Vous souhaitez réagir à ce message ? Créez un compte en quelques clics ou connectez-vous pour continuer.



 
AccueilRechercherDernières imagesS'enregistrerConnexionRootkit Win32:Rootkit-gen [Rtk] Site_web_animeRootkit Win32:Rootkit-gen [Rtk] Formation
Statistiques Antivir
Rechercher
 
 

Résultats par :
 
Rechercher Recherche avancée
Derniers sujets
» Infection + PC très lent
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 14 Déc - 22:03:56 par Fred_R

» J'ai quelque chose qui est en train de bouffer mon pc
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 5 Mai - 19:12:45 par Marco2404

» systeme de plugin a l'adress 0*e4783995 a recu l'erreur critique
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeLun 20 Juin - 15:58:24 par rositaa

» Démarrage bloquer
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 30 Jan - 19:55:46 par Nemesis31

» scan Security tool virus
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 30 Jan - 19:54:57 par Nemesis31

» coupure du PC
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeMer 9 Déc - 22:40:37 par Nemesis31

» Mon Pc Ram Comme Un Fou :@
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeMar 3 Nov - 0:18:46 par shion-ares

» coupure d'internet tout les 5 minutes plus d'executer sous xp
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeJeu 10 Sep - 0:28:07 par gollum

» soupson d'infection
Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeJeu 3 Sep - 13:42:30 par Nemesis31

Navigation
 Accueil
 Membres
 Profil
 FAQ
 Rechercher
Connexion
Nom d'utilisateur:
Mot de passe:
Connexion automatique: 
:: Récupérer mon mot de passe
Partenaires
Forum gratuit



Tchat Blablaland


Meilleurs posteurs
geoffrey5
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
shion-ares
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
plopus
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
didier68
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
Anthony5151
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
Juliensl
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
bluestyle
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
ginga
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
Nemesis31
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
gobiel
Rootkit Win32:Rootkit-gen [Rtk] Vote_lcapRootkit Win32:Rootkit-gen [Rtk] Voting_barRootkit Win32:Rootkit-gen [Rtk] Vote_rcap 
La boutique du forum
vous avez la possibilité d'acheter des articles propres au forum
Sondage
Le Deal du moment : -20%
Ecran PC GIGABYTE 28″ LED M28U 4K ( IPS, 1 ms, ...
Voir le deal
399 €

 :: Forums :: Virus/Sécurité
 

 Rootkit Win32:Rootkit-gen [Rtk]

Aller en bas 
3 participants
Aller à la page : 1, 2  Suivant
AuteurMessage
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeJeu 26 Mar - 17:03:53
bonjour avast me détecte un Rootkit a chaque ouverture de session avec le nom Win32:Rootkit-gen [Rtk] se trouvant la C:\Windows\System32\win.exe, jai lancé une analyse avg et malwarebytes mais ils n'ont rien trouvés, comme symptome a ce Rootkit je ne peut plus ouvrir le gestionaire de tâche Evil or Very Mad
jespere que je pourrai avoir un peut aide ici merci d'avance Very Happy


Dernière édition par Serkai le Dim 29 Mar - 20:09:07, édité 1 fois
Revenir en haut Aller en bas
Anthony5151
Modérateur
Modérateur
Anthony5151


Masculin
Nombre de messages : 177
Age : 36
Localisation : Reims (51)
Système d\'exploitation * : Vista / Ubuntu
Date d'inscription : 03/12/2008

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeJeu 26 Mar - 21:13:19
Bonjour,


J'ai déplacé ton sujet dans la partie Virus/Sécurité.
Je te poste la suite dans 2 minutes
Revenir en haut Aller en bas
Anthony5151
Modérateur
Modérateur
Anthony5151


Masculin
Nombre de messages : 177
Age : 36
Localisation : Reims (51)
Système d\'exploitation * : Vista / Ubuntu
Date d'inscription : 03/12/2008

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeJeu 26 Mar - 21:21:04
Re,


Il va falloir que tu fasses tout ce qui suit pour diagnostiquer le problème stp :


• Télécharge Random's System Information Tool (RSIT) de random/random, et enregistre le sur ton Bureau.
• Double clique sur RSIT.exe pour lancer l'outil.
• Clique sur ' continue ' à l'écran Disclaimer.
• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés



• Télécharge Rooter (créé par l'équipe IDN) sur ton Bureau.
/!\ Déconnecte toi d'internet et ferme toutes les applications en cours /!\
• Exécute Rooter et laisse le travailler jusqu'à l'apparition du rapport dans le bloc note
• Poste le rapport dans ta prochaine réponse.



• Rends toi sur le site http://www.virustotal.com/fr/
• Clique sur Parcourir, et navigue jusqu'au fichier suivant et valide : C:\Windows\System32\win.exe
• Clique sur "Envoyer le fichier" : s'il a déjà été analysé, demande une nouvelle analyse.
• Fais un copier/coller du rapport sur le forum.

Si tu ne trouves pas le fichier, fais ceci :
• Menu Démarrer --> Panneau de configuration --> Options des dossiers --> Affichage
• Coche "Afficher les fichiers et dossiers cachés", décoche "Masquer les extensions de fichiers connus", décoche "Masquer les fichiers protégés du Système", puis valide.
• Tu pourras à nouveau masquer les fichiers cachés une fois la manipulation terminée, si tu le souhaites.
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeJeu 26 Mar - 23:47:26
merci de prendre du temps pour m'aider
je vais déjà poster le rapport Malwarebytes et j'effectuerais les autres test demain ce soir je n'ai pas trop de temps.

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1900
Windows 6.0.6001 Service Pack 1

26/03/2009 17:57:35
mbam-log-2009-03-26 (17-57-35).txt

Type de recherche: Examen complet (C:\|D:\|F:\|)
Eléments examinés: 255385
Temps écoulé: 3 hour(s), 17 minute(s), 44 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe (Security.Hijack) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon (Backdoor.Poison) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regdiit (Backdoor.Poison) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Windows\System32\winjpg.jpg (Backdoor.Poison) -> Delete on reboot.
C:\winfile.jpg (Backdoor.Poison) -> Quarantined and deleted successfully.
C:\Windows\System32\wscript.exe (Backdoor.Poison) -> Delete on reboot.
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeJeu 26 Mar - 23:55:25
pour le rapport HijackThis Shocked

Logfile of random's system information tool 1.06 (written by random/random)
Run by Utilisateur at 2009-03-26 21:54:54
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 14 GB (15%) free of 92 GB
Total RAM: 2046 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:55:00, on 26/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\wscript.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\conime.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\system32\Wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Windows\system32\wscript.exe
C:\Users\Utilisateur\Downloads\RSIT.exe
C:\Program Files\trend micro\Utilisateur.exe
C:\Windows\system32\msfeedssync.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = .-~= 0508722265 =~-.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [CTFMON] C:\Windows\system32\wscript.exe /E:vbs C:\Windows\system32\winjpg.jpg
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: is-OGB06.lnk = Desktop\Virus Removal Tool\is-OGB06\startup.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {9E065E4A-BD9D-4547-8F90-985DC62A5591} (PlayerPT Control) - http://86.64.74.118/PlayerPT.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B49F3DDF-D851-4D91-93CD-C72007A71DF8}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{CD3F14F3-FD4B-4A71-B323-E0574F546654}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\Windows\system32\libusbd-nt.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 15016 bytes
Revenir en haut Aller en bas
Anthony5151
Modérateur
Modérateur
Anthony5151


Masculin
Nombre de messages : 177
Age : 36
Localisation : Reims (51)
Système d\'exploitation * : Vista / Ubuntu
Date d'inscription : 03/12/2008

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeVen 27 Mar - 2:58:39
Dans un rapport RSIT, tout est important, pas seulement la partie "hijackthis"
Il faudra que tu postes le reste stp (envoie le en plusieurs fois si ça ne passe pas, ou par MP).

Mais je vois déjà au moins deux infections.

