bonjour, j'ai un gros pb de blocage de toute les connexion internet (internet explorer, msn, limewire,...) et j'ai un fond d'écran qui s'est instaler tous seul me disant que j'ai des virus et trojant. Et j'ai une fenêtre qui souvre toute seule et qui me fait une analyse de mon pc et qui me demande d'acheter un antivirus, et dès que je refuse tous se bloc.
Et tous ça s'est produit après avoir voulu installer un antivirus (kaspersky) télécharger sur Limewire. Mais c'est en fin de compte un genre de "faux virus" je pense pour acheter se fameux antivirus. Mais impossible de le supprimer ou de le désinstaler. Que dois-je faire?
Ce n'est pas pour mon ordi mais c'est moi qui m'occupe de l'ordi infecté
merci d'avance
Voici le "rapport de HijackThis", suivi du "report" et pour finir de la "Startuplist"
==================== rapport de HijackThis=======================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:14:09, on 28/09/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
D:\KMWDSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Trust\MI-1500X MOUSE\Mouse32a.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\lphc75bj0e14l.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
D:\MouseDrv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\HijackThis\HJT.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {0032C917-E3C0-4C4D-BC24-F5E80F8A91B0} - C:\WINDOWS\System32\dcvkydru.dll
O2 - BHO: (no name) - {003F2391-5275-45CD-9A61-E81FA07DA0Ba} - C:\WINDOWS\System32\dcvkydru.dll
O2 - BHO: (no name) - {0065922E-E3C0-4C4D-BC24-F5E80F8A91B0} - C:\WINDOWS\System32\dcvkydru.dll
O2 - BHO: (no name) - {007E4723-5275-45CD-9A61-E81FA07DA0Ba} - C:\WINDOWS\System32\dcvkydru.dll
O2 - BHO: (no name) - {00CB245C-E3C0-4C4D-BC24-F5E80F8A91B0} - C:\WINDOWS\System32\dcvkydru.dll
O2 - BHO: (no name) - {00FC8E46-5275-45CD-9A61-E81FA07DA0Ba} - C:\WINDOWS\System32\dcvkydru.dll
O2 - BHO: (no name) - {019648B8-E3C0-4C4D-BC24-F5E80F8A91B0} - C:\WINDOWS\System32\dcvkydru.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {55737035-1B75-48DD-A4D8-66155D8AC7A3} - C:\WINDOWS\System32\nnnmmmKb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {76214118-D4F0-44DF-AA48-6169B29CEA79} - C:\WINDOWS\System32\geBqOfgg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: {132ab946-2ffb-992a-1ec4-13b778a4628e} - {e8264a87-7b31-4ce1-a299-bff2649ba231} - C:\WINDOWS\System32\krupfv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\MI-1500X MOUSE\Mouse32a.exe
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [lphc75bj0e14l] C:\WINDOWS\System32\lphc75bj0e14l.exe
O4 - HKLM\..\Run: [\VIE64.exe] C:\Windows\System32\VIE64.exe
O4 - HKLM\..\Run: [\VIE65.exe] C:\Windows\System32\VIE65.exe
O4 - HKLM\..\Run: [\VIE66.exe] C:\Windows\System32\VIE66.exe
O4 - HKLM\..\Run: [\VIE67.exe] C:\Windows\System32\VIE67.exe
O4 - HKLM\..\Run: [\VIE68.exe] C:\Windows\System32\VIE68.exe
O4 - HKLM\..\Run: [\VIE2.exe] C:\Windows\System32\VIE2.exe
O4 - HKLM\..\Run: [\VIE1.exe] C:\Windows\System32\VIE1.exe
O4 - HKLM\..\Run: [\VIE3.exe] C:\Windows\System32\VIE3.exe
O4 - HKLM\..\Run: [\VIE4.exe] C:\Windows\System32\VIE4.exe
O4 - HKLM\..\Run: [WireLessMouse] D:\StartAutorun.exe MouseDrv.exe
O4 - HKLM\..\Run: [683016ed] rundll32.exe "C:\WINDOWS\System32\rqohtcad.dll",b
O4 - HKLM\..\Run: [bM6b032571] Rundll32.exe "C:\WINDOWS\System32\comtgyvy.dll",s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [\VIE64.exe] C:\Windows\System32\VIE64.exe
O4 - HKCU\..\Run: [\VIE65.exe] C:\Windows\System32\VIE65.exe
O4 - HKCU\..\Run: [\VIE66.exe] C:\Windows\System32\VIE66.exe
O4 - HKCU\..\Run: [\VIE67.exe] C:\Windows\System32\VIE67.exe
