Alureon.H
Résolu
MIG
-
Quinou -
Quinou -
Bonjour,
j'ai un virus Alureon.H depuis quelques jours.
Je voudrais de l'aide pour le supprimer, car le travail se fait manuellement, semble-t-il.
Merci
j'ai un virus Alureon.H depuis quelques jours.
Je voudrais de l'aide pour le supprimer, car le travail se fait manuellement, semble-t-il.
Merci
65 réponses
bonjour
pas de soucis semble t il
le pc montre t il des signes inquiétants ,
.............
1)
fais un coup d'usbfix dessus mais sans remettre tes clés
...........
Rends toi sur ce site :
https://www.virustotal.com/gui/
Clique sur parcourir et cherche ce fichier :
C:\Program Files\Visionsoft\Mom Says No v2\vsmsnsrv.exe
Clique sur Send File.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Copie le lien de cette page dans ta réponse.
Si tu ne trouves pas le fichier alors
Affiche tous les fichiers et dossiers :
Pour cela :
Clique sur démarrer/panneau de configuration/option des dossiers/affichage
Cocher afficher les dossiers cachés
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décocher masquer les extensions dont le type est connu
Puis fais «appliquer» pour valider les changements.
Et OK
pas de soucis semble t il
le pc montre t il des signes inquiétants ,
.............
1)
fais un coup d'usbfix dessus mais sans remettre tes clés
...........
Rends toi sur ce site :
https://www.virustotal.com/gui/
Clique sur parcourir et cherche ce fichier :
C:\Program Files\Visionsoft\Mom Says No v2\vsmsnsrv.exe
Clique sur Send File.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Copie le lien de cette page dans ta réponse.
Si tu ne trouves pas le fichier alors
Affiche tous les fichiers et dossiers :
Pour cela :
Clique sur démarrer/panneau de configuration/option des dossiers/affichage
Cocher afficher les dossiers cachés
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décocher masquer les extensions dont le type est connu
Puis fais «appliquer» pour valider les changements.
Et OK
MIG
Le PC rame pas mal, il met beaucoup de temps à démarrer et j'ai trouvé win32/yabector.gen avec onecare scan.
Voici pour virustotal:
http://www.virustotal.com/file-scan/report.html?id=2ab4c0b4c059948a499c6c6bb19656e800bd28ba5922729238d23a85735a4406-1284985696
http://www.virustotal.com/file-scan/report.html?id=2ab4c0b4c059948a499c6c6bb19656e800bd28ba5922729238d23a85735a4406-1284985696
Et le rapport usbfix :
############################## | UsbFix 7.025 | [Recherche]
Utilisateur: Superviseur (Administrateur) # GEORGES [ ]
Mis à jour le 15/09/10 par El Desaparecido / C_XX
Lancé à 14:38:42 | 20/09/2010
Site Web: http://www.teamxscript.org
Contact: FindyKill.Contact@gmail.com
CPU: Intel(R) Pentium(R) D CPU 3.00GHz
CPU 2: Intel(R) Pentium(R) D CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Pare-feu Windows: Activé
Antivirus: AntiVir Desktop 10.0.1.44 [(!) Disabled | Updated]
RAM -> 1022 Mo
C:\ (%systemdrive%) -> Disque fixe # 293 Go (170 Go libre(s) - 58%) [] # NTFS
E:\ -> CD-ROM
################## | Éléments infectieux |
################## | Registre |
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apitrap.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cleanup.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cqw32.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divxdec.ax
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DJSMAR00.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DRMINST.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ehshell.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\enc98.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EncodeDivXExt.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EncryptPatchVer.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\front.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fullsoft.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GBROWSER.DLL
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htmlmarq.ocx
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htmlmm.ocx
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ishscan.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ISSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javai.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jvm.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jvm_g.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\main123w.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mngreg32.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msci_uno.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoree.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvr.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorwks.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msjava.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mso.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVOPTRF.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NeVideoFX.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPMLIC.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NSWSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\photohse.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PMSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppw32hlp.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\printhse.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prwin8.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ps80.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psdmt.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qfinder.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpw.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\salwrap.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sevinst.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcnet.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcore_ebook.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TFDTCTT8.DLL
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ua80.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\udtapi.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ums.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vb40032.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbe6.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpwin8.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xlmlEN.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xwsetup.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_INSTPGM.EXE
################## | Mountpoints2 |
HKCU\.\.\.\.\Explorer\MountPoints2\{cad0a186-2f9a-11df-8337-001676c59444}
Shell\AutoRun\Command = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL launcher.exe
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné!
