Infection Rootkit besoin d'un maitre Jedi svp
Fermé
malorossi
-
3 mai 2010 à 14:36
dédétraqué Messages postés 4384 Date d'inscription vendredi 5 septembre 2008 Statut Contributeur sécurité Dernière intervention 4 février 2013 - 10 mai 2010 à 23:36
dédétraqué Messages postés 4384 Date d'inscription vendredi 5 septembre 2008 Statut Contributeur sécurité Dernière intervention 4 février 2013 - 10 mai 2010 à 23:36
A voir également:
- Infection Rootkit besoin d'un maitre Jedi svp
- Anti rootkit - Télécharger - Antivirus & Antimalwares
- Maitre vennin huissier - Forum Vos droits sur internet
- Rootkit hunter - Télécharger - Antivirus & Antimalwares
- Vennin vibert - Forum Consommation & Internet
- Tatouage ni dieu ni maître en latin - Forum traduction
56 réponses
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
4 mai 2010 à 20:34
4 mai 2010 à 20:34
Salut malorossi
OK cela est bon, on continu :
Télécharge MBR par (GMER) sur ton Bureau :
http://www2.gmer.net/mbr/mbr.exe
- Désactive tous les programmes de protection (antivirus, antispyware etc.)
https://forum.pcastuces.com/default.asp
- Double-clique sur mbr.exe > une fenêtre noire va s'ouvrir et se refermer.
- Poste le rapport mbr.log qui apparaît.
@++ :)
OK cela est bon, on continu :
Télécharge MBR par (GMER) sur ton Bureau :
http://www2.gmer.net/mbr/mbr.exe
- Désactive tous les programmes de protection (antivirus, antispyware etc.)
https://forum.pcastuces.com/default.asp
- Double-clique sur mbr.exe > une fenêtre noire va s'ouvrir et se refermer.
- Poste le rapport mbr.log qui apparaît.
@++ :)
je lance l'exe. La fenetre noire apparait 2 secondes puis disparait? Et ensuite plus rien. Aucun rapport. Quand je vais dans le gestionnaires des taches windows il n'y a aucune trace de mbr.exe. Ca fait 15 minutes maintenant et rien ne se passe...
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
5 mai 2010 à 01:16
5 mai 2010 à 01:16
Salut malorossi
Regarde bien sur le bureau, tu devrais avoir le mbr.log
@++ :)
Regarde bien sur le bureau, tu devrais avoir le mbr.log
@++ :)
j'ai honte ! Il était devant mes yeux...
Le rapport :
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
Le rapport :
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
5 mai 2010 à 17:21
5 mai 2010 à 17:21
Salut malorossi
OK c'est bon pour ce rapport., Combofix a tout bien réparer.
Je reviens au scan de Gmer que je t'avais demandé hier et je n'avais pas porté attention sur ta réponse.
Peux-tu me donner le message d'erreur que Windows te donne?
@++ :)
OK c'est bon pour ce rapport., Combofix a tout bien réparer.
Je reviens au scan de Gmer que je t'avais demandé hier et je n'avais pas porté attention sur ta réponse.
Peux-tu me donner le message d'erreur que Windows te donne?
@++ :)
La fenetre affiche un msg classique d'erreur . gmr.exe a renco,ntré un probleme et doit fermer etc;
Quand jer clique pour avoir le détail des erreurs : voila ce que j'ai :
AppName: wxmckpqy[1].exe AppVer: 1.0.15.15281 ModName: wxmckpqy[1].exe
ModVer: 1.0.15.15281 Offset: 0005c887
Quand jer clique pour avoir le détail des erreurs : voila ce que j'ai :
AppName: wxmckpqy[1].exe AppVer: 1.0.15.15281 ModName: wxmckpqy[1].exe
ModVer: 1.0.15.15281 Offset: 0005c887
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
5 mai 2010 à 18:49
5 mai 2010 à 18:49
Salut malorossi
Télécharge SystemLook sur ton Bureau :
http://jpshortstuff.247fixes.com/SystemLook.exe
- Double-clique sur SystemLook.exe pour le lancer.
- Copie le contenu en gras ci-dessous et colle-le dans la zone texte de SystemLook :
:filefind
wxmckpqy[1].exe
wxmckpqy.exe
*wxmckpqy*
:regfind
wxmckpqy
- Clique sur le bouton Look pour démarrer l'examen.
