Virus Alert !

Question

Bonjour,

Je suis moi aussi pris avec le problème de Virus Alert ! à côté de mon Horloge. Je demande ainsi votre aide.

Merci

CROTCHO · Answer

salut + d info svp

ODDdefault · Answer

Salut, 

Bon comme j'ai dit, j'ai le mot Virus Alert ! à droite de mon horloge, j'ai perdu des icons sur mon bureau, je n'ai plus accès à mon disque dur en passant par le Poste de Travail. La moitié du temps, mes pages internets fonctionnent mal.
J'ai utiliser CCleaner, Ad-Aware et Spybot Search & Destroy, mais le problème persistent. 

J'ai vue d'autre poste qui proposait d'utiliser HijackThis et d'envoyer le rapport. Qu'en est-il de cela? 

Merci

ODDdefault · Answer

Voilà le rapport que j'ai obtenu par HijackThis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:52: VIRUS ALERT!, on 2008-09-01
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F3 - REG:win.ini: run="C:\Documents and Settings\POC\Application Data\Adobe\Manager.exe"
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: QXK Olive - {26027218-80B3-40FA-9FA1-70FD56AA5328} - C:\WINDOWSodqgpvldbv.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: D - {AC454869-B194-3C62-A7B3-32E6BECE653E} - C:\WINDOWS\system32\mmx69169.dll
O2 - BHO: mxlivemedia browser optimizer - {def9f07f-08d6-4702-849c-2e3e8eb33450} - C:\WINDOWS\system32\mtjbybupjbzv.dll (file missing)
O3 - Toolbar: qalkfxor - {5371FF76-9602-4029-9626-BE8CD757EB36} - C:\WINDOWS\qalkfxor.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [GEST] m’|\ü
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [{8a2f51b7-6a46-65a7-6549-f357e2f16cf1}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\mtjbybupjbzv.dll" DllStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.systemrequirementslab.com/cyri
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O21 - SSODL: rqbmvpso - {1BDD1C71-1205-43BB-B814-651918E2481A} - C:\WINDOWSqbmvpso.dll
O21 - SSODL: pdoskegl - {CE288907-5E5B-4C2B-A19A-FF983D96CFD5} - C:\WINDOWS\pdoskegl.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

ODDdefault · Answer

J'ai fait le scan comme indiqué. Je n'ai plus le message Virus Alert ! à droite de mon horloge, j'ai retrouvé l'accès à mon disque dur à partir du Poste de Travail.

Voici le rapport donné

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1103
Windows 5.1.2600 Service Pack 3

16:20:29 2008-09-01
mbam-log-09-01-2008 (16-20-29).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 93172
Temps écoulé: 14 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 14
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 12
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 15

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\rodqgpvldbv.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\rqbmvpso.dll (Trojan.FakeAlert) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mxlivemedia (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{fd924082-30ca-4c7f-8866-9b494a03889d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9da604e4-8a8f-47fb-b4f1-bb4bc73e546c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a878ffb4-52de-4396-8f6e-a03417493f9a} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{26027218-80b3-40fa-9fa1-70fd56aa5328} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{26027218-80b3-40fa-9fa1-70fd56aa5328} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1bdd1c71-1205-43bb-b814-651918e2481a} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qalkfxor.bmva (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qalkfxor.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ac454869-b194-3c62-a7b3-32e6bece653e} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ac454869-b194-3c62-a7b3-32e6bece653e} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{def9f07f-08d6-4702-849c-2e3e8eb33450} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{def9f07f-08d6-4702-849c-2e3e8eb33450} (Adware.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\c:\program files\adwarealert\ (Rogue.AdwareAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{8a2f51b7-6a46-65a7-6549-f357e2f16cf1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\rqbmvpso (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\pdoskegl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run (Trojan.Agent) -> Data: c:\documents and settings\poc\application data\adobe\manager.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76413-640-1215903-23179) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\AdwareAlert (Rogue.AdwareAlert) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{955DA75C-212B-4C07-90FF-F924AD06AB51}\RP30\A0009092.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{955DA75C-212B-4C07-90FF-F924AD06AB51}\RP30\A0009093.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{955DA75C-212B-4C07-90FF-F924AD06AB51}\RP30\A0009102.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\eaxf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\evjxpzjvhmjsxzp.exe (Malware.Trace) -> Quarantined and deleted successfully.
C:\Program Files\AdwareAlert\SpyCleaner.dll (Rogue.AdwareAlert) -> Quarantined and deleted successfully.
C:\Program Files\AdwareAlert\TCL.dll (Rogue.AdwareAlert) -> Quarantined and deleted successfully.
C:\Program Files\AdwareAlert\vistaCPtasks.xml (Rogue.AdwareAlert) -> Quarantined and deleted successfully.
C:\Program Files\AdwareAlert\zlib.dll (Rogue.AdwareAlert) -> Quarantined and deleted successfully.
C:\Program Files\KB37558.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\rodqgpvldbv.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\rvoelbxt.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\rqbmvpso.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\POC\Application Data\Adobe\Manager.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mmx69169.dll (Trojan.BHO) -> Quarantined and deleted successfully.