################## | E.O.F |
############################## | UsbFix 7.025 | [Recherche]
Utilisateur: Superviseur (Administrateur) # GEORGES [ ]
Mis à jour le 15/09/10 par El Desaparecido / C_XX
Lancé à 14:38:42 | 20/09/2010
Site Web: http://www.teamxscript.org
Contact: FindyKill.Contact@gmail.com
CPU: Intel(R) Pentium(R) D CPU 3.00GHz
CPU 2: Intel(R) Pentium(R) D CPU 3.00GHz
Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Pare-feu Windows: Activé
Antivirus: AntiVir Desktop 10.0.1.44 [(!) Disabled | Updated]
RAM -> 1022 Mo
C:\ (%systemdrive%) -> Disque fixe # 293 Go (170 Go libre(s) - 58%) [] # NTFS
E:\ -> CD-ROM
################## | Éléments infectieux |
################## | Registre |
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apitrap.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cleanup.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cqw32.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divxdec.ax
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DJSMAR00.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DRMINST.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ehshell.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\enc98.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EncodeDivXExt.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EncryptPatchVer.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\front.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fullsoft.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GBROWSER.DLL
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htmlmarq.ocx
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htmlmm.ocx
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ishscan.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ISSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javai.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jvm.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jvm_g.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\main123w.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mngreg32.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msci_uno.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoree.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvr.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorwks.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msjava.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mso.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVOPTRF.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NeVideoFX.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPMLIC.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NSWSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\photohse.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PMSTE.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppw32hlp.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\printhse.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prwin8.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ps80.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psdmt.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qfinder.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpw.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\salwrap.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sevinst.exe
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcnet.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcore_ebook.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TFDTCTT8.DLL
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ua80.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\udtapi.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ums.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vb40032.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbe6.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpwin8.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xlmlEN.dll
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xwsetup.EXE
Présent! HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_INSTPGM.EXE
################## | Mountpoints2 |
HKCU\.\.\.\.\Explorer\MountPoints2\{cad0a186-2f9a-11df-8337-001676c59444}
Shell\AutoRun\Command = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL launcher.exe
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné!
################## | E.O.F |
? Relance UsbFix
? Dans le menu principale cette fois choisit l'option SUPPRESSION
Le menu démarrer et les icônes vont à nouveau disparaître.. c'est normal.
Si un message te demande de redémarrer l'ordinateur fais le ...
? Au redémarrage, le fix se relance... laisses l'opération s'effectuer.
? Le bloc note s'ouvre avec un rapport, envoies le dans la prochaine réponse
UsbFix peut te demander d'uploader un dossier compressé à cette adresse : https://www.ionos.fr/?affiliate_id=77097
Il est enregistré sur ton bureau.
Merci de l'envoyer à l'adresse indiquée afin d'aider l'auteur de UsbFix dans ses recherches.
Merci
? Dans le menu principale cette fois choisit l'option SUPPRESSION
Le menu démarrer et les icônes vont à nouveau disparaître.. c'est normal.
Si un message te demande de redémarrer l'ordinateur fais le ...
? Au redémarrage, le fix se relance... laisses l'opération s'effectuer.
? Le bloc note s'ouvre avec un rapport, envoies le dans la prochaine réponse
UsbFix peut te demander d'uploader un dossier compressé à cette adresse : https://www.ionos.fr/?affiliate_id=77097
Il est enregistré sur ton bureau.
Merci de l'envoyer à l'adresse indiquée afin d'aider l'auteur de UsbFix dans ses recherches.
Merci
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
et le rapport de suppression d'USBFIX :
http://www.cijoint.fr/cjlink.php?file=cj201009/cijZoMDwgU.txt
http://www.cijoint.fr/cjlink.php?file=cj201009/cijZoMDwgU.txt
J'ai fait des copies d'écran du rapport de onecare security
de ce j'ai pu lire, ce sont des trucs pas cools que tu télécharges
il rame toujours ?
de ce j'ai pu lire, ce sont des trucs pas cools que tu télécharges
il rame toujours ?
DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)
Télécharge ici :List_Kill'em et enregistre le sur ton bureau
http://sd-4.archive-host.com/membres/up/829108531491024/Mes_Tools/List_Killem_Install.exe
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur le raccourci sur ton bureau pour lancer l'installation
Laisse coché :
Executer List_Kill'em
une fois terminée , clic sur "terminer" et le programme se lancera seul
choisis l'option Search
laisse travailler l'outil
il se peut qu'une boite de dialogue s'ouvre , dans ce cas clique sur "ok" ou "Agree"
à l'apparition de la fenetre blanche , c'est un peu long , c'est normal ,c'est une recherche supplementaire de fichiers cachés , le programme n'est pas bloqué.
Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"
NE LE POSTE PAS SUR LE FORUM
Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/
Clique sur Parcourir et cherche le fichier ci-dessus.
Clique sur Ouvrir.
Clique sur "Cliquez ici pour déposer le fichier".
Un lien de cette forme :
http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt
est ajouté dans la page.
Copie ce lien dans ta réponse.
Fais de même avec more.txt qui se trouve sur ton bureau
fichier list_kill'm :
http://www.cijoint.fr/cjlink.php?file=cj201009/cijJOWhF9q.txt
Fichier more :
http://www.cijoint.fr/cjlink.php?file=cj201009/cijUEKyzSY.txt
Bonne soirée
http://www.cijoint.fr/cjlink.php?file=cj201009/cijJOWhF9q.txt
Fichier more :
http://www.cijoint.fr/cjlink.php?file=cj201009/cijUEKyzSY.txt
Bonne soirée
Finalement, je ne suis pas couché, et voici le rapport de kill'em :
¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.7 ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Quarantined & Deleted !! : C:\WINDOWS\002986_.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4E.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4F.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET50.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET51.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET5D.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET60.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET97.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1918.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is191A.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1927.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1929.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1CE.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1D0.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is412.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is41E.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is7AE.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is7B0.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEP87.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\ver69.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\Application Data\wklnhst.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\Application Data\Desktopicon
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\Local Settings\Temp\dw.log
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\AdobeAIRInstaller.exe
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\jre-6u20-windows-i586-iftw-rv.exe
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\jre-6u21-windows-i586-iftw-rv.exe
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\_is20.exe
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\isconfig.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1014.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_107c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1248.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1370.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_137c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_13c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1474.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1484.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_14d0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_14fc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_154.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_156c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_17b0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1a0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1a4.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1d4.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1fc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_200c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_2090.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_2254.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_2e4.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_42c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_480.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_528.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_67c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_748.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_7d0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_7dc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_858.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_948.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_a00.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_a4c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_a68.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_a84.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_c0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_c58.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_c60.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_cc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_cd8.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_ce0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_d6c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_e24.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_e5c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_ebc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_ecc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_f04.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_f24.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_f78.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_fd4.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Th_script.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\drm_dyndata_7390006.dll
¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤
127.0.0.1 localhost
¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
Deleted : HKCR\interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Deleted : HKCR\interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Deleted : HKCR\MediaPlayer.GraphicsUtils
Deleted : HKCR\MediaPlayer.GraphicsUtils.1
Deleted : HKCR\MgMediaPlayer.GifAnimator
Deleted : HKCR\MgMediaPlayer.GifAnimator.1
Deleted : HKCR\SWEETIE.SWEETIE
Deleted : HKCR\SWEETIE.SWEETIE.3
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Deleted : HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Deleted : HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr/?ocid=iehp
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.google.com/?gws_rd=ssl
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 ()
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤
Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
FEATURE_BROWSER_EMULATION | svchost :
====================================
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys sfsync04.sys hal.dll iastor.sys
kernel: MBR read successfully
user & kernel MBR OK
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.7 ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Quarantined & Deleted !! : C:\WINDOWS\002986_.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4E.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET4F.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET50.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET51.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET5D.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET60.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET97.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1918.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is191A.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1927.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1929.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1CE.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is1D0.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is412.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is41E.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is7AE.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\is7B0.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEP87.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\ver69.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\Application Data\wklnhst.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\Application Data\Desktopicon
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\Local Settings\Temp\dw.log
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\AdobeAIRInstaller.exe
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\jre-6u20-windows-i586-iftw-rv.exe
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\jre-6u21-windows-i586-iftw-rv.exe
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\_is20.exe
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\isconfig.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1014.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_107c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1248.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1370.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_137c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_13c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1474.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1484.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_14d0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_14fc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_154.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_156c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_17b0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1a0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1a4.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1d4.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_1fc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_200c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_2090.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_2254.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_2e4.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_42c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_480.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_528.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_67c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_748.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_7d0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_7dc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_858.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_948.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_a00.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_a4c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_a68.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_a84.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_c0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_c58.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_c60.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_cc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_cd8.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_ce0.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_d6c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_e24.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_e5c.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_ebc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_ecc.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_f04.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_f24.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_f78.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Perflib_Perfdata_fd4.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\Th_script.dat
Quarantined & Deleted !! : C:\Documents and Settings\Superviseur\LOCAL Settings\Temp\drm_dyndata_7390006.dll
¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤
127.0.0.1 localhost
¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
Deleted : HKCR\interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Deleted : HKCR\interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Deleted : HKCR\MediaPlayer.GraphicsUtils
Deleted : HKCR\MediaPlayer.GraphicsUtils.1
Deleted : HKCR\MgMediaPlayer.GifAnimator
Deleted : HKCR\MgMediaPlayer.GifAnimator.1
Deleted : HKCR\SWEETIE.SWEETIE
Deleted : HKCR\SWEETIE.SWEETIE.3
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Deleted : HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Deleted : HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr/?ocid=iehp
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.google.com/?gws_rd=ssl
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 ()
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤
Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
FEATURE_BROWSER_EMULATION | svchost :
====================================
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys sfsync04.sys hal.dll iastor.sys
kernel: MBR read successfully
user & kernel MBR OK
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
J'ai lancé defogger, l'outil a travaillé, mais il est toujours actif et propose à nouveau disable et re-enable. Est-ce que je dois laisser la fenêtre ainsi et lancer gmer ?