- A la fin, le Bloc-notes s'ouvre avec le résultat de l'analyse. Copie-colle le rapport dans ta prochaine réponse.
@++ :)
Télécharge SystemLook sur ton Bureau :
http://jpshortstuff.247fixes.com/SystemLook.exe
- Double-clique sur SystemLook.exe pour le lancer.
- Copie le contenu en gras ci-dessous et colle-le dans la zone texte de SystemLook :
:filefind
wxmckpqy[1].exe
wxmckpqy.exe
*wxmckpqy*
:regfind
wxmckpqy
- Clique sur le bouton Look pour démarrer l'examen.
- A la fin, le Bloc-notes s'ouvre avec le résultat de l'analyse. Copie-colle le rapport dans ta prochaine réponse.
@++ :)
SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 20:09 on 05/05/2010 by LAURENT (Administrator - Elevation successful)
========== filefind ==========
Searching for "wxmckpqy[1].exe "
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\wxmckpqy[1].exe --a--- 293376 bytes [16:09 05/05/2010] [16:09 05/05/2010] F80F6E09E7F4BAFE478CA0DA6137E1E2
Searching for "wxmckpqy.exe "
No files found.
Searching for "*wxmckpqy* "
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\wxmckpqy[1].exe --a--- 293376 bytes [16:09 05/05/2010] [16:09 05/05/2010] F80F6E09E7F4BAFE478CA0DA6137E1E2
C:\WINDOWS\Prefetch\WXMCKPQY[1].EXE-2024E040.pf --a--- 15516 bytes [16:09 05/05/2010] [16:09 05/05/2010] F3C0331F785737DEAECC7B8E56F66CBE
========== regfind ==========
Searching for "wxmckpqy "
No data found.
-=End Of File=-
Log created at 20:09 on 05/05/2010 by LAURENT (Administrator - Elevation successful)
========== filefind ==========
Searching for "wxmckpqy[1].exe "
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\wxmckpqy[1].exe --a--- 293376 bytes [16:09 05/05/2010] [16:09 05/05/2010] F80F6E09E7F4BAFE478CA0DA6137E1E2
Searching for "wxmckpqy.exe "
No files found.
Searching for "*wxmckpqy* "
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\wxmckpqy[1].exe --a--- 293376 bytes [16:09 05/05/2010] [16:09 05/05/2010] F80F6E09E7F4BAFE478CA0DA6137E1E2
C:\WINDOWS\Prefetch\WXMCKPQY[1].EXE-2024E040.pf --a--- 15516 bytes [16:09 05/05/2010] [16:09 05/05/2010] F3C0331F785737DEAECC7B8E56F66CBE
========== regfind ==========
Searching for "wxmckpqy "
No data found.
-=End Of File=-
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
5 mai 2010 à 21:02
5 mai 2010 à 21:02
Salut malorossi
Double clic sur OTL.exe pour le lancer.
? Copie la liste qui se trouve en gras ci-dessous, et colle-la dans la zone sous " Personnalisation "
:files
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\wxmckpqy[1].exe
C:\WINDOWS\Prefetch\WXMCKPQY[1].EXE-2024E040.pf
:commands
[emptytemp]
? Clique sur " Correction " pour lancer la suppression.
? Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur Oui.
? Au redémarrage , autorise OTL a s'exécuter.
? Poste le rapport généré par OTL.
Essai de nouveau avec Gmer voir si cela fonctionne
@++ :)
Double clic sur OTL.exe pour le lancer.
? Copie la liste qui se trouve en gras ci-dessous, et colle-la dans la zone sous " Personnalisation "
:files
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\wxmckpqy[1].exe
C:\WINDOWS\Prefetch\WXMCKPQY[1].EXE-2024E040.pf
:commands
[emptytemp]
? Clique sur " Correction " pour lancer la suppression.
? Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur Oui.
? Au redémarrage , autorise OTL a s'exécuter.
? Poste le rapport généré par OTL.
Essai de nouveau avec Gmer voir si cela fonctionne
@++ :)
voila pour OTL
All processes killed
========== FILES ==========
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\wxmckpqy[1].exe not found.