ODDdefault · Answer

Voici le rapport donné par SDFix


[b]SDFix: Version 1.220 [/b]
Run by POC on 2008-09-01 at 16:57

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat - Contains Links to Malware Sites! - Deleted
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat - Contains Links to Malware Sites! - Deleted
C:\WINDOWS\system32\mmx21275.dll - Deleted
C:\WINDOWS\system32\mx21275.dll - Deleted
C:\Documents and Settings\POC\Application Data\Adobe\crc.dat - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-01 17:00:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:d1,74,3e,c6,df,67,fd,69,ca,d5,21,9b,91,b9,68,21,0b,6f,d7,5a,7e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,b0,36,10,02,a0,c2,87,6d,20,09,dd,f8,24,92,16,17,26,..
"khjeh"=hex:bc,16,76,8c,15,ae,53,c3,42,2f,af,ef,f7,ca,f9,f3,fc,50,ab,ac,28,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:41,d7,f0,4d,ca,9b,c3,3a,9a,85,d3,a2,79,3b,ae,7d,63,c8,91,6a,8a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:d1,74,3e,c6,df,67,fd,69,ca,d5,21,9b,91,b9,68,21,0b,6f,d7,5a,7e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,b0,36,10,02,a0,c2,87,6d,20,09,dd,f8,24,92,16,17,26,..
"khjeh"=hex:bc,16,76,8c,15,ae,53,c3,42,2f,af,ef,f7,ca,f9,f3,fc,50,ab,ac,28,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:41,d7,f0,4d,ca,9b,c3,3a,9a,85,d3,a2,79,3b,ae,7d,63,c8,91,6a,8a,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD"
"D:\CDS\Nero\Installation\SetupX.exe"="D:\CDS\Nero\Installation\SetupX.exe:*:Enabled:Nero ProductSetup"
"C:\Program Files\McAfee\Common Framework\FrameworkService.exe"="C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:æTorrent"
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe"="C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"E:\Jeux\Combat Arms\Engine.exe"="E:\Jeux\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"E:\Jeux\Combat Arms\NMService.exe"="E:\Jeux\Combat Arms\NMService.exe:*:Enabled:Nexon Messenger Core"
"E:\Jeux\Combat Arms\CombatArms.exe"="E:\Jeux\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"E:\Jeux\Diablo II\Diablo II.exe"="E:\Jeux\Diablo II\Diablo II.exe:*:Enabled:Diablo II.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"E:\Jeux\Combat Arms\CombatArms.exe"="E:\Jeux\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"E:\Jeux\Combat Arms\Engine.exe"="E:\Jeux\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:


[b]Finished![/b]

ODDdefault · Answer

Et voilà le Rapport de ToolBarSD


   -----------\  ToolBar S&D 1.1.6   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )
   BIOS : Award Modular BIOS v6.00PG
   USER : POC ( Administrator )
   BOOT : Normal boot
   Antivirus : McAfee VirusScan Enterprise 8.5.0.781 (Activated)

   "C:\ToolBar SD" ( MAJ : 30-08-2008|00:19 )
   Option : [1] ( 2008-09-01|17:25 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="about:blank"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\POC\Mes documents\1.10_Item_Vault_Version_1.2\1.10 Item Vault Version 1.2\Uniques\Exceptional\Weapons\Swords\Cloudcrack Gothic Sword.d2i



   1 - "C:\ToolBar SD\TB_1.txt" - 2008-09-01|17:25 - Option : [1]

   -----------\  Fin du rapport a 17:25:29,31


PS: Merci pour l'aide que tu m'apportes =)

ODDdefault · Answer

Je n'étais pas sur si je devais poster le rapport, donc je le poste quand même, au cas où.


   -----------\  ToolBar S&D 1.1.6   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )
   BIOS : Award Modular BIOS v6.00PG
   USER : POC ( Administrator )
   BOOT : Normal boot
   Antivirus : McAfee VirusScan Enterprise 8.5.0.781 (Activated)

   "C:\ToolBar SD" ( MAJ : 30-08-2008|00:19 )
   Option : [2] ( 2008-09-01|17:32 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="about:blank"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\POC\Mes documents\1.10_Item_Vault_Version_1.2\1.10 Item Vault Version 1.2\Uniques\Exceptional\Weapons\Swords\Cloudcrack Gothic Sword.d2i



   1 - "C:\ToolBar SD\TB_1.txt" - 2008-09-01|17:25 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 2008-09-01|17:32 - Option : [2]

   -----------\  Fin du rapport a 17:32:55,10

ODDdefault · Answer

Le Rapport De MSNFix :

C:\MSNFix 
Fix exécuté le 2008-09-01 - 17:43:38,54 By POC 
mode normal    
    
************************ Recherche les fichiers présents      
    
Aucun Fichier trouvé 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Hostsclean 
 
Cleanhosts v 0.1.0.7  By Laurent

-- Backup : C:\WINDOWS\system32\drivers\etc\hosts-20080901174405
-- original size 0.67 Kb / 19 lines
-- Start cleaning Hosts file .... 



-- final size 0.67 Kb / 19 lines
-- entry Found : 0  /  Entry check : 310

End .............................. 14.56 Secondes 

 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
************************ HKLM\...\Winlogon\Userinit 
 
Userinit = C:\WINDOWS\system32\userinit.exe, 

Important : http://msnfix.changelog.fr/index.php/2008/05/18/32-alerte


------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   --------------------------------------------- 

Voici le Rapport de HijackThis: 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:45:40, on 2008-09-01
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [GEST] m’|\ü
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.systemrequirementslab.com/cyri
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

ODDdefault · Answer

Voilà le rapport de ComboFix

ComboFix 08-09-01.01 - POC 2008-09-01 17:58:12.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2880 [GMT -4:00]
Endroit: C:\Documents and Settings\POC\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\mx69169.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-08-01 to 2008-09-01 ))))))))))))))))))))))))))))))))))))
.