Bonsoir,
gmer a planté, et je viens de voir que je ne sais pas bien désactivé spybot. Dans les autres sujets, j'ai vu que spybot n'est pas un outil à garder.
Dois-je le désintaller avant de relancer gmer ?
gmer a planté, et je viens de voir que je ne sais pas bien désactivé spybot. Dans les autres sujets, j'ai vu que spybot n'est pas un outil à garder.
Dois-je le désintaller avant de relancer gmer ?
nouveau plantage ou plutôt blocage du PC. cette fois, il m'indique qu'il y a eu une erreur d'écriture d'un fichier et puis impossible de bouger la souris, pas possible de faire ctrl+alt+suppr. J'ai rebooté la machine, mais avant de recommencer, je voudrais savoir si il y a une autre manip à faire ou bien revoir la procédure ? Merci
j'y crois pas trop mais bon
Attention, avant de commencer, lit attentivement la procédure, et imprime la
Aide à l'utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Télécharge ComboFix de sUBs que tu renommes MIG.exe avant de l'enregistrersur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et <gras>DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\ </gras>
---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
(si il te propose de l'installer remets internet)
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
Attention, avant de commencer, lit attentivement la procédure, et imprime la
Aide à l'utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Télécharge ComboFix de sUBs que tu renommes MIG.exe avant de l'enregistrersur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et <gras>DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\ </gras>
---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
(si il te propose de l'installer remets internet)
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt
Bonjour, désolé pour le retard, mais voici le rapport de combofix :
ComboFix 10-09-22.05 - Superviseur 23/09/2010 6:49.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.478 [GMT 2:00]
Lancé depuis: c:\documents and settings\Superviseur\Bureau\mig.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\SUPERV~1\LOCALS~1\Temp\clclean.0001.dir.0004\~df394b.tmp
c:\documents and settings\Superviseur\Local Settings\Temp\clclean.0001.dir.0004\~df394b.tmp
c:\windows\system32\Data
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-08-23 au 2010-09-23 ))))))))))))))))))))))))))))))))))))
.
2010-09-20 17:17 . 2010-09-20 20:06 -------- d-----w- C:\Kill'em
2010-09-20 17:17 . 2010-09-20 20:34 -------- d-----w- c:\program files\List_Kill'em
2010-09-20 12:37 . 2010-09-20 16:15 -------- d-----w- C:\UsbFix
2010-09-20 04:12 . 2010-09-20 04:14 -------- d-----w- c:\program files\ZHPDiag
2010-09-20 04:05 . 2010-07-17 03:00 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-19 08:27 . 2010-09-19 08:27 -------- d-----w- c:\documents and settings\Superviseur\Application Data\Avira
2010-09-19 08:09 . 2010-09-19 08:09 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-09-19 08:05 . 2010-09-19 08:05 -------- d-----w- c:\program files\Avira
2010-09-19 08:05 . 2010-09-19 08:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-09-19 08:05 . 2010-03-01 08:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-09-19 08:05 . 2010-02-16 12:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-09-19 08:05 . 2009-05-11 10:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-09-19 08:05 . 2009-05-11 10:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-09-18 21:47 . 2010-09-18 21:47 -------- d-----w- c:\documents and settings\Superviseur\Application Data\Malwarebytes
2010-09-18 21:47 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-18 21:47 . 2010-09-18 21:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-18 21:47 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-18 21:47 . 2010-09-18 21:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-18 02:39 . 2010-09-18 03:17 -------- d-----w- c:\windows\BDOSCAN8
2010-09-16 08:03 . 2010-09-16 08:08 -------- d-----w- c:\program files\Windows Live Safety Center
2010-09-12 17:01 . 2010-09-12 17:01 -------- d-----w- C:\found.004
2010-09-08 13:18 . 2010-09-08 13:18 -------- d-----w- c:\documents and settings\Hanna\Application Data\Apple Computer
2010-08-26 10:13 . 2010-09-20 15:22 -------- d-----w- c:\documents and settings\Hanna\Tracing
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 04:16 . 2008-04-21 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-09-23 04:16 . 2009-10-01 20:51 -------- d-----w- c:\program files\LogMeIn
2010-09-20 20:35 . 2005-09-01 05:53 86588 ----a-w- c:\windows\system32\perfc00C.dat
2010-09-20 20:35 . 2005-09-01 05:53 515110 ----a-w- c:\windows\system32\perfh00C.dat
2010-09-20 04:06 . 2006-12-01 17:28 -------- d-----w- c:\program files\Fichiers communs\Java
2010-09-20 04:05 . 2006-12-01 17:28 -------- d-----w- c:\program files\Java