C:\WINDOWS\Prefetch\WXMCKPQY[1].EXE-2024E040.pf moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: KARINE
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LAURENT
->Temp folder emptied: 141395 bytes
->Temporary Internet Files folder emptied: 52363247 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 11397067 bytes
->Flash cache emptied: 1856 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 32071 bytes
Total Files Cleaned = 61,00 mb
OTL by OldTimer - Version 3.2.4.1 log created on 05062010_151426
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF3AF0.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF3C15.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF3C79.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF3DB9.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF4060.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF437A.tmp not found!
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\XQ7EI88K\favicon[2].ico moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\affich-17602466-infection-rootkit-besoin-d-un-maitre-jedi-svp[1].htm moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\WINDOWS\temp\T30DebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...
je relance gmer
All processes killed
========== FILES ==========
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\wxmckpqy[1].exe not found.
C:\WINDOWS\Prefetch\WXMCKPQY[1].EXE-2024E040.pf moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: KARINE
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LAURENT
->Temp folder emptied: 141395 bytes
->Temporary Internet Files folder emptied: 52363247 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 11397067 bytes
->Flash cache emptied: 1856 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 32071 bytes
Total Files Cleaned = 61,00 mb
OTL by OldTimer - Version 3.2.4.1 log created on 05062010_151426
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF3AF0.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF3C15.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF3C79.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF3DB9.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF4060.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF437A.tmp not found!
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\XQ7EI88K\favicon[2].ico moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\944OH8CI\affich-17602466-infection-rootkit-besoin-d-un-maitre-jedi-svp[1].htm moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\WINDOWS\temp\T30DebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...
je relance gmer
et hop gmer :
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
6 mai 2010 à 16:02
6 mai 2010 à 16:02
Salut malorossi
Cela est le rapport de MBR et non Gmer, on va utilisé un utilitaire qui désactive certain logiciel qui peut nuire au bon fonctionnement de Gmer :
* Télécharge Defogger (de jpshortstuff) sur ton Bureau :
http://www.jpshortstuff.247fixes.com/Defogger.exe
* Lance le
* Une fenêtre apparait : clique sur "Disable"
* Fais redémarrer l'ordinateur si l'outil te le demande
* Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"
Essai de nouveau avec Gmer
@++ :)
Cela est le rapport de MBR et non Gmer, on va utilisé un utilitaire qui désactive certain logiciel qui peut nuire au bon fonctionnement de Gmer :
* Télécharge Defogger (de jpshortstuff) sur ton Bureau :
http://www.jpshortstuff.247fixes.com/Defogger.exe
* Lance le
* Une fenêtre apparait : clique sur "Disable"
* Fais redémarrer l'ordinateur si l'outil te le demande
* Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"
Essai de nouveau avec Gmer
@++ :)
bjr dédétraqué
le scan fut interminable mais a quand meme fonctionné. Voici le rapport :
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-07 00:03:41
Windows 5.1.2600 Service Pack 3
Running: 3hk4uwh2.exe; Driver: C:\DOCUME~1\LAURENT\LOCALS~1\Temp\uxtdapow.sys
---- System - GMER 1.0.15 ----
SSDT EC380C1E ZwCreateKey
SSDT EC380C14 ZwCreateThread
SSDT EC380C23 ZwDeleteKey
SSDT EC380C2D ZwDeleteValueKey
SSDT EC380C32 ZwLoadKey
SSDT EC380C00 ZwOpenProcess
SSDT EC380C05 ZwOpenThread
SSDT EC380C3C ZwReplaceKey
SSDT EC380C37 ZwRestoreKey
SSDT EC380C28 ZwSetValueKey
SSDT EC380C0F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\drivers\oreans32.sys section is writeable [0xF3131280, 0x7B04, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 40D85505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 40E5DAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 40F5473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 40F54671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 40F546DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 40F54542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 40F545A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 40F547A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 40F54606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 40D85505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 40E59A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!CallNextHookEx 7E3AB3C6 5 Bytes JMP 40E4D101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 40E5DAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 40DC466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 40F5473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 40F54671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 40F546DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 40F54542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 40F545A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 40F547A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 40F54606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ole32.dll!CoCreateInstance 774C057E 5 Bytes JMP 40E5DB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ole32.dll!OleLoadFromStream 774E9C85 5 Bytes JMP 