Virus fakealert win32
Deanofmedecine
Messages postés
36
Statut
Membre
-
Deanofmedecine Messages postés 36 Statut Membre -
Deanofmedecine Messages postés 36 Statut Membre -
Bonjour,
J'ai un énorme problème hier j'ai vu que j'avais 6 Trojan fake alert et j'ai pu les supprimer avec malwarebytes, mais il n'en reste encore un qui persiste et qui ne veut pas se supprimer et encore moins se mettre en quarantaine je vous donne les informations :
C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe
Dropper
Win32:Dropper-gen [Drp]
http://nsa20.casimages.com/img/2010/08/29/100829060424892851.jpg
J'ai avast & malwarebytes qui ne veulent pas le supprimer. Que dois je faire ?
J'ai un énorme problème hier j'ai vu que j'avais 6 Trojan fake alert et j'ai pu les supprimer avec malwarebytes, mais il n'en reste encore un qui persiste et qui ne veut pas se supprimer et encore moins se mettre en quarantaine je vous donne les informations :
C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe
Dropper
Win32:Dropper-gen [Drp]
http://nsa20.casimages.com/img/2010/08/29/100829060424892851.jpg
J'ai avast & malwarebytes qui ne veulent pas le supprimer. Que dois je faire ?
A voir également:
- Virus fakealert win32
- Virus mcafee - Accueil - Piratage
- Virus facebook demande d'amis - Accueil - Facebook
- Virus informatique - Guide
- Panda anti virus gratuit - Télécharger - Antivirus & Antimalwares
- Undisclosed-recipients virus - Guide
8 réponses
ok tu fais un nettoyage avec ccleaner avec les réglages donnés, et tu vois si ton avast te signal toujours ton problème
télécharges Ccleaner à partir de cette adresses
https://www.commentcamarche.net/telecharger/utilitaires/5647-ccleaner/
.enregistres le sur le bureau
.double-cliques sur le fichier pour lancer l'installation
.sur la fenêtre de l'installation langage bien choisir français et OK
.cliques sur suivant
.lis la licence et j'accepte
.cliques sur suivant
.la tu ne gardes de coché que mettre un raccourci sur le bureau et puis contrôler automatiquement les mises à jour de Ccleaner
.cliques sur intaller
.cliques sur fermer
.double-cliques sur l'icône de Ccleaner pour l'ouvrir
.une fois ouvert tu cliques sur option et puis avancé
.tu décoches effacer uniquement les fichiers, du dossier temp de windows plus vieux que 24 heures
.cliques sur nettoyeur
.cliques sur windows et dans la colonne avancé
.cochesla première case vieilles données du perfetch que celle-la
.cliques sur analyse une fois l'analyse terminé
.cliques sur lancer le nettoyage et sur la demande de confirmation OK il vas falloir que tu le refasses une autre fois une fois fini vériffis en appuiant de nouveau sur analyse pour être sur qu'il n'y est plus rien
.cliques maintenant sur registre et puis sur rechercher les erreurs
.laisses tout cochées et cliques sur réparrer les erreurs sélectionnées
.il te demande de sauvegarder OUI
.tu lui donnes un nom pour pouvoir la retrouver et enregistre
.cliques sur corriger toutes les erreurs sélectionnées et sur la demande de confirmation OK
.il supprime et fermer tu vériffis en relancant rechercher les erreurs
.tu retournes dans option et tu recoches la case effacer uniquement les fichiers, du dossier temp de windows plus vieux que 24 heures et sur nettoyeur, windows sous avancé tu décoches la première case vieilles données du perfetch
.tu peux fermer Ccleaner
pour aider si besion tutoriel: https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
télécharges Ccleaner à partir de cette adresses
https://www.commentcamarche.net/telecharger/utilitaires/5647-ccleaner/
.enregistres le sur le bureau
.double-cliques sur le fichier pour lancer l'installation
.sur la fenêtre de l'installation langage bien choisir français et OK
.cliques sur suivant
.lis la licence et j'accepte
.cliques sur suivant
.la tu ne gardes de coché que mettre un raccourci sur le bureau et puis contrôler automatiquement les mises à jour de Ccleaner
.cliques sur intaller
.cliques sur fermer
.double-cliques sur l'icône de Ccleaner pour l'ouvrir
.une fois ouvert tu cliques sur option et puis avancé
.tu décoches effacer uniquement les fichiers, du dossier temp de windows plus vieux que 24 heures
.cliques sur nettoyeur
.cliques sur windows et dans la colonne avancé
.cochesla première case vieilles données du perfetch que celle-la
.cliques sur analyse une fois l'analyse terminé
.cliques sur lancer le nettoyage et sur la demande de confirmation OK il vas falloir que tu le refasses une autre fois une fois fini vériffis en appuiant de nouveau sur analyse pour être sur qu'il n'y est plus rien
.cliques maintenant sur registre et puis sur rechercher les erreurs
.laisses tout cochées et cliques sur réparrer les erreurs sélectionnées
.il te demande de sauvegarder OUI
.tu lui donnes un nom pour pouvoir la retrouver et enregistre
.cliques sur corriger toutes les erreurs sélectionnées et sur la demande de confirmation OK
.il supprime et fermer tu vériffis en relancant rechercher les erreurs