J'attends donc la fin du rapport RSIT, le rapport VirusTotal et celui de Rooter Wink

A demain
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeVen 27 Mar - 20:29:58
yes malwarebytes (trouver sur ce site internet Cool) ma supprimer mon virus a mon reboot d'ordi Very Happy merci quand même d'avoir prêté attention a mon topic
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeVen 27 Mar - 20:33:23
ce virus que javais choper à mon lycée affraid c'était mi sur ma clee usb
petite question a la con Suspect jai mi ma clee usb dans ma ps3 est ce que le virus a pu ce propager dans ma ps3 ? et recontaminer ma clee usb ou autre peripherique (je ne pense pas mais je voudrai être sur a 100%)
et je met antivir ou avast en antivirus ? le site conseil antivir est il réellement plus fiable ?
Revenir en haut Aller en bas
plopus
Helper
Helper



Masculin
Nombre de messages : 238
Age : 38
Localisation : isere
Date d'inscription : 20/01/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeVen 27 Mar - 22:28:01
Salut ici

tout a fait si tu ne poste pas la suite du rapport RSIT pour qu'Anthony te fasse supprimer lz clefs de regsitre et passer un fix specifique cette infection USB ce relancera toujours et contamineras les PC auxquel tu la branche pour la PS3 je sais pas sa depend des virus.

mais pour suivre poste le rapport RSIT surtout le LOG.TXT en ENTIER pour qu'il puisse t'aider comme il faut et apparament tu es encore infecté en +
Revenir en haut Aller en bas
Anthony5151
Modérateur
Modérateur
Anthony5151


Masculin
Nombre de messages : 177
Age : 36
Localisation : Reims (51)
Système d\'exploitation * : Vista / Ubuntu
Date d'inscription : 03/12/2008

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 1:19:50
Effectivement (merci plopus Wink), si tu ne postes pas le rapport de RSIT en entier, je ne peux pas t'aider.

Fais ce que je te dis stp, je te dirais quand la désinfection sera terminée.

Pour l'antivirus, AntiVir est plus performant qu'Avast, c'est certain Wink
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 15:17:31
Logfile of random's system information tool 1.06 (written by random/random)
Run by Utilisateur at 2009-03-28 13:13:36
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 17 GB (19%) free of 92 GB
Total RAM: 2046 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:14:08, on 28/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\System32\mobsync.exe
C:\Users\Utilisateur\Downloads\RSIT.exe
C:\Program Files\trend micro\Utilisateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = .-~= 0508722265 =~-.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: is-OGB06.lnk = Desktop\Virus Removal Tool\is-OGB06\startup.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {9E065E4A-BD9D-4547-8F90-985DC62A5591} (PlayerPT Control) - http://86.64.74.118/PlayerPT.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B49F3DDF-D851-4D91-93CD-C72007A71DF8}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\Windows\system32\libusbd-nt.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 12881 bytes
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 15:18:28
======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{DE07AA01-D503-43FC-90CA-C85F00D4B173}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{19C8E43B-07B3-49CB-BFFC-6777B593E6F8}]
Download Manager Browser Helper Object - C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL [2007-05-21 525792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-02-24 251504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2009-02-24 657904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2009-02-24 522224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - C:\PROGRA~1\GOOGLE~1\BAE.dll [2006-06-23 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-10-14 863688]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-02-24 251504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-04-08 4423680]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-03-10 835584]
"ISBMgr.exe"=C:\Program Files\Sony\ISB Utility\ISBMgr.exe [2007-06-11 317560]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY]
C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-03-22 1932568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-02-16 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]
C:\Program Files\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Sipru.lnk]
C:\PROGRA~1\Sipru\sipru.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Utilisateur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
C:\PROGRA~1\MICROS~2\Office12\ONENOTEM.EXE [2007-12-07 101440]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
is-OGB06.lnk - C:\Users\Utilisateur\Desktop\Virus Removal Tool\is-OGB06\startup.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
igfxdev.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon]
C:\Windows\system32\VESWinlogon.dll [2007-07-24 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableCMD"=0
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ec63c86-3a18-11dd-b98f-001bfb85e5b3}]
shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a54c2c6f-a680-11dd-a874-001bfb85e5b3}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e94cd1bb-9a1f-11dd-b408-001a803bc9e4}]
shell\AutoRun\command - J:\autorun.exe


======File associations======
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 15:18:52
.js - open -
.vbs - open -

======List of files/folders created in the last 1 months======

2009-03-27 19:17:44 ----SHD---- C:\Windows\ftpcache
2009-03-27 18:17:17 ----D---- C:\Avenger
2009-03-27 18:17:17 ----A---- C:\avenger.txt
2009-03-26 22:22:42 ----D---- C:\Rooter$
2009-03-26 21:39:06 ----D---- C:\Program Files\trend micro
2009-03-26 21:39:05 ----D---- C:\rsit
2009-03-26 16:24:40 ----A---- C:\Windows\system32\javaws.exe
2009-03-26 16:24:40 ----A---- C:\Windows\system32\javaw.exe
2009-03-26 16:24:39 ----A---- C:\Windows\system32\java.exe
2009-03-26 14:33:48 ----D---- C:\Users\Utilisateur\AppData\Roaming\Malwarebytes
2009-03-26 14:33:40 ----D---- C:\ProgramData\Malwarebytes
2009-03-26 14:33:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-03-22 13:15:17 ----HD---- C:\$AVG8.VAULT$
2009-03-22 11:42:16 ----A---- C:\Windows\system32\avgrsstx.dll
2009-03-22 11:41:32 ----D---- C:\Program Files\AVG
2009-03-22 11:41:31 ----D---- C:\ProgramData\avg8
2009-03-10 22:49:44 ----A---- C:\Windows\system32\wmp.dll
2009-03-10 22:49:43 ----A---- C:\Windows\system32\spwmp.dll
2009-03-10 22:49:43 ----A---- C:\Windows\system32\dxmasf.dll
2009-03-10 22:49:42 ----A---- C:\Windows\system32\wmploc.DLL
2009-03-10 22:49:37 ----A---- C:\Windows\system32\schannel.dll
2009-03-02 15:27:18 ----HD---- C:\Windows\PIF