2010-09-19 15:36 . 2009-05-16 06:01 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-19 09:44 . 2006-12-01 17:46 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-19 07:19 . 2010-01-27 15:32 -------- d-----w- c:\documents and settings\Superviseur\Application Data\OpenOffice.org2
2010-09-16 07:29 . 2009-03-15 16:35 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-10 04:26 . 2008-01-31 19:44 -------- d-----w- c:\documents and settings\theofab\Application Data\OpenOffice.org2
2010-08-26 21:35 . 2010-05-18 19:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-08-26 21:35 . 2006-12-01 17:42 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2010-08-17 13:17 . 2005-09-01 05:53 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-13 20:08 . 2010-08-13 20:08 -------- d-----w- c:\program files\Dofus 2
2010-08-13 20:07 . 2010-08-13 20:07 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
2010-08-13 11:45 . 2007-05-19 20:52 -------- d-----w- c:\program files\Messenger Plus! Live
2010-07-27 21:39 . 2007-05-20 18:59 -------- d-----w- c:\program files\Picasa2
2010-07-22 15:48 . 2005-09-01 05:53 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-06-30 12:32 . 2005-09-01 05:53 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-25 07:06 . 2006-12-28 21:53 5164 ----a-w- c:\documents and settings\theofab\Application Data\wklnhst.dat
2007-01-18 19:30 . 2006-12-27 11:16 168 --sh--r- c:\windows\system32\2A3B0006C4.sys
2007-01-18 19:30 . 2006-12-27 11:16 5954 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2007-09-21 19:54 1453080 ----a-w- c:\program files\Freecorder\tbFre1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\tbFre1.dll" [2007-09-21 1453080]
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612}"= "c:\program files\Freecorder\tbFre1.dll" [2007-09-21 1453080]
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 24576]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-21 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 282624]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"MBMon"="CTMBHA.DLL" [2006-06-28 1355042]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter"="c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2006-02-16 1118208]
"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"EPSON Stylus Photo R240 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE" [2005-04-25 98304]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"TrayServer"="c:\program files\MAGIX\Video_deluxe_15_Plus_Version_a_telecharger\TrayServer.exe" [2008-09-01 90112]
"MMReminderService"="c:\program files\Mindjet\MindManager 7\MMReminderService.exe" [2008-09-08 37656]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]
c:\documents and settings\theofab\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-8-17 393216]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Assistant d'Acrobat.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 217194]
PC TimeWatch Tray Icon.lnk - c:\program files\MainSoft\PC TimeWatch\PctwTI.exe [2007-2-6 553984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-06-09 16:14 87424 ----a-w- c:\windows\system32\LMIinit.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\maxime\\Application Data\\Midway Games\\Rise and Fall\\RiseAndFall.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Documents and Settings\\theofab\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Documents and Settings\\maxime\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Documents and Settings\\alice\\Application Data\\Midway Games\\Rise and Fall\\RiseAndFall.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
R?2 vsMSNsrv;vsMSNsrv;c:\program files\Visionsoft\Mom Says No v2\vsMSNSrv.exe [27/04/2008 02:33 830464]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [19/09/2010 10:05 135336]
R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [14/07/2006 03:01 13824]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [11/08/2008 12:41 12856]
R2 PTWsvc;PCTimeWatch;c:\program files\MainSoft\PC TimeWatch\PTWsvc.exe [06/02/2007 12:58 835584]
R2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [14/07/2006 03:02 13696]
R3 PTWDrv;PTW - Process monitoring driver;c:\program files\MainSoft\PC TimeWatch\PTWatch.sys [20/10/2003 18:07 4096]
R3 WN6201;Wireless Network Adapter Service;c:\windows\system32\drivers\WN6201.sys [27/12/2006 09:18 457472]
S0 AlfaFF;Alfa File System Mini-Filter;c:\windows\system32\Drivers\AlfaFF.sys --> c:\windows\system32\Drivers\AlfaFF.sys [?]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [03/01/2010 17:13 135664]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [29/12/2008 23:23 1527900]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [07/12/2007 19:18 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [25/11/2007 18:12 85696]
.