.tu retournes dans option et tu recoches la case effacer uniquement les fichiers, du dossier temp de windows plus vieux que 24 heures et sur nettoyeur, windows sous avancé tu décoches la première case vieilles données du perfetch
.tu peux fermer Ccleaner
pour aider si besion tutoriel: https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
Deanofmedecine
Messages postés
36
Statut
Membre
Je connais ce logiciel j'ai vu que le fichier c'était XML qui était une clé obsolète je l'ai dejà effacé 3 fois via ce logiciel & au bout d'un moment il revient dans le registre.
bonjour, passes list&kill"em
A) passes lis&kill"em option Search
DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)
Télécharge List_Kill'em et enregistre le sur ton bureau
double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation
une fois terminée , clic sur "terminer" et le programme se lancera seul
choisis l'option Search
un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.
un autre rouge et noir te servira a desinstaller le prog a la fin de la desinfection.
laisse travailler l'outil
à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.
un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan
Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"
B) list&kill"em option Clean
Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :
choisis l'Option Clean
ton PC va redemarrer,
laisse travailler l'outil.
en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,
colle le contenu dans ta reponse
A) passes lis&kill"em option Search
DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)
Télécharge List_Kill'em et enregistre le sur ton bureau
double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation
une fois terminée , clic sur "terminer" et le programme se lancera seul
choisis l'option Search
un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.
un autre rouge et noir te servira a desinstaller le prog a la fin de la desinfection.
laisse travailler l'outil
à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.
un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan
Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"
B) list&kill"em option Clean
Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :
choisis l'Option Clean
ton PC va redemarrer,
laisse travailler l'outil.
en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,
colle le contenu dans ta reponse
J'ai téléchargé le logiciel list&kill"em et j'ai mis Search ça m'a affiché un écran bleu et là il fait des recherches il est ensuite passé a un écran noir avec écriture rouge c'est assez long....
Quand j'ai remarqué que j'avais un virus j'ai voulu sauvegardé mes images & dossiers dans une clé usb il y a t'il un risque de contamination de la clé usb si je la remet dans l'ordinateur ?
Quand j'ai remarqué que j'avais un virus j'ai voulu sauvegardé mes images & dossiers dans une clé usb il y a t'il un risque de contamination de la clé usb si je la remet dans l'ordinateur ?
bonjour, oui des fois il est un peut long dans la recherche,je pense pas que u est un risque de contamination on verra après , ton truc est dan un dossier temp jepese que lis&kill"em le trouveraet e supprimera , sinon on essaira de le supprimer avec un nettoyage avec ccleanerou sinon tu vas dans le dossier et tu vides le dossier temp
J'espère que c'est le bon scan qui fallait mettre.
¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.0.1 ¤¤¤¤¤¤¤¤¤¤
User : Utilisateur (Administrateurs)
Update on 28/08/2010 by g3n-h@ckm@n ::::: 17.00
Start at: 18:18:50 | 29/08/2010
Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
Microsoft Windows 7 Édition Familiale Premium (6.1.7600 64-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1201 [VPS 100107-0] 4.8.1201 [ Enabled | Updated ]
C:\ -> Disque fixe local | 149,05 Go (46,39 Go free) [OS] | NTFS
D:\ -> Disque fixe local | 134,39 Go (134,17 Go free) [DATA] | NTFS
E:\ -> Disque CD-ROM
Boot: Normal
¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe ---- 3732 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe" ---- ASUSTeK Computer Inc.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe ---- 800 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" ---- ALWIL Software
C:\Program Files\ATKGFNEX\GFNEXSrv.exe ---- 3180 Ko ---- Normal ---- "C:\Program Files\ATKGFNEX\GFNEXSrv.exe" ----
C:\Program Files\Alwil Software\Avast4\ashServ.exe ---- 41996 Ko ---- High ---- "C:\Program Files\Alwil Software\Avast4\ashServ.exe" ---- ALWIL Software
C:\Program Files (x86)\AWS\WeatherBug Alert\WeatherBugAlert.exe ---- 864 Ko ---- Normal ---- "C:\Program Files (x86)\AWS\WeatherBug Alert\WeatherBugAlert.exe" /st ----
C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe ---- 96504 Ko ---- Normal ---- "C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe" ----
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe ---- 7312 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe ---- 5332 Ko ---- Normal ---- Atouch64.exe ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe ---- 4484 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" ---- Apple Inc.