======List of files/folders modified in the last 1 months======

2009-03-28 13:14:06 ----D---- C:\Windows\Temp
2009-03-28 13:12:44 ----D---- C:\Windows
2009-03-28 12:58:39 ----D---- C:\Program Files\Mozilla Firefox
2009-03-28 01:45:38 ----D---- C:\Users\Utilisateur\AppData\Roaming\uTorrent
2009-03-27 22:09:18 ----SHD---- C:\System Volume Information
2009-03-27 21:09:01 ----D---- C:\Windows\system32\catroot2
2009-03-27 20:43:21 ----SD---- C:\Users\Utilisateur\AppData\Roaming\Microsoft
2009-03-27 20:43:21 ----D---- C:\Windows\system32\drivers
2009-03-27 20:43:21 ----D---- C:\Windows\System32
2009-03-27 20:43:15 ----D---- C:\ProgramData
2009-03-27 20:43:09 ----D---- C:\Windows\system32\Tasks
2009-03-27 20:23:42 ----HD---- C:\Program Files\InstallShield Installation Information
2009-03-27 20:23:42 ----D---- C:\Program Files\Sony
2009-03-27 19:23:23 ----D---- C:\Update
2009-03-27 19:21:51 ----SHD---- C:\Windows\Installer
2009-03-27 19:21:51 ----HD---- C:\Config.Msi
2009-03-27 19:09:57 ----D---- C:\Big Fish Games
2009-03-27 19:09:17 ----RD---- C:\Program Files
2009-03-27 18:45:33 ----D---- C:\Windows\Debug
2009-03-27 18:39:43 ----D---- C:\Program Files\Cain
2009-03-26 16:24:34 ----D---- C:\Program Files\Java
2009-03-25 14:03:26 ----D---- C:\Windows\Prefetch
2009-03-22 16:39:51 ----D---- C:\Users\Utilisateur\AppData\Roaming\dvdcss
2009-03-15 17:35:26 ----D---- C:\Program Files\Veetle
2009-03-15 14:12:47 ----D---- C:\Program Files\World of Warcraft
2009-03-12 18:47:15 ----D---- C:\Windows\winsxs
2009-03-11 23:03:53 ----D---- C:\Windows\system32\catroot
2009-03-11 23:00:48 ----D---- C:\Program Files\Windows Media Player
2009-03-11 23:00:47 ----D---- C:\Program Files\Windows Mail
2009-03-11 11:32:35 ----D---- C:\ProgramData\Microsoft Help
2009-03-09 05:19:08 ----A---- C:\Windows\system32\deploytk.dll
2009-03-08 15:17:47 ----D---- C:\Windows\inf
2009-03-08 15:17:47 ----A---- C:\Windows\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-02-05 23152]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 AvgLdx86;AVG AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-03-22 325640]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\Windows\System32\Drivers\avgmfx86.sys [2009-03-22 27656]
R1 AvgTdiX;AVG8 Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2009-03-24 108552]
R1 DMICall;Sony DMI Call service; C:\Windows\system32\DRIVERS\DMICall.sys [2007-06-27 10216]
R1 is-OGB06drv;is-OGB06drv; C:\Windows\system32\DRIVERS\64900864.sys [2008-07-08 148496]
R1 Ndisprot;RawPacket NDIS Protocol Driver; C:\Windows\system32\DRIVERS\ndisprot.sys [2003-10-24 22016]
R1 Tosrfcom;Bluetooth RFCOMM; C:\Windows\System32\Drivers\tosrfcom.sys [2005-08-01 64896]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-02-05 51792]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2007-06-16 12672]
R2 regi;regi; C:\Windows\system32\drivers\regi.sys [2007-04-17 11032]
R2 RMCAST;Pilote du protocole RMCAT PGMP; C:\Windows\system32\DRIVERS\RMCAST.sys [2008-06-14 113664]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-06-16 8192]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-07 2591232]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-06-16 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-06-16 207360]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-04-08 1761696]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1; C:\Windows\system32\drivers\libusb0.sys [2005-03-09 33792]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-09-25 3666432]
R3 R5U870FLx86;R5U870 UVC Lower Filter ; C:\Windows\System32\Drivers\R5U870FLx86.sys [2007-04-20 73472]
R3 R5U870FUx86;R5U870 UVC Upper Filter ; C:\Windows\System32\Drivers\R5U870FUx86.sys [2007-04-20 43904]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-11-10 135680]
R3 SNC;Sony Firmware Extension Parser Device; C:\Windows\System32\Drivers\SonyNC.sys [2006-11-06 27520]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-03-10 181560]
R3 ti21sony;ti21sony; C:\Windows\system32\drivers\ti21sony.sys [2007-06-06 812544]
R3 tosporte;Bluetooth COM Port; C:\Windows\system32\DRIVERS\tosporte.sys [2006-10-10 41600]
R3 usbvideo;R5U870 (UVC) ; C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-06-16 659968]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 akr2uppf;akr2uppf; C:\Windows\system32\drivers\akr2uppf.sys []
S3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2008-11-17 15360]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2008-10-25 25280]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys []
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETw4v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw4v32.sys [2008-03-13 2555392]
S3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 TcUsb;TC USB Kernel Driver; C:\Windows\System32\Drivers\tcusb.sys [2007-05-29 46992]
S3 tosrfbd;Bluetooth RFBUS; C:\Windows\system32\DRIVERS\tosrfbd.sys [2007-04-24 113920]
S3 tosrfbnp;Bluetooth RFBNEP; C:\Windows\System32\Drivers\tosrfbnp.sys [2006-11-20 36480]
S3 Tosrfhid;Bluetooth RFHID; C:\Windows\system32\DRIVERS\Tosrfhid.sys [2007-03-01 73728]
S3 tosrfnds;Bluetooth Personal Area Network; C:\Windows\system32\DRIVERS\tosrfnds.sys [2005-01-06 18612]
S3 tosrfusb;Bluetooth USB Controller; C:\Windows\system32\DRIVERS\tosrfusb.sys [2007-04-24 41856]
S3 usbbus;LGE Mobile Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2005-08-29 21344]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2005-08-29 38144]
S3 USBModem;LGE Mobile USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2005-08-29 39248]
S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2007-02-13 128104]
S4 UIUSys;Conexant Setup API; C:\Windows\system32\DRIVERS\UIUSYS.SYS []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeActiveFileMonitor5.0;Adobe Active File Monitor V5; C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [2006-12-22 108712]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-07-07 593920]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-03-22 298264]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 EvtEng;Intel® PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2008-10-02 860160]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1; C:\Windows\system32\libusbd-nt.exe [2005-03-09 18944]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 RegSrvc;Intel® PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2008-10-02 466944]
R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-25 125048]
R2 VAIO Event Service;VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [2007-07-24 182392]
R2 VzCdbSvc;VAIO Entertainment Database Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [2007-08-28 192512]
R2 VzFw;VAIO Entertainment File Import Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [2007-08-28 131072]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-06-16 386560]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R3 Vcsw;VAIO Entertainment UPnP Client Adapter; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [2007-06-28 274432]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-24 137200]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2008-11-17 195752]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 MSCSPTISRV;MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [2006-12-14 45056]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PACSPTISVR;PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [2006-12-14 57344]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 SPTISRV;Sony SPTI Service; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [2006-12-14 69632]
S3 VAIO Entertainment TV Device Arbitration Service;VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe [2007-06-28 73728]
S3 VAIOMediaPlatform-IntegratedServer-AppServer;VAIO Media Integrated Server; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2007-06-20 2523136]
S3 VAIOMediaPlatform-IntegratedServer-HTTP;VAIO Media Integrated Server (HTTP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
S3 VAIOMediaPlatform-IntegratedServer-UPnP;VAIO Media Integrated Server (UPnP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
S3 VAIOMediaPlatform-Mobile-Gateway;VAIO Media Gateway Server; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe [2007-06-20 499712]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection; C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]
S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2007-07-05 292152]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface; C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2008-03-17 87328]

-----------------EOF-----------------
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 15:25:00
rapport rooter:

Microsoft Windows Vista Home Edition (6.0.6001) Service Pack 1

C:\ [Fixed] - NTFS - (Total:91990 Mo/Free:935 Mo)
D:\ [Removable] (Total:0 Mo/Free:0 Mo)
E:\ [Removable] (Total:0 Mo/Free:0 Mo)
F:\ [Fixed] - NTFS - (Total:89486 Mo/Free:1558 Mo)
G:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)
J:\ [CD-Rom] (Total:0 Mo/Free:0 Mo)

28/03/2009|13:23

----------------------\\ Processes..

--Locked-- [System Process]
--Locked-- System
---------- \SystemRoot\System32\smss.exe
---------- C:\Windows\system32\csrss.exe
---------- C:\Windows\system32\wininit.exe
---------- C:\Windows\system32\csrss.exe
---------- C:\Windows\system32\services.exe
---------- C:\Windows\system32\lsass.exe
---------- C:\Windows\system32\lsm.exe
---------- C:\Windows\system32\winlogon.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\system32\Ati2evxx.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\system32\svchost.exe
--Locked-- audiodg.exe
---------- C:\Windows\system32\SLsvc.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\system32\Ati2evxx.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Windows\system32\WLANExt.exe
---------- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
---------- C:\Program Files\Alwil Software\Avast4\ashServ.exe
---------- C:\Windows\System32\spoolsv.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
---------- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
---------- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
---------- C:\Program Files\Bonjour\mDNSResponder.exe
---------- C:\Program Files\Intel\WiFi\bin\EvtEng.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
---------- C:\Windows\system32\libusbd-nt.exe
---------- C:\PROGRA~1\AVG\AVG8\avgam.exe
---------- C:\PROGRA~1\AVG\AVG8\avgrsx.exe
---------- C:\PROGRA~1\AVG\AVG8\avgnsx.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
---------- C:\Windows\system32\svchost.exe
---------- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
---------- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
---------- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
---------- C:\Windows\System32\svchost.exe
---------- C:\Windows\system32\SearchIndexer.exe
---------- C:\Windows\system32\DRIVERS\xaudio.exe
---------- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
---------- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
---------- C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
---------- C:\Windows\system32\WUDFHost.exe
---------- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
---------- C:\Windows\system32\Dwm.exe
---------- C:\Windows\system32\taskeng.exe
---------- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
---------- C:\Windows\system32\wbem\wmiprvse.exe
---------- C:\Windows\system32\taskeng.exe
---------- C:\Windows\Explorer.EXE
---------- C:\Program Files\Windows Defender\MSASCui.exe
---------- C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
---------- C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
---------- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
---------- C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
---------- C:\Program Files\Sony\ISB Utility\ISBMgr.exe
---------- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
---------- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
---------- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
---------- C:\Program Files\Java\jre6\bin\jusched.exe
---------- C:\Windows\ehome\ehtray.exe
---------- C:\Program Files\Windows Sidebar\sidebar.exe
---------- C:\Windows\system32\wbem\unsecapp.exe
---------- C:\Program Files\Windows Media Player\wmpnscfg.exe
---------- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
---------- C:\Windows\ehome\ehmsas.exe
---------- C:\Program Files\Windows Media Player\wmpnetwk.exe
---------- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
---------- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
---------- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
---------- C:\Program Files\Windows Sidebar\sidebar.exe
---------- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
---------- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
---------- C:\Windows\system32\conime.exe
---------- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
---------- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
---------- C:\Windows\system32\SearchProtocolHost.exe
---------- C:\Windows\system32\SearchFilterHost.exe
--Locked-- Rooter.exe
---------- C:\Windows\system32\cmd.exe
---------- C:\Rooter$\RK.exe

----------------------\\ Search..