2008-09-01 17:42 . 2008-09-01 17:44 <REP> d-------- C:\MSNFix
2008-09-01 17:25 . 2008-09-01 17:32 2,982 --a------ C:\Documents and Settings\Orph.egd
2008-09-01 17:24 . 2008-09-01 17:32 <REP> d-------- C:\ToolBar SD
2008-09-01 16:57 . 2008-09-01 16:57 579,584 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-09-01 16:56 . 2008-09-01 16:56 <REP> d-------- C:\WINDOWS\ERUNT
2008-09-01 16:51 . 2008-09-01 17:00 <REP> d-------- C:\SDFix
2008-09-01 16:04 . 2008-09-01 16:04 <REP> d-------- C:\Documents and Settings\POC\Application Data\Malwarebytes
2008-09-01 16:04 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-01 16:04 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-01 16:03 . 2008-09-01 16:30 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-01 16:03 . 2008-09-01 16:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 00:40 . 2008-09-01 00:40 <REP> d-------- C:\Program Files\Trend Micro
2008-08-31 20:25 . 2008-08-31 21:36 <REP> d-------- C:\QUARANTINE
2008-08-31 20:05 . 2008-08-31 20:05 <REP> d-------- C:\Program Files\Lavasoft
2008-08-31 20:05 . 2008-08-31 20:05 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-31 20:05 . 2008-08-31 20:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-31 19:04 . 2008-08-31 19:04 266 --a------ C:\WINDOWS\wininit.ini
2008-08-31 18:52 . 2008-08-31 18:52 <REP> d-------- C:\Program Files\CCleaner
2008-08-31 18:51 . 2008-09-01 16:49 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-31 18:51 . 2008-09-01 16:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-30 19:30 . 2008-08-30 19:30 <REP> d-------- C:\Documents and Settings\POC\Contacts
2008-08-30 19:27 . 2008-08-30 19:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NexonUS
2008-08-30 19:11 . 2008-08-30 19:11 <REP> d-------- C:\Program Files\Winamp
2008-08-30 19:11 . 2008-08-30 19:11 <REP> d-------- C:\Documents and Settings\POC\Application Data\Winamp
2008-08-30 19:08 . 2008-08-30 19:08 <REP> d-------- C:\Documents and Settings\POC\Application Data\MSNInstaller
2008-08-30 19:06 . 2008-08-30 19:29 <REP> d-------- C:\Program Files\Windows Live
2008-08-30 19:06 . 2008-08-30 19:28 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-08-30 19:06 . 2008-08-30 19:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-30 19:03 . 2008-08-30 19:03 <REP> d-------- C:\Program Files\uTorrent
2008-08-30 19:03 . 2008-09-01 17:49 <REP> d-------- C:\Documents and Settings\POC\Application Data\uTorrent
2008-08-30 16:02 . 2008-08-30 16:02 <REP> d-------- C:\Documents and Settings\POC\Application Data\Ahead
2008-08-30 16:01 . 2008-08-30 16:01 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-08-30 15:52 . 2008-08-30 15:52 <REP> d-------- C:\Documents and Settings\POC\Application Data\DAEMON Tools
2008-08-30 15:52 . 2008-08-30 15:52 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-08-30 14:46 . 2008-04-13 15:17 83,072 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2008-08-30 14:46 . 2008-04-13 15:17 83,072 --a--c--- C:\WINDOWS\system32\dllcache\wdmaud.sys
2008-08-30 14:46 . 2001-08-23 17:04 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-08-30 14:46 . 2001-08-23 17:04 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-08-30 14:45 . 2008-04-13 14:45 60,032 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-08-30 14:45 . 2008-04-13 14:45 60,032 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-08-30 12:04 . 2008-08-30 12:04 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-08-30 12:03 . 2008-08-30 14:44 <REP> d-------- C:\Program Files\NOS
2008-08-30 12:03 . 2008-08-30 14:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NOS
2008-08-30 12:00 . 2008-08-30 12:00 <REP> d-------- C:\Documents and Settings\POC\Application Data\OfficeUpdate12
2008-08-30 11:59 . 2008-08-30 11:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-30 11:52 . 2008-08-30 11:52 <REP> d-------- C:\Program Files\MSXML 4.0
2008-08-30 11:47 . 2008-04-11 15:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-30 11:47 . 2008-05-01 10:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-30 11:47 . 2008-06-14 13:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-30 11:47 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-08-30 11:41 . 2008-08-30 11:52 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-08-30 11:41 . 2008-08-30 11:41 <REP> d-------- C:\WINDOWS\system32\fr
2008-08-30 11:41 . 2008-08-30 11:41 <REP> d-------- C:\WINDOWS\system32\bits
2008-08-30 11:41 . 2008-08-30 11:41 <REP> d-------- C:\WINDOWS\l2schemas
2008-08-30 11:40 . 2008-08-30 11:40 <REP> d-------- C:\WINDOWS\ServicePackFiles
2008-08-30 10:33 . 2008-08-30 11:54 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-08-30 10:25 . 2004-03-22 15:17 24,816 --a------ C:\WINDOWS\system32\mdimon.dll
2008-08-30 10:25 . 2008-08-30 10:25 385 --a------ C:\WINDOWS\ODBC.INI
2008-08-30 10:24 . 2008-08-30 10:24 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-08-30 10:21 . 2008-08-30 10:21 <REP> d-------- C:\Program Files\McAfee
2008-08-30 10:21 . 2008-08-30 10:21 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
2008-08-30 10:21 . 2008-08-30 10:21 <REP> d-------- C:\Program Files\Fichiers communs\Cisco Systems
2008-08-30 10:21 . 2008-08-30 10:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-08-30 10:21 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
2008-08-30 10:21 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-08-30 10:21 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-08-30 10:21 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-08-30 10:21 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-08-30 10:21 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-08-30 10:21 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
