ah pourtant ya pas signe exterieur, la page de demarrage ne change pas, la page recherche via google ne delire pas, no popup.
Cette ligne j'aurais pu la fixer avec hijack non? (elle y ai dans le rapport).
Thu 02 Sep 04 20:19:16
»»»»»»»»»»»»»»»»»»***LOG!***(*updated *9/1*)»»»»»»»»»»»»»»»»
*System:
Microsoft Windows XP Professional 5.1 Service Pack 1 (Build 2600)
*IE version:
6.0.2800.1106 SP1-Q810847
MS-DOS Version 5.00.500
*command.com test passed!
__________________________________
!!*Creating backups...!!
The operation completed successfully
20:19:15,88 02/09/2004
__________________________________
*Local time:
jeudi 2 septembre 2004 (02/09/2004)
20:19, Paris, Madrid (heure d'été)
*Uptime:
20:19:18 up 0 days, 1:44:23
*Path:
C:\FINDnFIX
----------------------------------------------------
»»Member of...: ("ADMIN" logon + group match required!)
User is a member of group WORKSTATION\Aucun.
User is a member of group \Tout le monde.
User is a member of group BUILTIN\Administrateurs.
User is a member of group BUILTIN\Utilisateurs.
User is a member of group \LOCAL.
User is a member of group AUTORITE NT\INTERACTIF.
User is a member of group AUTORITE NT\Utilisateurs authentifiés.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
User: [WORKSTATION\YANNICK], is a member of:
BUILTIN\Administrateurs
WORKSTATION\Aucun
Running in WORKSTATION MODE.
SystemDrive is C:
SystemRoot is C:\WINDOWS
Logon Domain is WORKSTATION
Administrator's Name is YANNICK
Computer Name is WORKSTATION
LOGON SERVER is \\WORKSTATION
»»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
The list will produce a small database of files that will match certain criteria.
Ex: read only files, s/h files, last modified date. size, etc.
The filters provided and registry scan should match the
corresponding file(s) listed.
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Unless the file match the entire criteria, it should not be pointed to remove
without attempting to confirm it's nature!
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
If in doubt, always search the file(s) and properties according to criteria!
The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder
______________________________________________________________________________
***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
______________________________________________________________________________
......Scanning for file(s)...
*Note! The list(s) may include legitimate files!
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»» (*1*) »»»»» .........
»»Read access error(s)...
»»»»» (*2*) »»»»»........
»»»»» (*3*) »»»»»........
No matches found.
unknown/hidden files...
No matches found.
»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
»»»»»(*5*)»»»»»
»»»»»(*6*)»»»»»
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINDOWS\SYSTEM32 Including: *.DLL
791. Nvwddi Dll 35,840 . . . . A 2-04-04 11:37 am
____________________________________________________________________________
*By size and date...
No matches found.
No matches found.
No matches found.
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.
SNiF 1.34 statistics
Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0
Masks sniffed for: *.DLL
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
BHO search and other files...
No matches found.
No matches found.
--*sp.html in temp folder was NOT FOUND!--
*Filter keys search...
REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html' (2)
--(*text/html Subkey was NOT FOUND!)--
REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain' (2)
--(*text/plain Subkey was NOT FOUND!)--
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)
Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 398
»»Checking for AppInit_DLLs (empty) value...
________________________________
!"AppInit_DLLs"=""!
Value does not exist
________________________________
»»Comparing *saved* key with *original*...
REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)
Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).
No differences found.
»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
»»Security settings for 'Windows' key:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(NI) ALLOW Read BUILTIN\Utilisateurs
(IO) ALLOW Read BUILTIN\Utilisateurs
(NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(NI) ALLOW Full access BUILTIN\Administrateurs
(IO) ALLOW Full access BUILTIN\Administrateurs
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access BUILTIN\Administrateurs
(IO) ALLOW Full access CREATEUR PROPRIETAIRE
Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Utilisateurs
Read BUILTIN\Utilisateurs avec pouvoir
Full access BUILTIN\Administrateurs
Full access AUTORITE NT\SYSTEM
»»Performing string scan....
00001150: ?
00001190: P vk UDeviceNo
000011D0:tSelectedTimeout 1 5 ( W vk ' z
00001210:GDIProcessHandleQuota" 9 0 | vk X
00001250:Spooler2 y e s hd vk =pswapdisk
00001290: 8 h vk ( R TransmissionRetryTimeout
000012D0: vk ' 3 USERProcessHandleQuotau! 8
00001310:h E P } } } \ ; E PWW u j
00001350: ; 9} tc E ; u t P Q M Qh t } V ; M Q
00001390: P ; |q E U R u u P Q0 ; |X u u@ E ; t P Q
000013D0:K E P u } P P T ; | u E P 15 9} @ 3 9} u
00001410: 5 E ; t P Q E ; t P Q E ; t P Q _ ^[ D$ u W
00001450:G V t$ Wt J u) $B t T tj Y3 u L$ t Q P 3
00001490: @ _^ L$ t$ P U QQ e e V W M Q P |> }
000014D0: u > E t P Q N e U R P | E u P Q E
00001510:t P Q E t P Q _^ U QQS ] V3 f93W u ] t E P
00001550: Yt E E f 8 u u t Y E f f=+ t f=- u 3 f=+
00001590: E L M u H t E E Y f .t FFf f u f > tl 0Z t
000015D0:3 FFf f tvf=0 r0f=9 w* }% 0 E AF E F3
---------- WIN.TXT
--------------
--------------
$011C7: UDeviceNotSelectedTimeout
$0120F: zGDIProcessHandleQuota
$012B8: TransmissionRetryTimeout
$012E8: USERProcessHandleQuotau
--------------
--------------
No strings found.
--------------
--------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
.............
-----------------------
»»»»»»Backups list...»»»»»»
20:21:45 up 0 days, 1:46:50
-----------------------
Thu 02 Sep 04 20:21:45
C:\FINDNFIX\
keyback.hiv Thu 2 Sep 2004 20:19:16 A.... 8 192 8,00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 8 192 bytes 8,00 K
C:\FINDNFIX\KEYS1\
winkey.reg Thu 2 Sep 2004 20:19:18 A.... 268 0,26 K
1 item found: 1 file, 0 directories.
Total of file sizes: 268 bytes 0,26 K
*Temp backups...
"C:\Documents and Settings\YANNICK\Local Settings\Temp\Backs2\"
keyback2.hi_ 2 Sep 2004 8192 "keyback2.hi_"
winkey2.re_ 2 Sep 2004 268 "winkey2.re_"
2 items found: 2 files, 0 directories.
Total of file sizes: 8 460 bytes 8,26 K
-D---- JUNKXXX 00000000 20:19.16 02/09/2004
A----- STARTIT .BAT 00000060 20:19.16 02/09/2004
________________________________________________________________________________
***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
MINIMAL REQUIREMENTS INCLUDE:
_________XP HOME/PRO; SP1; IE6/SP1
_________2K/SP4; IE6/SP1
________________________________________________________________________________
»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»
-----END------
Thu 02 Sep 04 20:21:46
les dll suspectes:
