rapport.
0
Réponse 18 / 30
patapock
18 mars 2010 à 11:34
Le rapport OLT apres redémarrage est le suivant:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No actAntivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.03.18 -
AhnLab-V3 5.0.0.2 2010.03.18 -
AntiVir 8.2.1.194 2010.03.18 -
Antiy-AVL 2.0.3.7 2010.03.18 -
Authentium 5.2.0.5 2010.03.18 -
Avast 4.8.1351.0 2010.03.17 -
Avast5 5.0.332.0 2010.03.17 -
AVG 9.0.0.787 2010.03.17 -
BitDefender 7.2 2010.03.18 -
CAT-QuickHeal 10.00 2010.03.18 -
ClamAV 0.96.0.0-git 2010.03.18 -
Comodo 4304 2010.03.18 -
DrWeb 5.0.1.12222 2010.03.18 -
eSafe 7.0.17.0 2010.03.17 -
eTrust-Vet 35.2.7372 2010.03.18 -
F-Prot 4.5.1.85 2010.03.17 -
F-Secure 9.0.15370.0 2010.03.18 -
Fortinet 4.0.14.0 2010.03.15 -
GData 19 2010.03.18 -
Ikarus T3.1.1.80.0 2010.03.18 -
Jiangmin 13.0.900 2010.03.18 -
K7AntiVirus 7.10.1000 2010.03.17 -
Kaspersky 7.0.0.125 2010.03.18 -
McAfee 5923 2010.03.17 -
McAfee+Artemis 5923 2010.03.17 -
McAfee-GW-Edition 6.8.5 2010.03.18 -
Microsoft 1.5605 2010.03.17 -
NOD32 4954 2010.03.18 -
Norman 6.04.08 2010.03.17 -
nProtect 2009.1.8.0 2010.03.18 -
Panda 10.0.2.2 2010.03.17 -
PCTools 7.0.3.5 2010.03.18 -
Prevx 3.0 2010.03.18 -
Rising 22.39.03.04 2010.03.18 -
Sophos 4.51.0 2010.03.18 -
Sunbelt 5947 2010.03.18 -
Symantec 20091.2.0.41 2010.03.18 -
TheHacker 6.5.2.0.236 2010.03.18 -
TrendMicro 9.120.0.1004 2010.03.18 -
VBA32 3.12.12.2 2010.03.17 -
ViRobot 2010.3.18.2233 2010.03.18 -
VirusBuster 5.0.27.0 2010.03.17 -

Information additionnelle
File size: 9680 bytes
MD5   : 9b2a6147a22f7e696cc7538283de6346
SHA1  : 5606b654d7d391605bf34ed8bd9b89f79a87cf3f
SHA256: 4bb6e018c36684172cddc456f90a1b4d14ba70711e47514921d919969d8ddeec
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x51E<BR>timedatestamp.....: 0x37F3F168 (Fri Oct 1 01:25:28 1999)<BR>machinetype.......: 0x14C (Intel I386)<BR><BR>( 7 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x2E0 0x1032 0x1040 6.39 77432f21dc30c8aab69dcf5cb554e0bf<BR>.rdata 0x1320 0x140 0x140 3.29 c46cdfb1bc5856c25de4be7721ab168c<BR>.data 0x1460 0x1CC 0x1E0 2.48 c48df6cfe5a5f48f00a5ae710f39bb9e<BR>PAGE 0x1640 0x3BC 0x3C0 6.15 8681e5fda0e24c2d0f1ff5fdc1e80c2c<BR>INIT 0x1A00 0x4D6 0x4E0 5.25 29982325ece5a474a6576b3d42e850a0<BR>.rsrc 0x1EE0 0x3D8 0x3E0 3.38 c2028ea2ac742f9c217bcdbc2d48837e<BR>.reloc 0x22C0 0x1E2 0x200 5.13 a0eb99148dcf69630d0f8f63e8f5a9ad<BR><BR>( 2 imports )<BR><BR>> hal.dll: HalGetInterruptVector, HalReadDmaCounter, IoFlushAdapterBuffers, IoFreeAdapterChannel, KfRaiseIrql, KfLowerIrql, IoMapTransfer, HalGetAdapter, HalAllocateCommonBuffer, HalFreeCommonBuffer, HalGetBusDataByOffset, WRITE_PORT_ULONG, WRITE_PORT_USHORT, WRITE_PORT_UCHAR, READ_PORT_ULONG, READ_PORT_USHORT, READ_PORT_UCHAR, HalTranslateBusAddress, ExAcquireFastMutex, ExReleaseFastMutex<BR>> ntoskrnl.exe: InterlockedExchange, KeSetEvent, IoAllocateMdl, IoDisconnectInterrupt, IoAllocateAdapterChannel, KeWaitForSingleObject, MmBuildMdlForNonPagedPool, MmMapLockedPages, MmMapLockedPagesSpecifyCache, IoReportResourceForDetection, MmUnmapIoSpace, MmMapIoSpace, ExAllocatePoolWithTag, IoGetCurrentProcess, KeInitializeEvent, IoCreateDevice, IoCreateSymbolicLink, _except_handler3, ProbeForRead, IofCompleteRequest, ExFreePool, RtlInitUnicodeString, IoDeleteSymbolicLink, IoDeleteDevice, IoFreeMdl, IoConnectInterrupt<BR><BR>( 0 exports )<BR>
TrID  : File type identification<BR>Win32 Executable Generic (68.0%)<BR>Generic Win/DOS Executable (15.9%)<BR>DOS Executable Generic (15.9%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 192:f2RlLahsLoHjPRpOv2JdQ8kJCkiAUWSyR90eLUyBOHfXPyaWXHW:uS8SPA27Q8k0mUWSyM0FUHfXP/WXHW
sigcheck: publisher....: Microsoft Corporation<BR>copyright....: Copyright (C) Microsoft Corp. 1981-1999<BR>product......: Microsoft(R) Windows (R) 2000 Operating System<BR>description..: Network Card Detection driver<BR>original name: NETDTECT.SYS<BR>internal name: NETDTECT.SYS<BR>file version.: 5.00.2138.1<BR>comments.....: n/a<BR>signers......: Microsoft Windows 2000 Publisher<BR>Microsoft Windows Verification Intermediate PCA<BR>Microsoft Root Authority<BR>signing date.: 8:05 PM 7/27/2000<BR>verified.....: -<BR>
PEiD  : -
RDS   : NSRL Reference Data Set<BR><BR>( Giant )<BR><BR>Antispyware: netdtect.sys<BR>( Compaq )<BR><BR>Compaq Operating System CD: netdtect.sys<BR>( NewTech Infosystems Inc. )<BR><BR>CD-Maker Plus Edition: netdtect.sys<BR>( The Learning Company Inc. )<BR><BR>Reader Rabbits Toddler: netdtect.sys<BR>( Dell )<BR><BR>Dell Back-up Dell-installed Programs: netdtect.sysOperating System Reinstallation CD W2K + SP2: netdtect.sysReinstallation CD: netdtect.sysReinstallation CD W2K + SP2: netdtect.sysReinstallation CD W2K+SP3: netdtect.sys<BR>( Gateway )<BR><BR>Gateway System Restoration Kit: netdtect.sys<BR>( Topics Entertainment )<BR><BR>Instant Home Design: netdtect.sys<BR>( Microsoft )<BR><BR>Applications, Platforms: netdtect.sysApplications, Platforms: netdtect.sysApplications, Platforms, Servers: netdtect.sysBackOffice Server 2000: netdtect.sysBackOffice Server Beta: netdtect.sysBackOffice Small Business Server: netdtect.sysDell Reinstallation CD W2K and SP3: netdtect.sysDell reinstallation CD W2K SP1: netdtect.sysDisc 2438.5: netdtect.sysGateway Operating System Backup CD Version 2000.1: netdtect.sysGateway Operating System W2K: netdtect.sysInternet Explorer: netdtect.sysInternet Explorer Versions: netdtect.sysMDSN Disc 2441.2: netdtect.sysMicrosoft Security Resource Kit: netdtect.sysMicrosoft TechNet Trial Software 2002 Volume 1: netdtect.sysMSDN Development Platform Disc 10: netdtect.sysMSDN Development Platform Disc2: netdtect.sysMSDN Development Platform Disc2: netdtect.sysMSDN Disc 0527.1: netdtect.sysMSDN Disc 0527.2: netdtect.sysMSDN Disc 1550: netdtect.sysMSDN disc 2390: netdtect.sysMSDN Disc 2427.1: netdtect.sysMSDN Disc 2427.2: netdtect.sysMSDN Disc 2427.3: netdtect.sysMSDN Disc 2438: netdtect.sysMSDN Disc 2438.1: netdtect.sysMSDN Disc 2438.2: netdtect.sysMSDN DISC 2438.3: netdtect.sysMSDN Disc 2438.7: netdtect.sysMSDN Disc 2439: netdtect.sysMSDN Disc 2439.1: netdtect.sysMSDN Disc 2439.2: netdtect.sysMSDN Disc 2439.3: netdtect.sysMSDN Disc 2439.6: netdtect.sysMSDN Disc 2439.7: netdtect.sysMSDN Disc 2440.3: netdtect.sysMSDN Disc 2440.4: netdtect.sysMSDN Disc 2441: netdtect.sysMSDN Disc 2441.1: netdtect.sysMSDN Disc 2441.5: netdtect.sysMSDN Disc 2441.6: netdtect.sysMSDN Disc 2442: netdtect.sysMSDN Disc 2442.1: netdtect.sysMSDN Disc 2442.2: netdtect.sysMSDN Disc 2442.3: netdtect.sysMSDN Disc 2442.4: netdtect.sysMSDN Disc 2442.5: netdtect.sysMSDN Disc 2442.6: netdtect.sysMSDN Disc 2443: netdtect.sysMSDN Disc 2443.1: netdtect.sysMSDN Disc 2443.2: netdtect.sysMSDN Disc 2444: netdtect.sysMSDN Disc 2444.1: netdtect.sysMSDN Disc 2444.3: netdtect.sysMSDN Disc 2455: netdtect.sysMSDN Disc 2455.1: netdtect.sysMSDN disc 2455.2: netdtect.sysMSDN Disc 2455.4: netdtect.sysMSDN Disc 2455.6: netdtect.sysMSDN Disc 2464: netdtect.sysMSDN Disc 2464.1: netdtect.sysMSDN Disc 2464.2: netdtect.sysMSDN Disc 2464.5: netdtect.sysMSDN Disc 2465: netdtect.sysMSDN Disc 2465.2: netdtect.sysMSDN Disc 2465.4: netdtect.sysMSDN Disc 2465.5: netdtect.sysMSDN Disc 2466: netdtect.sysMSDN Disc 2466.1: netdtect.sysMSDN Disc 2466.2: netdtect.sysMSDN Disc 2476: netdtect.sysMSDN Disc 2476.1: netdtect.sysMSDN Disc 2476.2: netdtect.sysMSDN Disc 3235: netdtect.sysMSDN Disc2365: netdtect.sysMSDN Disc2389: netdtect.sysmsdn Internet Explorer/ windows2000 Server: netdtect.sysMSDN MSIE 6.0, IE 6.0 SP1, Windows 2000 Advanced Server, Windows 2000 Professional, Windows 2000 Server, Windows 98 Second ed., Windows ME, Win XP Pro: netdtect.sysMSDN Windows 2000 Advanced Server Disc6: netdtect.sysMSDN Windows 2000 Professional Disc 3: netdtect.sysMSDN Windows 2000 Server Disc5: netdtect.sysOperating System Reinstallation CD W2K + SP3: netdtect.sysPlatforms: netdtect.sysPlatforms, SDK/DDK: netdtect.sysPlatforms, SDK/DDK, Developer Tools: netdtect.sysPlatforms, Servers, Applications: netdtect.sysVirtual PC for Mac Windows 2000 Professional: netdtect.sysWindows: netdtect.sysWindows: netdtect.sysWindows: netdtect.sysWindows: netdtect.sysWindows: netdtect.sysWindows 2000: netdtect.sysWindows 2000: netdtect.sysWindows 2000 - Dell Reinstallation CD: netdtect.sysWindows 2000 Professional: netdtect.sysWindows 2000 Professional: netdtect.sysWindows 2000 Professional - Dell Reinstallation CD: netdtect.sysWindows 2000 Versions: netdtect.sysWindows 98 Versions: netdtect.sysWindows XP: netdtect.sys<BR>( Connectix Corporation )<BR><BR>Connectix Virtual PC for Mac Version 5: netdtect.sys

ive process named Teatimer.exe was found!
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-527237240-789336058-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\\ATI Launchpad deleted successfully.
Registry value HKEY_USERS\S-1-5-21-527237240-789336058-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\\WebCamRT.exe deleted successfully.
File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found.
Starting removal of ActiveX control DirectAnimation Java Classes
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
ADS C:\Documents and Settings\Administrateur\Mes documents\CIMG0258.JPG:Q30lsldxJoudresxAaaqpcawXc deleted successfully.
ADS C:\Documents and Settings\Administrateur\Mes documents\CIMG0263.JPG:Q30lsldxJoudresxAaaqpcawXc deleted successfully.
ADS C:\Documents and Settings\Administrateur\Mes documents\CIMG0257.JPG:Q30lsldxJoudresxAaaqpcawXc deleted successfully.
ADS C:\Documents and Settings\Administrateur\Mes documents\CIMG0264.JPG:Q30lsldxJoudresxAaaqpcawXc deleted successfully.
ADS C:\Documents and Settings\Administrateur\Mes documents\CIMG0260.JPG:Q30lsldxJoudresxAaaqpcawXc deleted successfully.
ADS C:\Documents and Settings\Administrateur\Mes documents\CIMG0261.JPG:Q30lsldxJoudresxAaaqpcawXc deleted successfully.
ADS C:\Documents and Settings\Administrateur\Mes documents\CIMG0262.JPG:Q30lsldxJoudresxAaaqpcawXc deleted successfully.
ADS C:\Documents and Settings\Administrateur\Mes documents\CIMG0259.JPG:Q30lsldxJoudresxAaaqpcawXc deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
========== FILES ==========
C:\Documents and Settings\Administrateur\Bureau\catchme.zip moved successfully.
C:\WINDOWS\info147.sys moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 53563483 bytes
->Temporary Internet Files folder emptied: 1233253 bytes
->Flash cache emptied: 1919558 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 583157 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 64512 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: shell32.dll unable to determine bytes removed.

Total Files Cleaned = 55,00 mb


OTL by OldTimer - Version 3.1.37.2 log created on 03182010_110214

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!

Registry entries deleted on Reboot...
0
Réponse 19 / 30
patapock
18 mars 2010 à 11:45
Pour Virus Total, j'ai fait l'analyse demandée des fichiers les uns apres les autres:

rien détecté. les logs sont sans doute trop long et je ne parviens pas a les poster ici.

juste Pour "C:\WINDOWS\System32\GlmanadSn.sys", l'analyse ne semble pas se faire, une fenêtre s'ouvre:

0 bytes size received / Se ha recibido un archivo vacio

sans doute parce que ce fichier fait 0 bytes?
0
Réponse 20 / 30
patapock
18 mars 2010 à 11:52
oups, j'arrive plus a poster sur le forum
0