C:\Program Files (x86)\Bonjour\mDNSResponder.exe ---- 5456 Ko ---- Normal ---- "C:\Program Files (x86)\Bonjour\mDNSResponder.exe" ---- Apple Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe ---- 3232 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe ---- 10624 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe ---- 3960 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe" ----
C:\Program Files\Alwil Software\Avast4\ashDisp.exe ---- 7308 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashDisp.exe" ---- ALWIL Software
C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe ---- 10684 Ko ---- Normal ---- "C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ---- 4276 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" ---- Sun Microsystems, Inc.
C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe ---- 6800 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe" ---- Intervideo, Inc.
C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe ---- 4360 Ko ---- Normal ---- "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe" ----
C:\Program Files (x86)\iTunes\iTunesHelper.exe ---- 12628 Ko ---- Normal ---- "C:\Program Files (x86)\iTunes\iTunesHelper.exe" ---- Apple Inc.
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ---- 2484 Ko ---- Below Normal ---- "C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 8368 Ko ---- Normal ---- "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe" ---- Microsoft Corporation
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ---- 1196 Ko ---- Below Normal ---- "C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe" ----
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe ---- 528 Ko ---- Below Normal ---- "C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe ---- 5676 Ko ---- Normal ---- ATKOSD.exe ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe ---- 3932 Ko ---- Normal ---- KBFiltr.exe ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe ---- 5148 Ko ---- Normal ---- WDC.exe ---- ASUSTeK Computer Inc.
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe ---- 112700 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service ---- ALWIL Software
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe ---- 3044 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service ---- ALWIL Software
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe ---- 3884 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe" ----
C:\Windows\AsScrPro.exe ---- 5048 Ko ---- Normal ---- "C:\Windows\AsScrPro.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe ---- 8540 Ko ---- Below Normal ---- "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" ---- CyberLink
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ---- 1224 Ko ---- Below Normal ---- "C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe ---- 7040 Ko ---- Normal ---- "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe" -Embedding ---- Microsoft Corporation
C:\Program Files (x86)\Mozilla Firefox\firefox.exe ---- 85380 Ko ---- Normal ---- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" ---- Mozilla Corporation
C:\Windows\SysWOW64\cmd.exe ---- 3712 Ko ---- Normal ---- C:\Windows\system32\cmd.exe /K List'em.bat ----
C:\Program Files (x86)\List_Kill'em\pv.exe ---- 5424 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ----
¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
msnmsgr = "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
WeatherBugAlert = "C:\Program Files (x86)\AWS\WeatherBug Alert\WeatherBugAlert.exe" /st
Google Update = "C:\Users\Utilisateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
XBV6RD5SZF = C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
HDAudDeck = C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
HControlUser = C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
ATKOSD2 = C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
ATKMEDIA = C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
avast! = "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
Adobe ARM = "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
SunJavaUpdateSched = "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
Ulead AutoDetector v2 = C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe
UnlockerAssistant = "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"
Microsoft Default Manager = "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
iTunesHelper = "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
QuickTime Task = "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
ConsentPromptBehaviorAdmin = 0 (0x0)
ConsentPromptBehaviorUser = 3 (0x3)
EnableInstallerDetection = 1 (0x1)
EnableLUA = 0 (0x0)
EnableSecureUIAPaths = 1 (0x1)
EnableUIADesktopToggle = 0 (0x0)
EnableVirtualization = 1 (0x1)