----------------------\\ ROOTKIT !!


----------------------\\ Cracks & Keygens..

C:\Users\UTILIS~1\AppData\Roaming\uTorrent\Update_FM2009_v9.2.0-Patch_et_Activation_Crack_FR_(Update_9.2.0_et_9.1.0_incluse)-M777.rar.torrent


1 - "C:\Rooter$\Rooter_1.txt" - 28/03/2009|13:20
2 - "C:\Rooter$\Rooter_2.txt" - 28/03/2009|13:23

----------------------\\ Scan completed at 13:23
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 15:34:28
win.com













Antivirus Version Dernière mise à jour Résultat
a-squared4.0.0.1012009.03.28-
AhnLab-V35.0.0.22009.03.28-
AntiVir7.9.0.1292009.03.27-
Antiy-AVL2.0.3.12009.03.28-
Authentium5.1.2.42009.03.27-
Avast4.8.1335.02009.03.27-
AVG8.5.0.2852009.03.28-
BitDefender7.22009.03.28-
CAT-QuickHeal10.002009.03.28-
ClamAV0.94.12009.03.28-
Comodo10872009.03.28-
DrWeb4.44.0.091702009.03.28-
eSafe7.0.17.02009.03.27-
eTrust-Vet31.6.64212009.03.27-
F-Prot4.4.4.562009.03.27-
F-Secure8.0.14470.02009.03.28-
Fortinet3.117.0.02009.03.28-
GData192009.03.28-
IkarusT3.1.1.48.02009.03.28-
K7AntiVirus7.10.6832009.03.27-
Kaspersky7.0.0.1252009.03.28-
McAfee55662009.03.27-
McAfee+Artemis55662009.03.27-
McAfee-GW-Edition6.7.62009.03.28-
Microsoft1.45022009.03.27-
NOD3239722009.03.28-
Norman6.00.062009.03.27-
nProtect2009.1.8.02009.03.28-
Panda10.0.0.102009.03.27-
PCTools4.4.2.02009.03.28-
Prevx1V22009.03.28-
Rising21.22.52.002009.03.28-
Sophos4.40.02009.03.28-
Sunbelt3.2.1858.22009.03.28-
Symantec1.4.4.122009.03.28-
TheHacker6.3.3.8.2942009.03.28-
TrendMicro8.700.0.10042009.03.28-
VBA323.12.10.12009.03.27-
ViRobot2009.3.27.16662009.03.27-


Information additionnelle
File size: 6656 bytes
MD5...: eac3e6e01135b8b97e02139a18400534
SHA1..: 29966385d3964009982a79dfc9e54b7b363b715f
SHA256: cdfb2e16fea379a45e0ebd7599dc2266ec5bddf9db10ed45c442858045cc7a4a
SHA512: 0c937067e479b140b8dc533c6a46940386b1c472dd1b3dbbd15c21b94424778f
6cdf9a751f18c70e0c560fb2cae811586aadc853943aa8de568b5daac9803e52
ssdeep: 96:siDizAAGYUWgCE8Xnahu2xBWEN+qN4DEW93CGEbWwxHAD+:siDizJgM332xBW
ENVN4IW93CRbWiA
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x154e
timedatestamp.....: 0x4549ade9 (Thu Nov 02 08:35:53 2006)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xdaa 0xe00 5.96 96b79954f57f3c7d4dd70984d52eb8f0
.data 0x2000 0x37c 0x200 0.30 a497d24ecb6e112af339fa7456a7af7f
.rsrc 0x3000 0x3e0 0x400 3.29 21cc7efac2c6c4fc9370c635044150fe
.reloc 0x4000 0x190 0x200 4.12 95ef5f1e78918c2ae2e14e81f96bb613

( 2 imports )
>
KERNEL32.dll: GetExitCodeProcess, WaitForSingleObject, CloseHandle,
GetLastError, CreateProcessA, GetCurrentProcess, TerminateProcess,
GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId,
GetTickCount, QueryPerformanceCounter, GetModuleHandleA,
SetUnhandledExceptionFilter, GetStartupInfoA,
InterlockedCompareExchange, Sleep, InterlockedExchange,
UnhandledExceptionFilter
> msvcrt.dll: __set_app_type,
__p__fmode, _except_handler4_common, _controlfp, __p__commode,
_adjust_fdiv, __setusermatherr, _amsg_exit, _initterm, _acmdln, exit,
_ismbblead, _XcptFilter, _exit, _cexit, __getmainargs, memset,
_terminate@@YAXXZ

( 0 exports )
RDS...: NSRL Reference Data Set

( Microsoft )

>
Installed Vista Ultimate:
win.com,x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.0.6000.16386_none_fbd6b71e75a2c6c8_win.com_ca2eda11
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 15:36:57
pour le fichier win.exe je sais pas si c'est un fichier caché par le virus m'enpèche di avoir accès et en fichier visible il y a win .com pas pas en .exe confused

et pour mon probleme de gestionnaire de tache avast et avg e detect plus rien mais toujours impossible d'ouvir le gestionaire de tache
Revenir en haut Aller en bas
Anthony5151
Modérateur
Modérateur
Anthony5151


Masculin
Nombre de messages : 177
Age : 36
Localisation : Reims (51)
Système d\'exploitation * : Vista / Ubuntu
Date d'inscription : 03/12/2008

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 20:16:34
Je vois encore deux infections sur ton ordinateur, on va donc devoir utiliser plusieurs programmes pour désinfecter.


Il y a une barre d'outil néfaste sur ton ordinateur (Daemon Tools Toolbar)...
Lors de l'installation de programmes gratuits, il faut lire attentivement et décocher tous les programmes additionnels qui sont proposés, en particulier les barres d'outil !


Télécharge Toolbar-S&D (Team IDN) sur ton Bureau

• Fais un clic-droit sur le raccourci de Toolbar-S&D sur le Bureau et choisis "Exécuter en tant qu' Administrateur"
• Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
• Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
• Poste le rapport généré. (C:\TB.txt)



Tu as aussi une infection qui se transmet par disque amovible.

Télécharge Flash Disinfector (de sUBs) sur ton Bureau.
• Fais un clic-droit sur le raccourci de FlashDisinfector et choisis "Exécuter en tant qu'administrateur"
• Une fenêtre "Start Flash Disinfector" va apparaître --> branche tous tes disques amovibles (clés USB, lecteurs mp3, disques durs externes, iPod...) et clique sur OK.
• Tes icônes vont disparaitre, c'est normal, ne touche à rien pendant la désinfection.
• Lorsque le message "Finish" apparaît, clique sur OK.