40F54AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!getaddrinfo 719F2A6F 5 Bytes JMP 46CAE71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!closesocket 719F3E2B 5 Bytes JMP 46CAEEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!socket 719F4211 5 Bytes JMP 46CAE59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!connect 719F4A07 5 Bytes JMP 46CAE62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!send 719F4C27 5 Bytes JMP 46CAE9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!recv 719F676F 5 Bytes JMP 46CAF1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 40D85505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 40E59A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!CallNextHookEx 7E3AB3C6 5 Bytes JMP 40E4D101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 40E5DAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 40DC466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 40F5473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 40F54671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 40F546DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 40F54542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 40F545A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 40F547A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 40F54606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ole32.dll!CoCreateInstance 774C057E 5 Bytes JMP 40E5DB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ole32.dll!OleLoadFromStream 774E9C85 5 Bytes JMP 40F54AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!getaddrinfo 719F2A6F 5 Bytes JMP 46CAE71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!closesocket 719F3E2B 5 Bytes JMP 46CAEEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!socket 719F4211 5 Bytes JMP 46CAE59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!connect 719F4A07 5 Bytes JMP 46CAE62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!send 719F4C27 5 Bytes JMP 46CAE9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!recv 719F676F 5 Bytes JMP 46CAF1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\internet explorer\iexplore.exe[2064] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [009C1ACB] C:\Program Files\internet explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\internet explorer\iexplore.exe[2572] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [009C1ACB] C:\Program Files\internet explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x2F 0xF9 0x23 0xE4 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x94 0xC4 0x39 0x6E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA5 0xC9 0x07 0xD6 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x2F 0xF9 0x23 0xE4 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x94 0xC4 0x39 0x6E ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA5 0xC9 0x07 0xD6 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x2F 0xF9 0x23 0xE4 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x94 0xC4 0x39 0x6E ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xD8 0x5F 0x23 0x93 ...
Reg HKLM\SYSTEM\ControlSet003\Services\tdssserv@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\tdssserv@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\tdssserv@imagepath \systemroot\system32\drivers\tdssserv.sys
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x7A 0x45 0x05 0xFD ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x6B 0x65 0x49 0x6A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...
---- EOF - GMER 1.0.15 ----
le scan fut interminable mais a quand meme fonctionné. Voici le rapport :
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-07 00:03:41
Windows 5.1.2600 Service Pack 3
Running: 3hk4uwh2.exe; Driver: C:\DOCUME~1\LAURENT\LOCALS~1\Temp\uxtdapow.sys
---- System - GMER 1.0.15 ----
SSDT EC380C1E ZwCreateKey
SSDT EC380C14 ZwCreateThread
SSDT EC380C23 ZwDeleteKey
SSDT EC380C2D ZwDeleteValueKey
SSDT EC380C32 ZwLoadKey
SSDT EC380C00 ZwOpenProcess
SSDT EC380C05 ZwOpenThread
SSDT EC380C3C ZwReplaceKey
SSDT EC380C37 ZwRestoreKey
SSDT EC380C28 ZwSetValueKey
SSDT EC380C0F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\drivers\oreans32.sys section is writeable [0xF3131280, 0x7B04, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 40D85505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 40E5DAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 40F5473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 40F54671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 40F546DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 40F54542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 40F545A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 40F547A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[1464] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 40F54606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 40D85505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 40E59A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!CallNextHookEx 7E3AB3C6 5 Bytes JMP 40E4D101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 40E5DAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 40DC466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 40F5473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 40F54671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 40F546DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 40F54542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 40F545A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 40F547A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 40F54606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ole32.dll!CoCreateInstance 774C057E 5 Bytes JMP 40E5DB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ole32.dll!OleLoadFromStream 774E9C85 5 Bytes JMP 40F54AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!getaddrinfo 