PromptOnSecureDesktop = 0 (0x0)
ValidateAdminCodeSignatures = 0 (0x0)
dontdisplaylastusername = 0 (0x0)
legalnoticecaption =
legalnoticetext =
scforceoption = 0 (0x0)
shutdownwithoutlogon = 1 (0x1)
undockwithoutlogon = 1 (0x1)
FilterAdministratorToken = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveAutoRun = 0 (0x0)
NoDriveTypeAutoRun = 145 (0x91)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoActiveDesktop = 1 (0x1)
ForceActiveDesktopOn = 0 (0x0)
NoActiveDesktopChanges = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS =
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
ReportBootOk = 1
Shell = explorer.exe
PreCreateKnownFolders = {A520A1A4-1780-4FF6-BD18-167343C5AF16}
DefaultDomainName =
DefaultUserName =
Userinit = C:\Windows\system32\userinit.exe,
VMApplet = SystemPropertiesPerformance.exe /pagefile
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\River Past\Animated GIF Converter and Booster Pack\VideoCleaner.exe = C:\Program Files\River Past\Animated GIF Converter and Booster Pack\VideoCleaner.exe:*:Enabled:River Past Animated GIF Converter
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}]
¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤
HKLM\SYSTEM\CCS\Services\Tcpip\..\{7B1F4779-CD96-464F-BA94-C323D7486879}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FBC74037-EA11-4E76-B7D3-4767BA3E105D}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7B1F4779-CD96-464F-BA94-C323D7486879}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FBC74037-EA11-4E76-B7D3-4767BA3E105D}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7B1F4779-CD96-464F-BA94-C323D7486879}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{FBC74037-EA11-4E76-B7D3-4767BA3E105D}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr
Local Page = C:\Windows\SysWOW64\blank.htm
Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr
Local Page = C:\Windows\system32\blank.htm
¤¤¤¤¤ Proxy Internet Explorer
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AcroRd32.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DllNXOptions]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IEInstal.exe]
¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection]
KnownDllList = nlhtml.dll
¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!
¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys :
[MD5.02062c0b390b7729edc9e69c680a6f3c]
[SHA256.0261683c6dc2706dce491a1cdc954ac9c9e649376ec30760bb4e225e18dc5273]
C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys :
[MD5.02062c0b390b7729edc9e69c680a6f3c]
[SHA256.0261683c6dc2706dce491a1cdc954ac9c9e649376ec30760bb4e225e18dc5273]
¤¤¤¤¤ Reference
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 338c86357871c167a96ab976519bf59e
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8215878c-5054-11df-9a79-90e6ba3a85ec}\shell\autorun
@ = Installer ou exécuter un programme depuis son support
SetWorkingDirectoryFromTarget =
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8215878c-5054-11df-9a79-90e6ba3a85ec}\shell\autorun\command
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8215878c-5054-11df-9a79-90e6ba3a85ec}\shell\autorun\command
@ = F:\Vodaphone_uninstaller.exe
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1d53f82-4bb8-11df-ade9-90e6ba3a85ec}\shell\autorun
@ = Installer ou exécuter un programme depuis son support
SetWorkingDirectoryFromTarget =
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1d53f82-4bb8-11df-ade9-90e6ba3a85ec}\shell\autorun\command
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1d53f82-4bb8-11df-ade9-90e6ba3a85ec}\shell\autorun\command
@ = F:\LaunchU3.exe -a
¤¤¤¤¤¤¤¤¤¤ Rogues Infections ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤
Present !! : C:\sqmnoopt00.sqm
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\Windows\System32\drivers\etc\hosts.msn
Present !! : C:\Windows\System32\x64
Present !! : C:\Windows\Syswow64\x64
Present !! : C:\Windows\Sysnative\drivers\etc\hosts.msn
Present !! : C:\Users\Utilisateur\AppData\Local\GDIPFONTCACHEV1.DAT
Present !! : C:\Users\Utilisateur\Local Settings\Temp\Op3.exe
Present !! : C:\Users\Utilisateur\LOCAL Settings\Temp\Op3.exe
¤¤¤¤¤¤¤¤¤¤ Keys :
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktop
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktopChanges
Present !! : HKCU\SOFTWARE\XML
FEATURE_BROWSER_EMULATION | svchost :
====================================
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-29 18:43:06
Windows 6.1.7600 WOW64 FAT NTAPI
detected NTDLL code modification:
ZwEnumerateKey 0 != 47, ZwQueryKey 0 != 19, ZwOpenKey 0 != 15, ZwClose 0 != 12, ZwEnumerateValueKey 0 != 16, ZwQueryValueKey 0 != 20, ZwOpenFile 0 != 48, ZwQueryDirectoryFile 0 != 50, ZwQuerySystemInformation 0 != 51Initialization error