Contenu du dossier 'Tâches planifiées'
2010-09-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-09-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 15:13]
2010-09-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 15:13]
2010-09-23 c:\windows\Tasks\User_Feed_Synchronization-{4B0A876A-8386-4EEF-83F8-7D2F6FB70ACF}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=0061201
uSearchAssistant = hxxp://www.google.com/ie
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} - hxxp://mannequin.redoute.fr/activex/Mannequin.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\documents and settings\Superviseur\Application Data\Mozilla\Firefox\Profiles\x7qndivu.default\
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-vsMSN - c:\program files\Visionsoft\Mom Says No v2\vsMSNone.exe
SafeBoot-MCODS
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-23 07:04
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsMSNsrv]
"ImagePath"="c:\program files\Visionsoft\Mom Says No v2\vsmsnsrv.exe /startedbyscm:399961AD-40E29890-NTService1"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(784)
c:\windows\system32\LMIinit.dll
.
Heure de fin: 2010-09-23 07:13:12
ComboFix-quarantined-files.txt 2010-09-23 05:13
Avant-CF: 182 847 963 136 octets libres
Après-CF: 189 235 736 576 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptOut
- - End Of File - - 1A98B18988DA6FE346DCBA6FBF2A46ED
ComboFix 10-09-22.05 - Superviseur 23/09/2010 6:49.1.2 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.478 [GMT 2:00]
Lancé depuis: c:\documents and settings\Superviseur\Bureau\mig.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\SUPERV~1\LOCALS~1\Temp\clclean.0001.dir.0004\~df394b.tmp
c:\documents and settings\Superviseur\Local Settings\Temp\clclean.0001.dir.0004\~df394b.tmp
c:\windows\system32\Data
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-08-23 au 2010-09-23 ))))))))))))))))))))))))))))))))))))
.
2010-09-20 17:17 . 2010-09-20 20:06 -------- d-----w- C:\Kill'em
2010-09-20 17:17 . 2010-09-20 20:34 -------- d-----w- c:\program files\List_Kill'em
2010-09-20 12:37 . 2010-09-20 16:15 -------- d-----w- C:\UsbFix
2010-09-20 04:12 . 2010-09-20 04:14 -------- d-----w- c:\program files\ZHPDiag
2010-09-20 04:05 . 2010-07-17 03:00 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-19 08:27 . 2010-09-19 08:27 -------- d-----w- c:\documents and settings\Superviseur\Application Data\Avira
2010-09-19 08:09 . 2010-09-19 08:09 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-09-19 08:05 . 2010-09-19 08:05 -------- d-----w- c:\program files\Avira
2010-09-19 08:05 . 2010-09-19 08:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-09-19 08:05 . 2010-03-01 08:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-09-19 08:05 . 2010-02-16 12:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-09-19 08:05 . 2009-05-11 10:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-09-19 08:05 . 2009-05-11 10:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-09-18 21:47 . 2010-09-18 21:47 -------- d-----w- c:\documents and settings\Superviseur\Application Data\Malwarebytes
2010-09-18 21:47 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-18 21:47 . 2010-09-18 21:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-18 21:47 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-18 21:47 . 2010-09-18 21:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-18 02:39 . 2010-09-18 03:17 -------- d-----w- c:\windows\BDOSCAN8
2010-09-16 08:03 . 2010-09-16 08:08 -------- d-----w- c:\program files\Windows Live Safety Center
2010-09-12 17:01 . 2010-09-12 17:01 -------- d-----w- C:\found.004
2010-09-08 13:18 . 2010-09-08 13:18 -------- d-----w- c:\documents and settings\Hanna\Application Data\Apple Computer
2010-08-26 10:13 . 2010-09-20 15:22 -------- d-----w- c:\documents and settings\Hanna\Tracing
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 04:16 . 2008-04-21 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-09-23 04:16 . 2009-10-01 20:51 -------- d-----w- c:\program files\LogMeIn
2010-09-20 20:35 . 2005-09-01 05:53 86588 ----a-w- c:\windows\system32\perfc00C.dat
2010-09-20 20:35 . 2005-09-01 05:53 515110 ----a-w- c:\windows\system32\perfh00C.dat
2010-09-20 04:06 . 2006-12-01 17:28 -------- d-----w- c:\program files\Fichiers communs\Java
2010-09-20 04:05 . 2006-12-01 17:28 -------- d-----w- c:\program files\Java
2010-09-19 15:36 . 2009-05-16 06:01 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-19 09:44 . 2006-12-01 17:46 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-19 07:19 . 2010-01-27 15:32 -------- d-----w- c:\documents and settings\Superviseur\Application Data\OpenOffice.org2