2008-08-30 10:19 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-08-30 10:19 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-08-30 10:19 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-30 10:19 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-08-30 10:19 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-30 10:18 . 2008-08-30 10:18 <REP> d--hs---- C:\Documents and Settings\POC\UserData
2008-08-30 10:13 . 2008-08-30 10:13 <REP> d-------- C:\WINDOWS\nview
2008-08-30 10:13 . 2008-08-30 10:13 <REP> d-------- C:\NVIDIA
2008-08-30 10:13 . 2008-05-16 11:48 446,464 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-08-30 10:13 . 2008-05-16 14:01 446,464 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-08-30 10:13 . 2008-09-01 17:00 186,097 --a------ C:\WINDOWS\system32\nvapps.xml
2008-08-30 10:13 . 2008-05-16 14:01 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-08-30 10:10 . 2008-08-30 11:59 <REP> d-------- C:\Driver
2008-08-30 10:09 . 2008-08-30 10:09 <REP> d-------- C:\Program Files\Nero
2008-08-30 10:09 . 2008-08-30 10:10 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2008-08-30 10:09 . 2008-08-30 10:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-08-30 10:06 . 2008-08-30 21:23 <REP> d-------- C:\Program Files\SystemRequirementsLab
2008-08-30 10:06 . 2008-09-01 17:00 <REP> d-------- C:\Program Files\lg_fwupdate
2008-08-30 10:06 . 1998-06-24 00:00 115,016 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-08-30 10:06 . 1998-07-22 00:00 102,912 --a------ C:\WINDOWS\system32\Vb6stkit.dll
2008-08-30 10:06 . 1998-07-22 00:00 102,160 --a------ C:\WINDOWS\system32\VB6KO.DLL
2008-08-30 10:06 . 2001-08-29 21:00 59,904 --a------ C:\WINDOWS\system32\wbemdisp.tlb
2008-08-30 10:06 . 2006-02-17 14:19 16,384 --a------ C:\WINDOWS\system32\lgfwunis.exe
2008-08-30 10:06 . 2008-08-30 10:06 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-08-30 10:06 . 2008-08-30 10:06 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-08-30 10:06 . 2008-09-01 17:00 265 --a------ C:\WINDOWS\lgfwup.ini
2008-08-30 10:04 . 2008-08-30 10:04 <REP> d-------- C:\MyWorks
2008-08-30 10:04 . 2007-01-08 22:17 502,816 --------- C:\WINDOWS\system32\msvcp71.dll
2008-08-30 10:04 . 2007-01-08 22:17 351,264 --------- C:\WINDOWS\system32\msvcr71.dll
2008-08-30 10:04 . 2007-01-08 22:17 27,168 --------- C:\WINDOWS\system32\msxml3a.dll
2008-08-30 10:03 . 2008-08-30 10:04 <REP> d-------- C:\Program Files\CyberLink
2008-08-30 09:58 . 2008-08-30 09:58 <REP> d-------- C:\WINDOWS\OPTIONS
2008-08-30 09:58 . 2008-01-03 10:10 105,856 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-08-30 09:57 . 2008-08-30 09:57 <REP> d-------- C:\WINDOWS\system32\Lang
2008-08-30 09:57 . 2008-08-30 09:57 <REP> d-------- C:\Documents and Settings\POC\Application Data\InstallShield
2008-08-30 09:57 . 2008-08-30 09:57 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-08-30 09:57 . 2008-08-30 09:57 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-08-30 09:57 . 2008-04-13 12:39 142,592 --a------ C:\WINDOWS\system32\drivers\aec.sys
2008-08-30 09:57 . 2008-04-13 14:45 56,576 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2008-08-30 09:57 . 2008-04-13 14:45 52,864 --a------ C:\WINDOWS\system32\drivers\dmusic.sys
2008-08-30 09:57 . 2008-04-13 14:45 6,272 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-08-30 09:55 . 2008-08-30 09:58 <REP> d-------- C:\Program Files\Realtek
2008-08-30 09:55 . 2008-05-07 03:39 16,862,208 -r------- C:\WINDOWS\RTHDCPL.exe
2008-08-30 09:55 . 2007-03-23 07:19 9,715,200 -r------- C:\WINDOWS\RTLCPL.exe
2008-08-30 09:55 . 2008-05-07 07:21 4,739,072 -r------- C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-08-30 09:55 . 2006-05-04 04:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe
2008-08-30 09:55 . 2007-06-28 04:44 2,165,760 -r------- C:\WINDOWS\MicCal.exe
2008-08-30 09:55 . 2008-03-05 06:07 520,192 -r------- C:\WINDOWS\RtlExUpd.dll
2008-08-30 09:55 . 2008-08-30 09:55 315,392 --a------ C:\WINDOWS\HideWin.exe
2008-08-30 09:55 . 2005-09-20 22:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.cpl
2008-08-30 09:55 . 2005-05-03 06:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-08-30 09:55 . 2007-08-10 08:18 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-08-30 09:53 . 2008-08-30 19:29 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-08-30 09:53 . 2008-08-30 09:53 <REP> d-------- C:\Program Files\Intel
2008-08-30 09:53 . 2008-03-25 23:15 53,248 -ra------ C:\WINDOWS\system32\CSVer.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-31 01:41 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-31 01:40 --------- d-----w C:\Program Files\Services en ligne
2008-07-21 16:52 524,288 ----a-w C:\WINDOWS\opuc.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 22:33 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 11:02 490952]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="m’|\ü" [X]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 21:01 71216]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 22:17 52256]
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" [2007-02-26 10:40 249856]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 20:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-03 19:02 36352]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-07 03:39 16862208 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 22:33 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"E:\Jeux\Combat Arms\Engine.exe"= E:\Jeux\Combat Arms\Engine.exe:*Enabled:Engine.exe
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"E:\\Jeux\\Combat Arms\\NMService.exe"=
"E:\Jeux\Combat Arms\CombatArms.exe"= E:\Jeux\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"E:\\Jeux\\Diablo II\\Diablo II.exe"=