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: error reading MBR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 18:46:29,15
¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.0.1 ¤¤¤¤¤¤¤¤¤¤
User : Utilisateur (Administrateurs)
Update on 28/08/2010 by g3n-h@ckm@n ::::: 17.00
Start at: 18:18:50 | 29/08/2010
Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
Microsoft Windows 7 Édition Familiale Premium (6.1.7600 64-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1201 [VPS 100107-0] 4.8.1201 [ Enabled | Updated ]
C:\ -> Disque fixe local | 149,05 Go (46,39 Go free) [OS] | NTFS
D:\ -> Disque fixe local | 134,39 Go (134,17 Go free) [DATA] | NTFS
E:\ -> Disque CD-ROM
Boot: Normal
¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe ---- 3732 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe" ---- ASUSTeK Computer Inc.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe ---- 800 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" ---- ALWIL Software
C:\Program Files\ATKGFNEX\GFNEXSrv.exe ---- 3180 Ko ---- Normal ---- "C:\Program Files\ATKGFNEX\GFNEXSrv.exe" ----
C:\Program Files\Alwil Software\Avast4\ashServ.exe ---- 41996 Ko ---- High ---- "C:\Program Files\Alwil Software\Avast4\ashServ.exe" ---- ALWIL Software
C:\Program Files (x86)\AWS\WeatherBug Alert\WeatherBugAlert.exe ---- 864 Ko ---- Normal ---- "C:\Program Files (x86)\AWS\WeatherBug Alert\WeatherBugAlert.exe" /st ----
C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe ---- 96504 Ko ---- Normal ---- "C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe" ----
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe ---- 7312 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe ---- 5332 Ko ---- Normal ---- Atouch64.exe ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe ---- 4484 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" ---- Apple Inc.
C:\Program Files (x86)\Bonjour\mDNSResponder.exe ---- 5456 Ko ---- Normal ---- "C:\Program Files (x86)\Bonjour\mDNSResponder.exe" ---- Apple Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe ---- 3232 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe ---- 10624 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe ---- 3960 Ko ---- Normal ---- "C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe" ----
C:\Program Files\Alwil Software\Avast4\ashDisp.exe ---- 7308 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashDisp.exe" ---- ALWIL Software
C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe ---- 10684 Ko ---- Normal ---- "C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ---- 4276 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" ---- Sun Microsystems, Inc.
C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe ---- 6800 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe" ---- Intervideo, Inc.
C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe ---- 4360 Ko ---- Normal ---- "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe" ----
C:\Program Files (x86)\iTunes\iTunesHelper.exe ---- 12628 Ko ---- Normal ---- "C:\Program Files (x86)\iTunes\iTunesHelper.exe" ---- Apple Inc.
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ---- 2484 Ko ---- Below Normal ---- "C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 8368 Ko ---- Normal ---- "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe" ---- Microsoft Corporation
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ---- 1196 Ko ---- Below Normal ---- "C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe" ----
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe ---- 528 Ko ---- Below Normal ---- "C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe ---- 5676 Ko ---- Normal ---- ATKOSD.exe ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe ---- 3932 Ko ---- Normal ---- KBFiltr.exe ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe ---- 5148 Ko ---- Normal ---- WDC.exe ---- ASUSTeK Computer Inc.
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe ---- 112700 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service ---- ALWIL Software
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe ---- 3044 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service ---- ALWIL Software
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe ---- 3884 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe" ----
C:\Windows\AsScrPro.exe ---- 5048 Ko ---- Normal ---- "C:\Windows\AsScrPro.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe ---- 8540 Ko ---- Below Normal ---- "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" ---- CyberLink
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ---- 1224 Ko ---- Below Normal ---- "C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe" ---- ASUSTeK Computer Inc.