O4 - HKCU\..\Run: [\VIE68.exe] C:\Windows\System32\VIE68.exe
O4 - HKCU\..\Run: [\VIE2.exe] C:\Windows\System32\VIE2.exe
O4 - HKCU\..\Run: [\VIE3.exe] C:\Windows\System32\VIE3.exe
O4 - HKCU\..\Run: [\VIE1.exe] C:\Windows\System32\VIE1.exe
O4 - HKCU\..\Run: [\VIE4.exe] C:\Windows\System32\VIE4.exe
O4 - HKCU\..\Run: [E06FXLRD_420843] "C:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Policies\Explorer\Run: [WinUpdating] WinUpdating.exe
O4 - HKCU\..\Policies\Explorer\Run: [Windows Printing Driver] WinSpooler.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1221030198108
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100
O20 - AppInit_DLLs: krupfv.dll
O20 - Winlogon Notify: nnnmmmKb - C:\WINDOWS\SYSTEM32\nnnmmmKb.dll
O21 - SSODL: BdanuVTVk - {68301643-C29A-BCE9-FDE0-C8F67DAE0DF3} - C:\WINDOWS\System32\nmdt.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - D:\KMWDSrv.exe
O24 - Desktop Component 0: (no name) - file:///E:/windows/Fonds%20Ecran%20Nature%201/Arbre2/arbre2_exe.jpg
--
End of file - 8505 bytes
==================== repport =======================
Username "M‚gane" - 28/09/2008 17:41:08 [Fixwareout edited 9/01/2007]
~~~~~ Prerun check
Cache de résolution DNS vidé.
System was rebooted successfully.
~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....
~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033"
"FLMOFFICE4DMOUSE"="C:\\Program Files\\Trust\\MI-1500X MOUSE\\Mouse32a.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe\""
"lphc75bj0e14l"="C:\\WINDOWS\\System32\\lphc75bj0e14l.exe"
"\\VIE64.exe"="C:\\Windows\\System32\\VIE64.exe"
"\\VIE65.exe"="C:\\Windows\\System32\\VIE65.exe"
"\\VIE66.exe"="C:\\Windows\\System32\\VIE66.exe"
"\\VIE67.exe"="C:\\Windows\\System32\\VIE67.exe"
"\\VIE68.exe"="C:\\Windows\\System32\\VIE68.exe"
"\\VIE2.exe"="C:\\Windows\\System32\\VIE2.exe"
"\\VIE1.exe"="C:\\Windows\\System32\\VIE1.exe"
"\\VIE3.exe"="C:\\Windows\\System32\\VIE3.exe"
"\\VIE4.exe"="C:\\Windows\\System32\\VIE4.exe"
"WireLessMouse"="D:\\StartAutorun.exe MouseDrv.exe"
"sysrest32.exe"="C:\\WINDOWS\\System32\\sysrest32.exe"
"683016ed"="rundll32.exe \"C:\\WINDOWS\\System32\\rqohtcad.dll\",b"
"BM6b032571"="Rundll32.exe \"C:\\WINDOWS\\System32\\comtgyvy.dll\",s"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\""
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"\\VIE64.exe"="C:\\Windows\\System32\\VIE64.exe"
"\\VIE65.exe"="C:\\Windows\\System32\\VIE65.exe"
"\\VIE66.exe"="C:\\Windows\\System32\\VIE66.exe"
"\\VIE67.exe"="C:\\Windows\\System32\\VIE67.exe"
"\\VIE68.exe"="C:\\Windows\\System32\\VIE68.exe"
"\\VIE2.exe"="C:\\Windows\\System32\\VIE2.exe"
"\\VIE3.exe"="C:\\Windows\\System32\\VIE3.exe"
"\\VIE1.exe"="C:\\Windows\\System32\\VIE1.exe"
"\\VIE4.exe"="C:\\Windows\\System32\\VIE4.exe"
"E06FXLRD_420843"="\"C:\\Program Files\\Microsoft Encarta\\Collection Microsoft Encarta 2006 DVD\\EDICT.EXE\" -m"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~
==================== startuplist =======================
StartupList report, 28/09/2008, 18:02:59
StartupList version: 1.52.2
Started from : C:\Program Files\HijackThis\HJT.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
D:\KMWDSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Trust\MI-1500X MOUSE\Mouse32a.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\lphc75bj0e14l.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
D:\MouseDrv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\HijackThis\HJT.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
DAEMON Tools-1033 = "C:\Program Files\D-Tools\daemon.exe" -lang 1033
FLMOFFICE4DMOUSE = C:\Program Files\Trust\MI-1500X MOUSE\Mouse32a.exe
SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
lphc75bj0e14l = C:\WINDOWS\System32\lphc75bj0e14l.exe
\VIE64.exe = C:\Windows\System32\VIE64.exe
\VIE65.exe = C:\Windows\System32\VIE65.exe
\VIE66.exe = C:\Windows\System32\VIE66.exe
\VIE67.exe = C:\Windows\System32\VIE67.exe
\VIE68.exe = C:\Windows\System32\VIE68.exe
\VIE2.exe = C:\Windows\System32\VIE2.exe
\VIE1.exe = C:\Windows\System32\VIE1.exe
\VIE3.exe = C:\Windows\System32\VIE3.exe
\VIE4.exe = C:\Windows\System32\VIE4.exe
WireLessMouse = D:\StartAutorun.exe MouseDrv.exe
683016ed = rundll32.exe "C:\WINDOWS\System32\rqohtcad.dll",b
BM6b032571 = Rundll32.exe "C:\WINDOWS\System32\comtgyvy.dll",s
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe"
MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
Yahoo! Pager = "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
\VIE64.exe = C:\Windows\System32\VIE64.exe
\VIE65.exe = C:\Windows\System32\VIE65.exe
\VIE66.exe = C:\Windows\System32\VIE66.exe
\VIE67.exe = C:\Windows\System32\VIE67.exe
\VIE68.exe = C:\Windows\System32\VIE68.exe
\VIE2.exe = C:\Windows\System32\VIE2.exe
\VIE3.exe = C:\Windows\System32\VIE3.exe
\VIE1.exe = C:\Windows\System32\VIE1.exe
\VIE4.exe = C:\Windows\System32\VIE4.exe
E06FXLRD_420843 = "C:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m
swg = C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=krupfv.dll
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\blphc75bj0e14l.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\WINDOWS\System32\dcvkydru.dll - {0032C917-E3C0-4C4D-BC24-F5E80F8A91B0}
(no name) - C:\WINDOWS\System32\dcvkydru.dll - {003F2391-5275-45CD-9A61-E81FA07DA0Ba}
(no name) - C:\WINDOWS\System32\dcvkydru.dll - {0065922E-E3C0-4C4D-BC24-F5E80F8A91B0}
(no name) - C:\WINDOWS\System32\dcvkydru.dll - {007E4723-5275-45CD-9A61-E81FA07DA0Ba}
(no name) - C:\WINDOWS\System32\dcvkydru.dll - {00CB245C-E3C0-4C4D-BC24-F5E80F8A91B0}
(no name) - C:\WINDOWS\System32\dcvkydru.dll - {00FC8E46-5275-45CD-9A61-E81FA07DA0Ba}
(no name) - C:\WINDOWS\System32\dcvkydru.dll - {019648B8-E3C0-4C4D-BC24-F5E80F8A91B0}
(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\WINDOWS\System32\geBqOfgg.dll - {2009BABD-17E9-4EB2-A851-7E836B82F4BF}
(no name) - C:\WINDOWS\System32\nnnmmmKb.dll - {55737035-1B75-48DD-A4D8-66155D8AC7A3}
(no name) - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - c:\program files\google\googletoolbar2.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
{132ab946-2ffb-992a-1ec4-13b778a4628e} - C:\WINDOWS\System32\krupfv.dll - {e8264a87-7b31-4ce1-a299-bff2649ba231}
--------------------------------------------------
Enumerating Download Program Files:
[shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\System32\Adobe\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab
[MUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\muweb.dll
CODEBASE = http://www.update.microsoft.com/microsoftu...b?1221030198108
[Java Plug-in 1.6.0_07]
InProcServer32 = C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
CODEBASE = http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100
[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab
[shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash9f.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\DOCUME~1\MGANE~1\LOCALS~1\Temp\1f34ff45
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
BdanuVTVk: C:\WINDOWS\system32\nmdt.dll
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
WinUpdating = WinUpdating.exe
Windows Printing Driver = WinSpooler.exe
--------------------------------------------------
End of report, 9 269 bytes
Report generated in 0,188 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