719F2A6F 5 Bytes JMP 46CAE71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!closesocket 719F3E2B 5 Bytes JMP 46CAEEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!socket 719F4211 5 Bytes JMP 46CAE59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!connect 719F4A07 5 Bytes JMP 46CAE62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!send 719F4C27 5 Bytes JMP 46CAE9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2064] ws2_32.dll!recv 719F676F 5 Bytes JMP 46CAF1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 40D85505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 40E59A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!CallNextHookEx 7E3AB3C6 5 Bytes JMP 40E4D101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 40E5DAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 40DC466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 40F5473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 40F54671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 40F546DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 40F54542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 40F545A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 40F547A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 40F54606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ole32.dll!CoCreateInstance 774C057E 5 Bytes JMP 40E5DB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ole32.dll!OleLoadFromStream 774E9C85 5 Bytes JMP 40F54AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!getaddrinfo 719F2A6F 5 Bytes JMP 46CAE71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!closesocket 719F3E2B 5 Bytes JMP 46CAEEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!socket 719F4211 5 Bytes JMP 46CAE59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!connect 719F4A07 5 Bytes JMP 46CAE62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!send 719F4C27 5 Bytes JMP 46CAE9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
.text C:\Program Files\internet explorer\iexplore.exe[2572] ws2_32.dll!recv 719F676F 5 Bytes JMP 46CAF1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation)
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\internet explorer\iexplore.exe[2064] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [009C1ACB] C:\Program Files\internet explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\internet explorer\iexplore.exe[2572] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [009C1ACB] C:\Program Files\internet explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x2F 0xF9 0x23 0xE4 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x94 0xC4 0x39 0x6E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA5 0xC9 0x07 0xD6 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x2F 0xF9 0x23 0xE4 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x94 0xC4 0x39 0x6E ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA5 0xC9 0x07 0xD6 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x2F 0xF9 0x23 0xE4 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x94 0xC4 0x39 0x6E ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xD8 0x5F 0x23 0x93 ...
Reg HKLM\SYSTEM\ControlSet003\Services\tdssserv@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\tdssserv@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\tdssserv@imagepath \systemroot\system32\drivers\tdssserv.sys
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x7A 0x45 0x05 0xFD ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x6B 0x65 0x49 0x6A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...
---- EOF - GMER 1.0.15 ----
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
7 mai 2010 à 16:22
7 mai 2010 à 16:22
Salut malorossi
- Quitte les applications en cours afin de ne pas interrompre le scan.
- Faire un double clique sur OTL.exe présent sur le bureau pour lancer le programme
- Une fenêtre apparaît. Dans la section Rapport en haut de cette fenêtre, coche "Rapport minimal". Fais de même avec "Tous les utilisateurs".
- Coche également les cases à côté de "Recherche LOP" et "Recherche Purity".
Ne modifie pas les autres paramètres!
- Clique sur le bouton Analyse.
- Une fois l'analyse terminée, une fenêtre va s'ouvrir dans le Bloc-notes : OTL.txt
Utilise cjoint.com pour poster en lien le rapport :
https://www.cjoint.com/
- Clique sur Parcourir pour aller chercher le rapport
- Clique sur Ouvrir ensuite sur Créer le lien Cjoint
- Fais un copier/coller du lien qui est devant Le lien a été créé: dans ta prochaine réponse.
@++ :)
- Quitte les applications en cours afin de ne pas interrompre le scan.
- Faire un double clique sur OTL.exe présent sur le bureau pour lancer le programme
- Une fenêtre apparaît. Dans la section Rapport en haut de cette fenêtre, coche "Rapport minimal". Fais de même avec "Tous les utilisateurs".
- Coche également les cases à côté de "Recherche LOP" et "Recherche Purity".
Ne modifie pas les autres paramètres!
- Clique sur le bouton Analyse.
- Une fois l'analyse terminée, une fenêtre va s'ouvrir dans le Bloc-notes : OTL.txt
Utilise cjoint.com pour poster en lien le rapport :
https://www.cjoint.com/
- Clique sur Parcourir pour aller chercher le rapport
- Clique sur Ouvrir ensuite sur Créer le lien Cjoint
- Fais un copier/coller du lien qui est devant Le lien a été créé: dans ta prochaine réponse.
@++ :)
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
7 mai 2010 à 17:58
7 mai 2010 à 17:58
Salut malorossi
Bon là je me disait que l'on avais travailler pour rien, en effet le rapport que tu m'as posté date :
OTL logfile created on: 03/05/2010 19:06:36
Peux-tu m'en posté un tout frais faite.
@++ :)
Bon là je me disait que l'on avais travailler pour rien, en effet le rapport que tu m'as posté date :
OTL logfile created on: 03/05/2010 19:06:36
Peux-tu m'en posté un tout frais faite.
@++ :)
C'était un test pour vérifier que tu suivais...