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe ---- 7040 Ko ---- Normal ---- "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe" -Embedding ---- Microsoft Corporation
C:\Program Files (x86)\Mozilla Firefox\firefox.exe ---- 85380 Ko ---- Normal ---- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" ---- Mozilla Corporation
C:\Windows\SysWOW64\cmd.exe ---- 3712 Ko ---- Normal ---- C:\Windows\system32\cmd.exe /K List'em.bat ----
C:\Program Files (x86)\List_Kill'em\pv.exe ---- 5424 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ----
¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
msnmsgr = "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
WeatherBugAlert = "C:\Program Files (x86)\AWS\WeatherBug Alert\WeatherBugAlert.exe" /st
Google Update = "C:\Users\Utilisateur\AppData\Local\Google\Update\GoogleUpdate.exe" /c
XBV6RD5SZF = C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
HDAudDeck = C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
HControlUser = C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
ATKOSD2 = C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
ATKMEDIA = C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
avast! = "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
Adobe ARM = "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
SunJavaUpdateSched = "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
Ulead AutoDetector v2 = C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe
UnlockerAssistant = "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"
Microsoft Default Manager = "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
iTunesHelper = "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
QuickTime Task = "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
ConsentPromptBehaviorAdmin = 0 (0x0)
ConsentPromptBehaviorUser = 3 (0x3)
EnableInstallerDetection = 1 (0x1)
EnableLUA = 0 (0x0)
EnableSecureUIAPaths = 1 (0x1)
EnableUIADesktopToggle = 0 (0x0)
EnableVirtualization = 1 (0x1)
PromptOnSecureDesktop = 0 (0x0)
ValidateAdminCodeSignatures = 0 (0x0)
dontdisplaylastusername = 0 (0x0)
legalnoticecaption =
legalnoticetext =
scforceoption = 0 (0x0)
shutdownwithoutlogon = 1 (0x1)
undockwithoutlogon = 1 (0x1)
FilterAdministratorToken = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveAutoRun = 0 (0x0)
NoDriveTypeAutoRun = 145 (0x91)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoActiveDesktop = 1 (0x1)
ForceActiveDesktopOn = 0 (0x0)
NoActiveDesktopChanges = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS =
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
ReportBootOk = 1
Shell = explorer.exe
PreCreateKnownFolders = {A520A1A4-1780-4FF6-BD18-167343C5AF16}
DefaultDomainName =
DefaultUserName =
Userinit = C:\Windows\system32\userinit.exe,
VMApplet = SystemPropertiesPerformance.exe /pagefile
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\River Past\Animated GIF Converter and Booster Pack\VideoCleaner.exe = C:\Program Files\River Past\Animated GIF Converter and Booster Pack\VideoCleaner.exe:*:Enabled:River Past Animated GIF Converter
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}]
¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤
HKLM\SYSTEM\CCS\Services\Tcpip\..\{7B1F4779-CD96-464F-BA94-C323D7486879}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FBC74037-EA11-4E76-B7D3-4767BA3E105D}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7B1F4779-CD96-464F-BA94-C323D7486879}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FBC74037-EA11-4E76-B7D3-4767BA3E105D}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7B1F4779-CD96-464F-BA94-C323D7486879}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{FBC74037-EA11-4E76-B7D3-4767BA3E105D}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr
Local Page = C:\Windows\SysWOW64\blank.htm
Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr
Local Page = C:\Windows\system32\blank.htm
¤¤¤¤¤ Proxy Internet Explorer
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AcroRd32.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DllNXOptions]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IEInstal.exe]
¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection]
KnownDllList = nlhtml.dll
¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!
¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys :
[MD5.02062c0b390b7729edc9e69c680a6f3c]
[SHA256.0261683c6dc2706dce491a1cdc954ac9c9e649376ec30760bb4e225e18dc5273]
C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys :
[MD5.02062c0b390b7729edc9e69c680a6f3c]
[SHA256.0261683c6dc2706dce491a1cdc954ac9c9e649376ec30760bb4e225e18dc5273]
¤¤¤¤¤ Reference
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 338c86357871c167a96ab976519bf59e
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8215878c-5054-11df-9a79-90e6ba3a85ec}\shell\autorun
@ = Installer ou exécuter un programme depuis son support
SetWorkingDirectoryFromTarget =
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8215878c-5054-11df-9a79-90e6ba3a85ec}\shell\autorun\command
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8215878c-5054-11df-9a79-90e6ba3a85ec}\shell\autorun\command
@ = F:\Vodaphone_uninstaller.exe
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1d53f82-4bb8-11df-ade9-90e6ba3a85ec}\shell\autorun
@ = Installer ou exécuter un programme depuis son support
SetWorkingDirectoryFromTarget =
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1d53f82-4bb8-11df-ade9-90e6ba3a85ec}\shell\autorun\command
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1d53f82-4bb8-11df-ade9-90e6ba3a85ec}\shell\autorun\command
@ = F:\LaunchU3.exe -a
¤¤¤¤¤¤¤¤¤¤ Rogues Infections ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤
Present !! : C:\sqmnoopt00.sqm
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Present !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Present !! : C:\Windows\System32\drivers\etc\hosts.msn