Remarque : ton antivirus peut afficher une alerte pour ce programme, c'est bien sûr une fausse alerte. Si c'est le cas, désactive le temporairement.
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 20:34:04
-----------\\ ToolBar S&D 1.2.8 XP/Vista


"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 28/03/2009|18:32 )

[ UAC => 0 ]

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\DAEMON Tools Toolbar
C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
C:\Program Files\DAEMON Tools Toolbar\Resources
C:\Program Files\DAEMON Tools Toolbar\uninst.exe
C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome.manifest
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\install.rdf
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome\dttoolbar.jar
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.xpt
C:\Program Files\DAEMON Tools Toolbar\Resources\about.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\AboutWindow.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\as.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\as.png
C:\Program Files\DAEMON Tools Toolbar\Resources\astro.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\b1.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\b1.png
C:\Program Files\DAEMON Tools Toolbar\Resources\BurnImage.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\buy.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\cond000.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond001.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond003.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond004.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond005.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond006.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond007.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond008.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond009.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond010.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond011.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond019.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond020.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond021.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond022.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond023.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond024.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond025.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond026.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond037.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond038.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond039.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond040.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond041.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond046.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond048.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond050.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond051.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond052.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond053.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond054.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond055.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond056.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond057.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond058.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond059.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond060.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond061.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond062.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond063.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond064.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond065.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond066.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond067.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond068.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond069.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond075.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond076.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond077.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond078.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond079.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond080.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond084.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond085.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond086.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond087.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond088.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond089.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond090.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond091.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond092.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond093.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond094.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond095.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond108.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond109.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond110.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond111.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond112.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond113.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond120.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond121.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond122.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond126.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond127.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond128.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond129.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond130.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond131.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond132.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond133.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond134.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond135.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond136.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond137.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond138.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond140.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond141.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond142.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond143.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond148.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond149.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond152.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond154.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond155.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond156.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond157.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\Config.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\d.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\d2.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\daemon.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\ds.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\dsearch.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\dt.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\DTPro.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\Dwnl.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\emulation.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\features.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\gd.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\genre.xml
C:\Program Files\DAEMON Tools Toolbar\Resources\globe.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\GrabImage.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\hb.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\hb.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\help.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\ip.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\lang.xml
C:\Program Files\DAEMON Tools Toolbar\Resources\lingvo.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\m.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\mail.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mail_disable.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mail_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mail_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mail_under.bmp
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 20:34:26
C:\Program Files\DAEMON Tools Toolbar\Resources\MenuRadioConfig.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\MenuRadioStation.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\MenuTr.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\next.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\next_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\next_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\next_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\none.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\none_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\noW.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\op.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\play.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\play.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\play_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\play_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\play_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\pragma.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\prev.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\prev_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\prev_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\prev_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\prod.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\Radio.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioBg.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioBgMask.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDisp.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDisp_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioError.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioError_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioSmallDisp.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioSmallDisp_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioVolume.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioVolume_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioVolume_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioVolume_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioWait.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioWait_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\refresh.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Rss.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\Rss1.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\rssClose.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\rssL.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\rssOpen.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\size.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\size_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\skins.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\spt.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\stop.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\stop.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\stop_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\stop_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\stop_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\SupportRequest.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\time.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\TitleIcon.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\toolbar.xml
C:\Program Files\DAEMON Tools Toolbar\Resources\trans.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\u.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\vol.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_back.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_dott.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_dott_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wb.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m42.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m43.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wi.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi0.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi1.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi10.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi11.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi12.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi13.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi2.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi3.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi4.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi5.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi6.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi7.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi8.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi9.ico

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="http://home.microsoft.com/access/allinone.asp"
"Search Bar"="http://g.msn.fr/0SEFRFR/SAOS02"
"Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Page_URL"="http://www.club-vaio.com"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"


--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\UTILIS~1\AppData\Roaming\uTorrent\Football Manager 2008 (PC) + crack.torrent
C:\Users\UTILIS~1\AppData\Roaming\uTorrent\Update_FM2009_v9.2.0-Patch_et_Activation_Crack_FR_(Update_9.2.0_et_9.1.0_incluse)-M777.rar.torrent


[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 28/03/2009|18:32 - Option : [1]

-----------\\ Fin du rapport a 18:32:31,89
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 20:42:57
et pour mon gestionnaire de tâche qui ne s'ouvre pas ?
Revenir en haut Aller en bas
Anthony5151
Modérateur
Modérateur
Anthony5151


Masculin
Nombre de messages : 177
Age : 36
Localisation : Reims (51)
Système d\'exploitation * : Vista / Ubuntu
Date d'inscription : 03/12/2008

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 21:29:12
On s'en occupera après Wink

• Fais un clic-droit sur le raccourci Toolbar-S&D sur le Bureau et choisis "Exécuter en tant qu'administrateur"
• Tape sur "2" puis valide en appuyant sur "Entrée".
• Ne ferme pas la fenêtre lors de la suppression !
• Un rapport sera généré, poste son contenu ici.

Confirme moi que FlashDisinfector a bien fonctionné stp


Dernière édition par Anthony5151 le Dim 29 Mar - 7:02:27, édité 1 fois
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeSam 28 Mar - 21:54:54
FlashDisinfector a apparament bien fonctionné
-----------\\ ToolBar S&D 1.2.8 XP/Vista


"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 28/03/2009|19:51 )

[ UAC => 1 ]

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="http://home.microsoft.com/access/allinone.asp"
"Search Bar"="http://g.msn.fr/0SEFRFR/SAOS02"
"Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/"
"Default_Page_URL"="http://www.club-vaio.com"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"


--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\UTILIS~1\AppData\Roaming\uTorrent\Football Manager 2008 (PC) + crack.torrent
C:\Users\UTILIS~1\AppData\Roaming\uTorrent\Update_FM2009_v9.2.0-Patch_et_Activation_Crack_FR_(Update_9.2.0_et_9.1.0_incluse)-M777.rar.torrent


[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 28/03/2009|18:32 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 28/03/2009|18:38 - Option : [2]
3 - "C:\ToolBar SD\TB_3.txt" - 28/03/2009|19:52 - Option : [2]

-----------\\ Fin du rapport a 19:52:23,38


j'avais deja lancé cette utilitaire avant le message en tapant 2
le toolbar demon tool avais été enlevé il me semble
Revenir en haut Aller en bas
Anthony5151
Modérateur
Modérateur
Anthony5151


Masculin
Nombre de messages : 177
Age : 36
Localisation : Reims (51)
Système d\'exploitation * : Vista / Ubuntu
Date d'inscription : 03/12/2008

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 29 Mar - 7:04:30
Exclamation A l'attention de ceux qui passent sur ce sujet Exclamation
Le logiciel qui suit n'est pas à utiliser à la légère et peut faire des dégâts s'il est mal utilisé ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.


/!\ Désactive tous tes logiciels de protection /!\
  • Télécharge ComboFix (de sUBs) sur ton Bureau.
  • Double-clique sur ComboFix.exe afin de le lancer.
  • Il va te demander d'installer la console de récupération : accepte.
  • Ne touche à rien pendant le scan.
  • Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Tutoriel officiel de Combofix : http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 29 Mar - 15:02:51
bon sa a marché j'ai récupérer mon gestionnaire de tâches par contre j'ai eu un beau ecran bleu pendant le combofix qui ma bien fait flipper affraid ce qui ne doit pas être normale
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 29 Mar - 15:50:20
ComboFix 09-03-28.06 - Utilisateur 2009-03-29 14:27:30.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2046.1017 [GMT 2:00]
Lancé depuis: c:\users\Utilisateur\Downloads\ComboFix.exe
AV: avast! antivirus 4.8.1229 [VPS 081124-0] *On-access scanning enabled* (Updated)
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\windows\system32\x64
F:\Autorun.inf

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-28 au 2009-03-29 ))))))))))))))))))))))))))))))))))))
.