R2 GEST Service;GEST Service for program management.;C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe [2008-05-13 18:07]

*Newly Created Service* - PROCEXP90
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKLM-Main,Window Title =
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
C:\WINDOWS\Downloaded Program Files\SysReqLab3.osd
C:\WINDOWS\Downloaded Program Files\sysreqlab3.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-01 17:58:52
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-09-01 17:59:12
ComboFix-quarantined-files.txt 2008-09-01 21:59:10

Pre-Run: 68,188,127,232 octets libres
Post-Run: 68,185,317,376 octets libres

215 --- E O F --- 2008-09-01 05:36:18

ODDdefault · Answer

Le rapport Smitfraudfix

SmitFraudFix v2.345

Rapport fait à 18:32:41,07, 2008-09-01
Executé à partir de C:\Documents and Settings\POC\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\POC


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\POC\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\POC\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5E61E327-20F8-444B-A7CA-11995AB02D30}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5E61E327-20F8-444B-A7CA-11995AB02D30}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5E61E327-20F8-444B-A7CA-11995AB02D30}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

ODDdefault · Answer

Si le problème n'est pas reglé avec Smitfraud, je devrai attendre à la fin de semaine prochaine car je n'aurais pas accès à mon ordinateur pendant la semaine.

Virus Alert !

11 réponses

Discussions similaires

Newsletters