Present !! : C:\Windows\System32\x64
Present !! : C:\Windows\Syswow64\x64
Present !! : C:\Windows\Sysnative\drivers\etc\hosts.msn
Present !! : C:\Users\Utilisateur\AppData\Local\GDIPFONTCACHEV1.DAT
Present !! : C:\Users\Utilisateur\Local Settings\Temp\Op3.exe
Present !! : C:\Users\Utilisateur\LOCAL Settings\Temp\Op3.exe
¤¤¤¤¤¤¤¤¤¤ Keys :
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktop
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktopChanges
Present !! : HKCU\SOFTWARE\XML
FEATURE_BROWSER_EMULATION | svchost :
====================================
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-29 18:43:06
Windows 6.1.7600 WOW64 FAT NTAPI
detected NTDLL code modification:
ZwEnumerateKey 0 != 47, ZwQueryKey 0 != 19, ZwOpenKey 0 != 15, ZwClose 0 != 12, ZwEnumerateValueKey 0 != 16, ZwQueryValueKey 0 != 20, ZwOpenFile 0 != 48, ZwQueryDirectoryFile 0 != 50, ZwQuerySystemInformation 0 != 51Initialization error
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: error reading MBR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 18:46:29,15
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
A moins que ce soit ca :
¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.1 ¤¤¤¤¤¤¤¤¤¤
User : Utilisateur (Administrateurs)
Update on 28/08/2010 by g3n-h@ckm@n ::::: 17.00
Start at: 19:05:01 | 29/08/2010
Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
Microsoft Windows 7 Édition Familiale Premium (6.1.7600 64-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1201 [VPS 100107-0] 4.8.1201 [ Enabled | Updated ]
C:\ -> Disque fixe local | 149,05 Go (46,58 Go free) [OS] | NTFS
D:\ -> Disque fixe local | 134,39 Go (134,17 Go free) [DATA] | NTFS
E:\ -> Disque CD-ROM
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ------- Memory(Ko)
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe ----3732 Ko
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe ----800 Ko
C:\Program Files\ATKGFNEX\GFNEXSrv.exe ----3180 Ko
C:\Program Files\Alwil Software\Avast4\ashServ.exe ----38336 Ko
C:\Program Files (x86)\AWS\WeatherBug Alert\WeatherBugAlert.exe ----1172 Ko
C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe ----118000 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe ----7344 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe ----5332 Ko
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe ----4484 Ko
C:\Program Files (x86)\Bonjour\mDNSResponder.exe ----5460 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe ----3232 Ko
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe ----10624 Ko
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe ----3960 Ko
C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----8560 Ko
C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe ----10684 Ko
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ----4276 Ko
C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe ----6800 Ko
C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe ----4360 Ko
C:\Program Files (x86)\iTunes\iTunesHelper.exe ----12628 Ko
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ----2884 Ko
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ----8380 Ko
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ----1292 Ko
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe ----608 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe ----5676 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe ----3932 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe ----5148 Ko
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe ----2888 Ko
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe ----3272 Ko
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe ----3884 Ko
C:\Windows\AsScrPro.exe ----5048 Ko
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe ----8540 Ko
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ----852 Ko
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe ----7060 Ko
C:\Program Files (x86)\Windows Media Player\wmplayer.exe ----64248 Ko
C:\Windows\SysWOW64\cmd.exe ----3808 Ko
C:\Program Files (x86)\Mozilla Firefox\firefox.exe ----22992 Ko
C:\Program Files (x86)\List_Kill'em\ERUNT.EXE ----6760 Ko
C:\Program Files (x86)\List_Kill'em\pv.exe ----5452 Ko
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Quarantined & Deleted !! : C:\sqmnoopt00.sqm
Quarantined & Deleted !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Quarantined & Deleted !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Quarantined & Deleted !! : C:\Windows\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\Windows\System32\x64
Quarantined & Deleted !! : C:\Users\Utilisateur\AppData\Local\GDIPFONTCACHEV1.DAT
Quarantined & Deleted !! : C:\Users\Utilisateur\Local Settings\Temp\Op3.exe
Quarantined & Deleted !! : C:\Users\Utilisateur\LOCAL Settings\Temp\catchme.dll
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$I0F94YD.lnk
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$I3UZ8DU.exe
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$I5BOTJD.htm
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$IFOGZGL
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$IGYIURX.exe
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$IMF5S2P.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$IN7C25E.lnk
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$R0F94YD.lnk
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$R3UZ8DU.exe
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$R5BOTJD.htm
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$RGYIURX.exe
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$RN7C25E.lnk
¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤
127.0.0.1 localhost
¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktop
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktopChanges
Deleted : HKCU\SOFTWARE\XML