2009-03-29 13:54 . 2009-03-29 13:55 241,653,915 --a------ c:\windows\MEMORY.DMP
2009-03-27 20:17 . 2009-03-27 20:17 d--hs---- c:\windows\ftpcache
2009-03-26 22:39 . 2009-03-26 22:39 d-------- C:\rsit
2009-03-26 22:39 . 2009-03-28 14:13 d-------- c:\program files\trend micro
2009-03-26 19:05 . 2009-03-29 14:31 51,445,728 --ahs---- c:\windows\System32\drivers\fidbox.dat
2009-03-26 19:05 . 2009-03-29 00:34 591,032 --ahs---- c:\windows\System32\drivers\fidbox.idx
2009-03-26 19:04 . 2008-07-08 14:54 148,496 --a------ c:\windows\System32\drivers\64900864.sys
2009-03-26 15:33 . 2009-03-26 15:33 d-------- c:\users\Utilisateur\AppData\Roaming\Malwarebytes
2009-03-26 15:33 . 2009-03-26 15:33 d-------- c:\users\All Users\Malwarebytes
2009-03-26 15:33 . 2009-03-26 15:33 d-------- c:\programdata\Malwarebytes
2009-03-26 15:33 . 2009-03-26 15:33 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-26 15:33 . 2009-02-11 11:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-03-26 15:33 . 2009-02-11 11:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-03-22 14:15 . 2009-03-29 14:18 d--h----- C:\$AVG8.VAULT$
2009-03-22 12:42 . 2009-03-28 13:42 d-------- c:\windows\System32\drivers\Avg
2009-03-22 12:42 . 2009-03-22 12:42 325,640 --a------ c:\windows\System32\drivers\avgldx86.sys
2009-03-22 12:42 . 2009-03-24 19:17 108,552 --a------ c:\windows\System32\drivers\avgtdix.sys
2009-03-22 12:42 . 2009-03-22 12:42 12,552 --a------ c:\windows\System32\drivers\avgrkx86.sys
2009-03-22 12:42 . 2009-03-22 12:42 10,520 --a------ c:\windows\System32\avgrsstx.dll
2009-03-22 12:41 . 2009-03-29 14:21 d-------- c:\users\All Users\avg8
2009-03-22 12:41 . 2009-03-29 14:21 d-------- c:\programdata\avg8
2009-03-22 12:41 . 2009-03-22 12:41 d-------- c:\program files\AVG
2009-03-10 23:49 . 2008-12-16 05:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2009-03-10 23:49 . 2009-02-09 05:10 2,033,152 --a------ c:\windows\System32\win32k.sys
2009-03-10 23:49 . 2008-11-27 06:43 268,288 --a------ c:\windows\System32\schannel.dll
2009-03-10 23:49 . 2008-12-16 07:31 7,680 --a------ c:\windows\System32\spwmp.dll
2009-03-10 23:49 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\msdxm.ocx
2009-03-10 23:49 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\dxmasf.dll
2009-03-02 16:27 . 2009-03-02 16:27 d--h----- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-29 12:21 1,347,584 ----a-w c:\users\Invité\NTUSER.DAT
2009-03-29 12:21 1,347,584 ----a-w c:\users\Invité\NTUSER.DAT
2009-03-29 12:21 --------- d-s---w c:\users\Invité\AppData\Roaming\Microsoft
2009-03-28 22:32 --------- d-----w c:\users\Utilisateur\AppData\Roaming\uTorrent
2009-03-27 19:23 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-27 19:23 --------- d-----w c:\program files\Sony
2009-03-26 15:24 --------- d-----w c:\program files\Java
2009-03-22 15:39 --------- d-----w c:\users\Utilisateur\AppData\Roaming\dvdcss
2009-03-15 16:35 --------- d-----w c:\program files\Veetle
2009-03-15 13:12 --------- d-----w c:\program files\World of Warcraft
2009-03-11 22:00 --------- d-----w c:\program files\Windows Mail
2009-03-11 10:32 --------- d-----w c:\programdata\Microsoft Help
2009-03-09 04:19 410,984 ----a-w c:\windows\System32\deploytk.dll
2009-02-28 10:52 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-26 14:22 --------- d-----w c:\program files\Wakfu
2009-02-24 19:42 --------- d-----w c:\program files\Google
2009-02-09 15:30 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-09 00:02 --------- d-----w c:\users\Utilisateur\AppData\Roaming\Bioshock
2009-02-08 23:32 --------- d-----w c:\program files\Microsoft Games for Windows - LIVE
2009-02-06 17:52 49,504 ----a-w c:\windows\System32\sirenacm.dll
2009-02-06 17:39 --------- d-----w c:\program files\Dofus
2009-02-05 21:06 51,792 ----a-w c:\windows\system32\drivers\aswMonFlt.sys
2009-01-26 20:22 362 ----a-w c:\users\Utilisateur\AppData\Roaming\wklnhst.dat
2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll
2008-06-14 17:47 174 --sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-08 c:\windows\RtHDVCpl.exe]

c:\users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
is-OGB06.lnk - c:\users\Utilisateur\Desktop\Virus Removal Tool\is-OGB06\startup.exe [2009-03-26 65536]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-05-22 2756608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-07-24 19:26 98304 c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.dvsd"= c:\program files\Common Files\Sony Shared\VideoLib\sonydv.dll
"BackLightCompensation"= 1 (0x1)
"Brightness"= 80 (0x50)
"Contrast"= 89 (0x59)
"PowerLineFrequency"= 2 (0x2)
"Hue"= -7 (0xfffffff9)
"Saturation"= 73 (0x49)
"Sharpness"= 81 (0x51)
"Gamma"= 327 (0x147)
"WBRedEx"= 127 (0x7f)
"WBGreenEx"= 127 (0x7f)
"WBBlueEx"= 127 (0x7f)
"AWBEx"= 1 (0x1)
"ExposureEx"= 255 (0xff)
"AECEx"= 1 (0x1)
"GainEx"= 63 (0x3f)
"AGCEx"= 1 (0x1)
"PowerLineEx"= 1 (0x1)
"FlipEx"= 0 (0x0)
"MirrorEx"= 0 (0x0)
"PrivacyEx"= 0 (0x0)
"NightModeEx"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe]
"Debugger"=c:\windows\system32\wscript.exe /E:vbs c:\windows\system32\winjpg.jpg

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dwwin.exe]
"Debugger"=c:\windows\system32\win.exe