2010-09-16 07:29 . 2009-03-15 16:35 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-10 04:26 . 2008-01-31 19:44 -------- d-----w- c:\documents and settings\theofab\Application Data\OpenOffice.org2
2010-08-26 21:35 . 2010-05-18 19:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-08-26 21:35 . 2006-12-01 17:42 -------- d-----w- c:\program files\Fichiers communs\Symantec Shared
2010-08-17 13:17 . 2005-09-01 05:53 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-13 20:08 . 2010-08-13 20:08 -------- d-----w- c:\program files\Dofus 2
2010-08-13 20:07 . 2010-08-13 20:07 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
2010-08-13 11:45 . 2007-05-19 20:52 -------- d-----w- c:\program files\Messenger Plus! Live
2010-07-27 21:39 . 2007-05-20 18:59 -------- d-----w- c:\program files\Picasa2
2010-07-22 15:48 . 2005-09-01 05:53 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-06-30 12:32 . 2005-09-01 05:53 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-25 07:06 . 2006-12-28 21:53 5164 ----a-w- c:\documents and settings\theofab\Application Data\wklnhst.dat
2007-01-18 19:30 . 2006-12-27 11:16 168 --sh--r- c:\windows\system32\2A3B0006C4.sys
2007-01-18 19:30 . 2006-12-27 11:16 5954 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2007-09-21 19:54 1453080 ----a-w- c:\program files\Freecorder\tbFre1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\tbFre1.dll" [2007-09-21 1453080]
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612}"= "c:\program files\Freecorder\tbFre1.dll" [2007-09-21 1453080]
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 24576]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-21 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 282624]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"MBMon"="CTMBHA.DLL" [2006-06-28 1355042]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter"="c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2006-02-16 1118208]
"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"EPSON Stylus Photo R240 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE" [2005-04-25 98304]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"TrayServer"="c:\program files\MAGIX\Video_deluxe_15_Plus_Version_a_telecharger\TrayServer.exe" [2008-09-01 90112]
"MMReminderService"="c:\program files\Mindjet\MindManager 7\MMReminderService.exe" [2008-09-08 37656]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]
c:\documents and settings\theofab\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-8-17 393216]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Assistant d'Acrobat.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 217194]
PC TimeWatch Tray Icon.lnk - c:\program files\MainSoft\PC TimeWatch\PctwTI.exe [2007-2-6 553984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-06-09 16:14 87424 ----a-w- c:\windows\system32\LMIinit.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\maxime\\Application Data\\Midway Games\\Rise and Fall\\RiseAndFall.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Documents and Settings\\theofab\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Documents and Settings\\maxime\\Application Data\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Documents and Settings\\alice\\Application Data\\Midway Games\\Rise and Fall\\RiseAndFall.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
R?2 vsMSNsrv;vsMSNsrv;c:\program files\Visionsoft\Mom Says No v2\vsMSNSrv.exe [27/04/2008 02:33 830464]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [19/09/2010 10:05 135336]
R2 hnmwrlspkt;HomeNet Manager Wireless Protocol;c:\windows\system32\drivers\hnm_wrls_pkt.sys [14/07/2006 03:01 13824]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [11/08/2008 12:41 12856]
R2 PTWsvc;PCTimeWatch;c:\program files\MainSoft\PC TimeWatch\PTWsvc.exe [06/02/2007 12:58 835584]
R2 wsppkt;Wireless Security Protocol;c:\windows\system32\drivers\wsp_pkt.sys [14/07/2006 03:02 13696]
R3 PTWDrv;PTW - Process monitoring driver;c:\program files\MainSoft\PC TimeWatch\PTWatch.sys [20/10/2003 18:07 4096]
R3 WN6201;Wireless Network Adapter Service;c:\windows\system32\drivers\WN6201.sys [27/12/2006 09:18 457472]
S0 AlfaFF;Alfa File System Mini-Filter;c:\windows\system32\Drivers\AlfaFF.sys --> c:\windows\system32\Drivers\AlfaFF.sys [?]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [03/01/2010 17:13 135664]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [29/12/2008 23:23 1527900]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [07/12/2007 19:18 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [25/11/2007 18:12 85696]
.