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr/?ocid=iehp
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.google.com/?gws_rd=ssl
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 ()
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤
Ndisuio : Start = 3
EapHost : Start = 2
Wlansvc : Start = 2
SharedAccess : Start = 2
windefend : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
FEATURE_BROWSER_EMULATION | svchost :
====================================
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: error reading MBR
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.1 ¤¤¤¤¤¤¤¤¤¤
User : Utilisateur (Administrateurs)
Update on 28/08/2010 by g3n-h@ckm@n ::::: 17.00
Start at: 19:05:01 | 29/08/2010
Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
Microsoft Windows 7 Édition Familiale Premium (6.1.7600 64-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1201 [VPS 100107-0] 4.8.1201 [ Enabled | Updated ]
C:\ -> Disque fixe local | 149,05 Go (46,58 Go free) [OS] | NTFS
D:\ -> Disque fixe local | 134,39 Go (134,17 Go free) [DATA] | NTFS
E:\ -> Disque CD-ROM
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ------- Memory(Ko)
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe ----3732 Ko
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe ----800 Ko
C:\Program Files\ATKGFNEX\GFNEXSrv.exe ----3180 Ko
C:\Program Files\Alwil Software\Avast4\ashServ.exe ----38336 Ko
C:\Program Files (x86)\AWS\WeatherBug Alert\WeatherBugAlert.exe ----1172 Ko
C:\Users\Utilisateur\AppData\Local\Temp\Op3.exe ----118000 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe ----7344 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe ----5332 Ko
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe ----4484 Ko
C:\Program Files (x86)\Bonjour\mDNSResponder.exe ----5460 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe ----3232 Ko
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe ----10624 Ko
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe ----3960 Ko
C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----8560 Ko
C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe ----10684 Ko
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ----4276 Ko
C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe ----6800 Ko
C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe ----4360 Ko
C:\Program Files (x86)\iTunes\iTunesHelper.exe ----12628 Ko
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ----2884 Ko
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ----8380 Ko
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ----1292 Ko
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe ----608 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe ----5676 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe ----3932 Ko
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe ----5148 Ko
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe ----2888 Ko
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe ----3272 Ko
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe ----3884 Ko
C:\Windows\AsScrPro.exe ----5048 Ko
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe ----8540 Ko
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ----852 Ko
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe ----7060 Ko
C:\Program Files (x86)\Windows Media Player\wmplayer.exe ----64248 Ko
C:\Windows\SysWOW64\cmd.exe ----3808 Ko
C:\Program Files (x86)\Mozilla Firefox\firefox.exe ----22992 Ko
C:\Program Files (x86)\List_Kill'em\ERUNT.EXE ----6760 Ko
C:\Program Files (x86)\List_Kill'em\pv.exe ----5452 Ko
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Quarantined & Deleted !! : C:\sqmnoopt00.sqm
Quarantined & Deleted !! : C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
Quarantined & Deleted !! : C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Quarantined & Deleted !! : C:\Windows\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\Windows\System32\x64
Quarantined & Deleted !! : C:\Users\Utilisateur\AppData\Local\GDIPFONTCACHEV1.DAT
Quarantined & Deleted !! : C:\Users\Utilisateur\Local Settings\Temp\Op3.exe
Quarantined & Deleted !! : C:\Users\Utilisateur\LOCAL Settings\Temp\catchme.dll
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$I0F94YD.lnk
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$I3UZ8DU.exe
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$I5BOTJD.htm
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$IFOGZGL
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$IGYIURX.exe
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$IMF5S2P.avi
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$IN7C25E.lnk
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$R0F94YD.lnk
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$R3UZ8DU.exe
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$R5BOTJD.htm
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$RGYIURX.exe
Deleted !! : C:\$Recycle.bin\S-1-5-21-3244362836-3714746651-2499860308-1001\$RN7C25E.lnk
¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤
127.0.0.1 localhost
¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktop
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktopChanges
Deleted : HKCU\SOFTWARE\XML
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr/?ocid=iehp
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.google.com/?gws_rd=ssl
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 ()
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤
Ndisuio : Start = 3
EapHost : Start = 2
Wlansvc : Start = 2
SharedAccess : Start = 2
windefend : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
FEATURE_BROWSER_EMULATION | svchost :
====================================
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: error reading MBR
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