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Sipru.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Sipru.lnk
backup=c:\windows\pss\Sipru.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Utilisateur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-06-12 03:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY]
--a------ 2009-03-22 12:41 1932568 c:\progra~1\AVG\AVG8\avgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-02-17 00:11 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-11-20 14:20 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-04 11:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]
--a------ 2005-07-15 23:48 479232 c:\program files\Google\Gmail Notifier\gnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2715411654-1622190309-3369637632-1000]
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 29 Mar - 15:51:17
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EDDC7BA6-1D23-4C1C-8846-E36756FCC8B3}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9B4B8E99-1833-4241-BE55-649ED07F04BD}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E5B443DB-9E5F-4CC7-B3AE-0144B7549E08}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media
"{5EFDFFC8-68E9-4394-B7B3-688C7AB9D46B}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media
"TCP Query User{64EAE0E8-E979-4740-BC01-1A8C859009A7}c:\\users\\utilisateur\\desktop\\utorrent.exe"= UDP:c:\users\utilisateur\desktop\utorrent.exe:utorrent.exe
"UDP Query User{C227121C-CAF4-417F-8244-A16A78B1977A}c:\\users\\utilisateur\\desktop\\utorrent.exe"= TCP:c:\users\utilisateur\desktop\utorrent.exe:utorrent.exe
"{BB2635AC-7403-40DA-9B52-5757857DEEDE}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{C858255C-2352-464D-B47C-89DF445A32FB}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"TCP Query User{20C1D1FB-58F9-4BD9-AB92-FFD9F7EE4F64}c:\\program files\\windows sidebar\\sidebar.exe"= UDP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"UDP Query User{AF494373-39E6-46F4-B876-98FDA68CE876}c:\\program files\\windows sidebar\\sidebar.exe"= TCP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"TCP Query User{CAE9F213-D7D0-4EC0-BD96-2FEB5B84FF09}c:\\program files\\windows sidebar\\sidebar.exe"= UDP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"UDP Query User{C0642439-3691-4EB4-9944-E55D3CA36324}c:\\program files\\windows sidebar\\sidebar.exe"= TCP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"TCP Query User{4E60CA75-1A54-4157-B8C6-14403ECFD1D7}c:\\users\\utilisateur\\desktop\\utorrent.exe"= UDP:c:\users\utilisateur\desktop\utorrent.exe:utorrent.exe
"UDP Query User{283FC67D-D3A8-4CB8-93FD-AC6F931899F2}c:\\users\\utilisateur\\desktop\\utorrent.exe"= TCP:c:\users\utilisateur\desktop\utorrent.exe:utorrent.exe
"{100B6E15-7FB8-471D-9AFA-375D79162C84}"= UDP:c:\program files\Adobe\Photoshop Elements 5.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{77FDC329-5639-45C4-9C27-2FAE5D64D92F}"= TCP:c:\program files\Adobe\Photoshop Elements 5.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"TCP Query User{36813750-C117-4CE8-88BE-02C958181E87}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{B8F2C1CF-F630-4238-B077-4569FCF0F3CE}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{2F92CE51-9164-410B-B3EF-BFFA05DB2686}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{1A0D5FCC-8904-4756-97E1-B00D9AF59F8E}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{F65497BF-357A-4319-9130-34F715452A83}"= UDP:65091:emule tcp
"{73B19CD2-CF4A-4EFB-82B0-0C2A39F6ECA9}"= TCP:16689:emule udp
"TCP Query User{0056635A-418B-4C03-B4D4-214162DBF926}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{190E63F1-D1D5-47F8-8DC9-3F67F183C6C0}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{579D330F-BD90-481E-B900-F40D0D8F3AF4}c:\\users\\utilisateur\\appdata\\local\\temp\\wzse0.tmp\\symnrt.exe"= UDP:c:\users\utilisateur\appdata\local\temp\wzse0.tmp\symnrt.exe:symnrt.exe
"UDP Query User{E5C26776-4543-42D0-8891-E0D1BDDE7D85}c:\\users\\utilisateur\\appdata\\local\\temp\\wzse0.tmp\\symnrt.exe"= TCP:c:\users\utilisateur\appdata\local\temp\wzse0.tmp\symnrt.exe:symnrt.exe
"TCP Query User{2B9AC2E3-80D7-4C81-9F41-FC39A0997829}c:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{4E6D13F5-69EB-4D91-8DA6-01AD6C786058}c:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"TCP Query User{1B26040A-2DE2-44A5-8262-98E024238C6C}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{6523685E-8AAF-415E-8292-82354922C9C5}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"TCP Query User{1AC60015-3056-4A2F-97AA-5CDD7B1EDD58}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{900A137A-3BEE-400B-AC82-0DF4ED48D4F9}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{6C49E573-BF60-4E62-86EF-9A4DC037B303}c:\\gong\\game.bin"= UDP:c:\gong\game.bin:Gong Online
"UDP Query User{FCAE83B5-FF06-4018-984E-22E6144B0E3E}c:\\gong\\game.bin"= TCP:c:\gong\game.bin:Gong Online
"TCP Query User{085136B4-CC6B-4C21-869D-3D776648B5B8}c:\\gong\\game.bin"= UDP:c:\gong\game.bin:Gong Online
"UDP Query User{D78F4A38-D34A-4A6F-8D10-6594680568E2}c:\\gong\\game.bin"= TCP:c:\gong\game.bin:Gong Online
"TCP Query User{7D786380-F46A-46B2-8997-4A8BC2E5ED52}c:\\program files\\sipru\\sipru.exe"= UDP:c:\program files\sipru\sipru.exe:sipru
"UDP Query User{D7E28A71-49FB-429C-949A-640D1EF8E1C4}c:\\program files\\sipru\\sipru.exe"= TCP:c:\program files\sipru\sipru.exe:sipru
"TCP Query User{CEA6BE7B-BDC7-4BFF-A493-D3EF0018CFF5}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{9F8989D5-6182-4E25-BD29-16951D5F5B20}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{6DC36C92-1208-4D63-BF30-AB07387D7ACC}"= UDP:c:\windows\System32\mstsc.exe:mstsc
"{2166F9D4-291E-4C8D-A1FC-7FB462DC5E1D}"= TCP:c:\windows\System32\mstsc.exe:mstsc
"TCP Query User{3E8CC674-616D-44A8-B709-3A7D89437705}c:\\users\\utilisateur\\desktop\\wow\\maj wow\\wow-2.0.3-frfr-downloader.exe"= UDP:c:\users\utilisateur\desktop\wow\maj wow\wow-2.0.3-frfr-downloader.exe:wow-2.0.3-frfr-downloader.exe
"UDP Query User{C7DE8367-B60A-41A7-B2DB-9FA8C75BB490}c:\\users\\utilisateur\\desktop\\wow\\maj wow\\wow-2.0.3-frfr-downloader.exe"= TCP:c:\users\utilisateur\desktop\wow\maj wow\wow-2.0.3-frfr-downloader.exe:wow-2.0.3-frfr-downloader.exe
"TCP Query User{B1CA6E04-65B2-4601-B2C8-C638267F4283}c:\\users\\utilisateur\\desktop\\wow\\maj wow\\wow-2.0.3.6299-to-2.0.12.6546-frfr-downloader.exe"= UDP:c:\users\utilisateur\desktop\wow\maj wow\wow-2.0.3.6299-to-2.0.12.6546-frfr-downloader.exe:wow-2.0.3.6299-to-2.0.12.6546-frfr-downloader.exe
"UDP Query User{4FE02A0B-1FBF-4136-A6DB-FF6EFE812210}c:\\users\\utilisateur\\desktop\\wow\\maj wow\\wow-2.0.3.6299-to-2.0.12.6546-frfr-downloader.exe"= TCP:c:\users\utilisateur\desktop\wow\maj wow\wow-2.0.3.6299-to-2.0.12.6546-frfr-downloader.exe:wow-2.0.3.6299-to-2.0.12.6546-frfr-downloader.exe
"TCP Query User{AD570E43-7FBB-4E59-9EAF-79597E9AE3A9}c:\\users\\utilisateur\\desktop\\wow\\maj wow\\wow-2.0.10.6448-to-2.0.12.6546-frfr-downloader.exe"= UDP:c:\users\utilisateur\desktop\wow\maj wow\wow-2.0.10.6448-to-2.0.12.6546-frfr-downloader.exe:wow-2.0.10.6448-to-2.0.12.6546-frfr-downloader.exe
"UDP Query User{63698D3B-A801-4AB5-B4B3-6266FF866B41}c:\\users\\utilisateur\\desktop\\wow\\maj wow\\wow-2.0.10.6448-to-2.0.12.6546-frfr-downloader.exe"= TCP:c:\users\utilisateur\desktop\wow\maj wow\wow-2.0.10.6448-to-2.0.12.6546-frfr-downloader.exe:wow-2.0.10.6448-to-2.0.12.6546-frfr-downloader.exe
"TCP Query User{D2C3202A-7D9D-425E-B406-671E13584DB5}c:\\users\\utilisateur\\desktop\\wow\\maj wow\\wow-2.1.0.6692-to-2.1.0.6729-frfr-downloader.exe"= UDP:c:\users\utilisateur\desktop\wow\maj wow\wow-2.1.0.6692-to-2.1.0.6729-frfr-downloader.exe:wow-2.1.0.6692-to-2.1.0.6729-frfr-downloader.exe
"UDP Query User{8907C100-A827-4F8E-9635-F63301FA5E02}c:\\users\\utilisateur\\desktop\\wow\\maj wow\\wow-2.1.0.6692-to-2.1.0.6729-frfr-downloader.exe"= TCP:c:\users\utilisateur\desktop\wow\maj wow\wow-2.1.0.6692-to-2.1.0.6729-frfr-downloader.exe:wow-2.1.0.6692-to-2.1.0.6729-frfr-downloader.exe
"TCP Query User{B6C71F8E-14EA-4028-9415-294E7CAF3E8B}c:\\program files\\world of warcraft\\repair.exe"= UDP:c:\program files\world of warcraft\repair.exe:Blizzard Repair Utility
"UDP Query User{B2762E89-7200-4A4B-B050-E786EEE6074C}c:\\program files\\world of warcraft\\repair.exe"= TCP:c:\program files\world of warcraft\repair.exe:Blizzard Repair Utility
"TCP Query User{423EB423-8A56-445D-9D9F-BDCA66BB3232}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= UDP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"UDP Query User{A8974CD0-2977-4563-AE46-AF86E37AAA10}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= TCP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"{6AF62925-4E14-48D1-9A84-5F33137455E5}"= UDP:c:\users\Utilisateur\Desktop\utorrent.exe:µTorrent (TCP-In)
"{1582288C-10DA-4CB0-8681-E8452F47B1BD}"= TCP:c:\users\Utilisateur\Desktop\utorrent.exe:µTorrent (UDP-In)
"TCP Query User{A46C2DAE-955B-48B7-8286-94CC4D0C2909}c:\\program files\\sports interactive\\football manager 2008\\fm.exe"= UDP:c:\program files\sports interactive\football manager 2008\fm.exe:Football Manager 2008
"UDP Query User{6EC3C809-3CFC-49FC-9893-39913C4A8A27}c:\\program files\\sports interactive\\football manager 2008\\fm.exe"= TCP:c:\program files\sports interactive\football manager 2008\fm.exe:Football Manager 2008
"{4B69DBD9-1907-49D5-820A-BF90592A0FD7}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{909C4109-CEB0-4900-8D20-61BB04F16F52}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{607F6897-6D23-4577-8936-AE6921F029A3}"= TCP:35436:uT udp
"{69404AF2-5411-4C4A-AE1C-18726B879A9E}"= UDP:35436:uT tcp
"TCP Query User{DA597505-B4E9-4D4C-B887-871149DB1C2B}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{01971622-A972-4705-86BE-C0C880F8FCFC}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"TCP Query User{F3231038-C769-4D3D-ADEF-B4B9F5570A4B}c:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"UDP Query User{A19B19D1-D2B5-494E-89D7-AF1CEA41E51C}c:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:c:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component
"TCP Query User{C9E3674D-76F9-42D0-94BB-DC59E0394FE3}c:\\program files\\cain\\cain.exe"= UDP:c:\program files\cain\cain.exe:Cain - Password Recovery Utility
"UDP Query User{A021248E-D88D-40AC-95E5-81AE5B84E350}c:\\program files\\cain\\cain.exe"= TCP:c:\program files\cain\cain.exe:Cain - Password Recovery Utility
"TCP Query User{6BA61AA6-581D-4EED-8668-22E8BCEFF721}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{4CEE3512-0BFD-4672-AE23-593B318CAE99}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{07F684C8-3E5B-469F-A0ED-141B85D9D9DE}"= UDP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009
"{311AFFE6-CB73-497A-B34F-00C06BD1E167}"= TCP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009
"{E887CAEC-4149-4853-8244-1AD96684D475}"= Disabled:UDP:c:\program files\Sports Interactive\Football Manager 2009 Demo\fm.exe:Football Manager 2009 Demo
"{C915E3B3-5BA2-4FC1-852E-3D1C13CCEF48}"= Disabled:TCP:c:\program files\Sports Interactive\Football Manager 2009 Demo\fm.exe:Football Manager 2009 Demo
"{D5551FD2-F47F-4C4F-9C44-C112E5CBF029}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{43B49256-2BBC-4E6C-A5A1-E40F429AF061}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{0EA9BD1C-59FA-454D-ABCA-849A01394437}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{1617C642-73BE-4551-9A2F-2C745285ADC7}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{AC1B160C-69E7-4716-BA86-685BEF666EC1}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{B430DFDD-04B8-4378-AA0C-CFD84DFDCE46}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{33E8E4A8-8B00-4642-B14D-BC3E7BEED20F}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{33581C53-CE31-42D4-89E2-70AA2BEF42BD}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{1356A9B3-7C80-43C9-B199-B40F08942F32}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{DAA85C19-D67F-4FE4-9806-1A8017DFB935}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9DC9CB6D-5B68-4E39-8723-3AAF73502C36}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{27E6B5BD-0912-4067-A9EC-70352A15C425}c:\\program files\\cain\\cain.exe"= UDP:c:\program files\cain\cain.exe:Cain - Password Recovery Utility
"UDP Query User{6F8CA351-4B98-44B2-9627-7C918D954EE7}c:\\program files\\cain\\cain.exe"= TCP:c:\program files\cain\cain.exe:Cain - Password Recovery Utility
"{5BB162CD-31FD-4A9C-9D14-66D264C03F27}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{2EDB1209-73C0-491A-B946-38828E83E6C4}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{D0706F22-E3A2-4332-8CEA-F4AC80055E7A}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{5CAFD075-034F-4136-9CBA-2D83D2541A04}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{82B2BC96-EB08-4F63-ABF7-9EB8968EDE55}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{B2E7361C-C42D-44C3-9A44-56243E2908DC}"= Disabled:UDP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008
"{8306ABB8-E05A-4A0E-A5DC-4D69F53FE5CD}"= Disabled:TCP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 29 Mar - 15:51:38
R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2009-03-22 12552]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [2008-08-29 114768]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-03-22 325640]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-03-22 108552]
R1 is-OGB06drv;is-OGB06drv;c:\windows\System32\drivers\64900864.sys [2009-03-26 148496]
R1 Ndisprot;RawPacket NDIS Protocol Driver;c:\windows\System32\drivers\Ndisprot.sys [2008-09-23 22016]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [2008-08-29 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [2008-08-29 51792]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-22 298264]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
R2 regi;regi;c:\windows\System32\drivers\regi.sys [2007-04-17 11032]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\System32\drivers\libusb0.sys [2008-06-14 33792]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [2008-09-25 3666432]
R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [2007-08-14 73472]
R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [2007-08-14 43904]
R3 ti21sony;ti21sony;c:\windows\System32\drivers\ti21sony.sys [2007-08-14 812544]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2008-11-17 195752]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [2007-11-06 34064]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2008-05-31 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2008-05-31 397312]
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2008-05-31 1089536]
S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2008-05-31 292152]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2008-06-14 87328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - h:\autorun\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e94cd1bb-9a1f-11dd-b408-001a803bc9e4}]
\shell\AutoRun\command - J:\autorun.exe
.
Contenu du dossier 'Tâches planifiées'