Ca devrait etre mieux avec ca : https://www.cjoint.com/?fhsgrM0xKa
sorry
Ca devrait etre mieux avec ca : https://www.cjoint.com/?fhsgrM0xKa
sorry
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
7 mai 2010 à 18:46
7 mai 2010 à 18:46
Salut malorossi
Merci de me tester :-)))
Double clic sur OTL.exe pour le lancer.
? Copie la liste qui se trouve en gras ci-dessous, et colle-la dans la zone sous " Personnalisation "
:Files
C:\Documents and Settings\LocalService\Application Data\qvjsge.dat
:Commands
[Emptytemp]
? Clique sur " Correction " pour lancer la suppression.
? Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur Oui.
? Au redémarrage , autorise OTL a s'exécuter.
? Poste le rapport généré par OTL.
-----
On va vérifier si rien de caché:
Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :
https://www.eset.com/int/home/online-scanner/
(coche toutes les cases à chaque fois, sauf les deux dernières a la fin du scan, sinon le rapport est supprimer)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt
@++ :)
Merci de me tester :-)))
Double clic sur OTL.exe pour le lancer.
? Copie la liste qui se trouve en gras ci-dessous, et colle-la dans la zone sous " Personnalisation "
:Files
C:\Documents and Settings\LocalService\Application Data\qvjsge.dat
:Commands
[Emptytemp]
? Clique sur " Correction " pour lancer la suppression.
? Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur Oui.
? Au redémarrage , autorise OTL a s'exécuter.
? Poste le rapport généré par OTL.
-----
On va vérifier si rien de caché:
Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :
https://www.eset.com/int/home/online-scanner/
(coche toutes les cases à chaque fois, sauf les deux dernières a la fin du scan, sinon le rapport est supprimer)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt
@++ :)
Voila pour OTL, je lance le scan en ligne ;Rapport demain ou cette nuit ;)
All processes killed
========== FILES ==========
C:\Documents and Settings\LocalService\Application Data\qvjsge.dat moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: KARINE
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LAURENT
->Temp folder emptied: 250817 bytes
->Temporary Internet Files folder emptied: 31774057 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 1366 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 412 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 856140 bytes
Total Files Cleaned = 31,00 mb
OTL by OldTimer - Version 3.2.4.1 log created on 05072010_190511
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5C2F.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5C4B.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5C94.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5D3C.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5E8B.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5F1A.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DFF8E1.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DFF901.tmp not found!
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\WES1YBDJ\favicon[2].ico moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\5931JCXR\affich-17602466-infection-rootkit-besoin-d-un-maitre-jedi-svp[2].htm moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\5931JCXR\error404[1].htm moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\5931JCXR\favicon[5].ico moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\5931JCXR\favicon[6].ico moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\1ANVD9NW\confirm[1].htm moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
Registry entries deleted on Reboot...
All processes killed
========== FILES ==========
C:\Documents and Settings\LocalService\Application Data\qvjsge.dat moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: KARINE
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LAURENT
->Temp folder emptied: 250817 bytes
->Temporary Internet Files folder emptied: 31774057 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 1366 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 412 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 856140 bytes
Total Files Cleaned = 31,00 mb
OTL by OldTimer - Version 3.2.4.1 log created on 05072010_190511
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5C2F.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5C4B.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5C94.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5D3C.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5E8B.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DF5F1A.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DFF8E1.tmp not found!
File\Folder C:\Documents and Settings\LAURENT\Local Settings\Temp\~DFF901.tmp not found!
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\WES1YBDJ\favicon[2].ico moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\5931JCXR\affich-17602466-infection-rootkit-besoin-d-un-maitre-jedi-svp[2].htm moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\5931JCXR\error404[1].htm moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\5931JCXR\favicon[5].ico moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\5931JCXR\favicon[6].ico moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\Content.IE5\1ANVD9NW\confirm[1].htm moved successfully.
C:\Documents and Settings\LAURENT\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
Registry entries deleted on Reboot...
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
7 mai 2010 à 19:18
7 mai 2010 à 19:18
Salut malorossi
Cela est bon, le fichier est bien supprimer.
OK pour le scan, ne touche a rien durant, va faire pisser le chien :-D
@++ :)
Cela est bon, le fichier est bien supprimer.
OK pour le scan, ne touche a rien durant, va faire pisser le chien :-D
@++ :)