Contenu du dossier 'Tâches planifiées'
2010-09-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-09-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 15:13]
2010-09-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 15:13]
2010-09-23 c:\windows\Tasks\User_Feed_Synchronization-{4B0A876A-8386-4EEF-83F8-7D2F6FB70ACF}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=0061201
uSearchAssistant = hxxp://www.google.com/ie
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} - hxxp://mannequin.redoute.fr/activex/Mannequin.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\documents and settings\Superviseur\Application Data\Mozilla\Firefox\Profiles\x7qndivu.default\
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-vsMSN - c:\program files\Visionsoft\Mom Says No v2\vsMSNone.exe
SafeBoot-MCODS
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-23 07:04
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsMSNsrv]
"ImagePath"="c:\program files\Visionsoft\Mom Says No v2\vsmsnsrv.exe /startedbyscm:399961AD-40E29890-NTService1"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(784)
c:\windows\system32\LMIinit.dll
.
Heure de fin: 2010-09-23 07:13:12
ComboFix-quarantined-files.txt 2010-09-23 05:13
Avant-CF: 182 847 963 136 octets libres
Après-CF: 189 235 736 576 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptOut
- - End Of File - - 1A98B18988DA6FE346DCBA6FBF2A46ED
la pêche n'a pas été bonne....et on s'éloigne passablement de la piste infectieuse
fais un scan en ligne ici
copie colle le rapport final
http://www.kaspersky.com/kos/eng/partner/default/pages/default/check.html?n=1263916919335
tuto pout t'aider
https://www.commentcamarche.net/faq/17751-scanner-en-ligne-avec-kaspersky#analyse-de-l-ordinateur
fais un scan en ligne ici
copie colle le rapport final
http://www.kaspersky.com/kos/eng/partner/default/pages/default/check.html?n=1263916919335
tuto pout t'aider
https://www.commentcamarche.net/faq/17751-scanner-en-ligne-avec-kaspersky#analyse-de-l-ordinateur
voici le rapport :
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, September 23, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, September 23, 2010 00:10:31
Records in database: 4237661
--------------------------------------------------------------------------------
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
E:\
Scan statistics:
Objects scanned: 323786
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 06:50:18
File name / Threat / Threats count
C:\MAGIX\video_deLuxe_2005\softupdate.exe Infected: Trojan-Downloader.Win32.Genome.afkz 1
Selected area has been scanned.
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, September 23, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, September 23, 2010 00:10:31
Records in database: 4237661
--------------------------------------------------------------------------------
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
E:\
Scan statistics:
Objects scanned: 323786
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 06:50:18
File name / Threat / Threats count
C:\MAGIX\video_deLuxe_2005\softupdate.exe Infected: Trojan-Downloader.Win32.Genome.afkz 1
Selected area has been scanned.
en plus de supprimer ce fichier fais ceci
affiche les fichier caché
cherche boot ini sur C
ouvre le
tu devrais trouvé ceci
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptOut
modifie OptOut par Optin
tu obtiens ceci
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=Optin
accepte l'enregistrement
redemarre le pc et dis moi si tu constates un changement
affiche les fichier caché
cherche boot ini sur C
ouvre le
tu devrais trouvé ceci
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptOut
modifie OptOut par Optin
tu obtiens ceci
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=Optin
accepte l'enregistrement
redemarre le pc et dis moi si tu constates un changement
ça semble plus rapide. le PC rame moins, le disque "gratte moins" et le ventilo de l'UC tourne moins.
Bravo
Bravo
Fais un nouveau rapport ZHPdiag stp
Rend toi sur Cjoint : http://www.cijoint.fr/
Clique sur "Parcourir " dans la partie " Joindre un fichier[...] "
Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau
Clique ensuite sur "Cliquez ici pour déposer le fichier " et copie/colle le lien dans ton prochain message
si soucis avec ci joint. fr
=> utiliser https://www.cjoint.com/
=> utiliser http://ww38.toofiles.com/fr/oip/documents/txt/av.html
Rend toi sur Cjoint : http://www.cijoint.fr/
Clique sur "Parcourir " dans la partie " Joindre un fichier[...] "
Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau
Clique ensuite sur "Cliquez ici pour déposer le fichier " et copie/colle le lien dans ton prochain message
si soucis avec ci joint. fr
=> utiliser https://www.cjoint.com/
=> utiliser http://ww38.toofiles.com/fr/oip/documents/txt/av.html