2009-03-29 c:\windows\Tasks\User_Feed_Synchronization-{DE07AA01-D503-43FC-90CA-C85F00D4B173}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 09:33]
.
.
------- Examen supplémentaire -------
.
uStart Page =
mWindow Title =
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {B49F3DDF-D851-4D91-93CD-C72007A71DF8} = 192.168.1.1
TCP: {CD3F14F3-FD4B-4A71-B323-E0574F546654} = 192.168.1.1
FF - ProfilePath - c:\users\Utilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\41qn6tem.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://fr.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Common Files\fluxDVD\APIX\NPAPIX.dll
FF - plugin: c:\program files\Common Files\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: c:\program files\Common Files\mpDRM\NPMPDRM.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\users\Utilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\41qn6tem.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-29 14:31:39
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-03-29 14:34:10
ComboFix-quarantined-files.txt 2009-03-29 12:34:07

Avant-CF: 17,960,411,136 octets libres
Après-CF: 17,718,663,168 octets libres

332 --- E O F --- 2009-03-17 17:59:33
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 29 Mar - 15:52:28
la 2eme fois tout c'est bien passé, par contre j'ai toujours des dossier impossible a suprimer et des logicielle impossible a désinstaller comme avg
Revenir en haut Aller en bas
Serkai
Membre
Membre



Masculin
Nombre de messages : 27
Age : 35
Localisation : 76
Système d\'exploitation * : vista home premium 32bits
Date d'inscription : 26/03/2009

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 29 Mar - 16:21:59
bon tout semble remarcher nikel Very Happy merci pour ton aide qui ma été très utile.
Revenir en haut Aller en bas
Anthony5151
Modérateur
Modérateur
Anthony5151


Masculin
Nombre de messages : 177
Age : 36
Localisation : Reims (51)
Système d\'exploitation * : Vista / Ubuntu
Date d'inscription : 03/12/2008

Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitimeDim 29 Mar - 21:15:08
Attention, la désinfection n'est pas terminée : je te dirai quand ce sera le cas (on a presque fini).

Est-ce que tu as encore des problèmes pour désinstaller avg ? On peut le faire avec Combofix si besoin.

Poste un nouveau rapport hijackthis stp (plus besoin de RSIT)
Revenir en haut Aller en bas
Contenu sponsorisé





Rootkit Win32:Rootkit-gen [Rtk] Empty
MessageSujet: Re: Rootkit Win32:Rootkit-gen [Rtk]   Rootkit Win32:Rootkit-gen [Rtk] Icon_minitime
Revenir en haut Aller en bas
 
Rootkit Win32:Rootkit-gen [Rtk]
Revenir en haut 
Page 1 sur 2Aller à la page : 1, 2  Suivant
 Sujets similaires
-
» win32 adware gen
» Virus Win32:Beagle-WF[Wrm]
» pc infecte par Trojan.Win32.Buzus.addi

Permission de ce forum:Vous ne pouvez pas répondre aux sujets dans ce forum
 :: Forums :: Virus/Sécurité-
Sauter vers:  
Ne ratez plus aucun deal !
Abonnez-vous pour recevoir par notification une sélection des meilleurs deals chaque jour.
IgnorerAutoriser