Virus party : rapport MSNfixRésolu/Fermé

Question

Bonjour,

hélas hier j'ai été infectée par le virus party qui cicrule par msn. J'ai donc téléchargé MSNfix et voici le rapport, je ne sais pas ce que je dois faire maintenant alors si quelqu'un aurait la gentillesse de m'aider, je lui serais trés reconnaissante! merci d'avance

MSNFix 1.601  
 
C:\Documents and Settings\Benjamin\Bureau\MSNFix 
Fix exécuté le 07/12/2007 - 15:11:54,26 By Benjamin 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton 
... C:\Program Files\Fichiers communs\Carlson\carlton 
... C:\PROGRA~1\FICHIE~1\Carlson\carlton 
... C:\8e9w3l6u1g1.exe 
... C:\WINDOWS\msimn.exe 
... C:\WINDOWS\system32\microsoft\backup.ftp 
... C:\WINDOWS\system32\microsoft\backup.tftp 
... C:\WINDOWS\party_jpg.zip 

************************  MSNCHK ***** /!\ beta test /!\

[!] C:\WINDOWS\party_jpg.zip is INFECTED

 
************************ Recherche les dossiers présents       
 
... C:\Program Files\Fichiers communs\Carlson\ 
... C:\PROGRA~1\FICHIE~1\Carlson\ 
... C:\Temp\ 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton  
.. OK ... C:\Program Files\Fichiers communs\Carlson\carlton  
.. OK ... C:\PROGRA~1\FICHIE~1\Carlson\carlton  
.. OK ... C:\8e9w3l6u1g1.exe  
/!\ ...  C:\WINDOWS\msimn.exe   
.. OK ... C:\WINDOWS\system32\microsoft\backup.ftp  
.. OK ... C:\WINDOWS\system32\microsoft\backup.tftp  
.. OK ... C:\WINDOWS\party_jpg.zip 
 
 
************************ Suppression des dossiers

Rominet1389 · Answer

bonsoir,

Normalement, tu a été conpletement desinfecter, MAintenant si tu en doute, essai de relancer msnfix encor un coup, mais il ne devrait plu trouver grand chose.

Utilisateur anonyme · Answer

bonjour redemare en mode sans echec  c'est important et passe a l'option 2 de msnfix copie ton ordi demande un reboot execute ,attend , copie et colle le raport dans ta prochaine reponse

g!rly · Answer

bonjours sophie/benjamin, 

peux tu refaire msnfix et poster le rapport ici stp car apparament un fichier n´as pas pu etre supprimé lors de son passage...

- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt

@+

sophie · Answer

Merci pour vos réponses si rapides! effectivement Marie il manque la fin du rapport, le voici au complet 

MSNFix 1.601  
 
C:\Documents and Settings\Benjamin\Bureau\MSNFix 
Fix exécuté le 07/12/2007 - 15:11:54,26 By Benjamin 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton 
... C:\Program Files\Fichiers communs\Carlson\carlton 
... C:\PROGRA~1\FICHIE~1\Carlson\carlton 
... C:\8e9w3l6u1g1.exe 
... C:\WINDOWS\msimn.exe 
... C:\WINDOWS\system32\microsoft\backup.ftp 
... C:\WINDOWS\system32\microsoft\backup.tftp 
... C:\WINDOWS\party_jpg.zip 

************************  MSNCHK ***** /!\ beta test /!\

[!] C:\WINDOWS\party_jpg.zip is INFECTED

 
************************ Recherche les dossiers présents       
 
... C:\Program Files\Fichiers communs\Carlson\ 
... C:\PROGRA~1\FICHIE~1\Carlson\ 
... C:\Temp\ 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton  
.. OK ... C:\Program Files\Fichiers communs\Carlson\carlton  
.. OK ... C:\PROGRA~1\FICHIE~1\Carlson\carlton  
.. OK ... C:\8e9w3l6u1g1.exe  
/!\ ...  C:\WINDOWS\msimn.exe   
.. OK ... C:\WINDOWS\system32\microsoft\backup.ftp  
.. OK ... C:\WINDOWS\system32\microsoft\backup.tftp  
.. OK ... C:\WINDOWS\party_jpg.zip 
 
 
************************ Suppression des dossiers       
 
.. OK ... C:\Program Files\Fichiers communs\Carlson\   
.. OK ... C:\PROGRA~1\FICHIE~1\Carlson\   
.. OK ... C:\Temp\   
 
 
************************ Nettoyage du registre 
 
 
 
Les fichiers encore présents seront supprimés au prochain redémarrage 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\WINDOWS\msimn.exe  
 
 
 
************************ Fichiers suspects 
 
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention 
 
[C:\eMule0.47c-Installer.exe] D388CDC4DDA65263F7DB385989AF7160 
[C:\setupfre.exe] 344BFAC571828B079F2595FAC6FC1458 
[C:\spybotsd15.exe] 9286D3952F8CB08AD1BB4F3122E144CC 
[C:\PROGRA~1\Install_Messenger.exe] 4408BC2F0845D823E24B8C8B1B69895E 
[C:\PROGRA~1\uTorrent-1.6-install.exe] A4FA400AEC5E3E6AFD9ECF5774F8CAD4 

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier  [b] C:\DOCUME~1\Benjamin\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 07122007_15165081.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

sophie · Answer

J'ai relancer MSNfix et cette fois il n'a rien détécté "infection absente" suis-je débarassée?

g!rly · Answer

salut sophie/benjamin,

cette fois ci c´est ok pour msnfix, tous les fichiers on bien ete supprimé.

peux tu envoyé le fichier C:\DOCUME~1\Benjamin\Bureau\Upload_Me.zip sur cette adresse : http://upload.changelog.fr ca serait cool de ta part : c´est pour le crateur du fix...

puis fais ceci :

Télécharge HijackThis ici : 

-> https://www.zebulon.fr/telechargements/securite/systeme/hijackthis.html

Tutoriel d´installation (images) :

-> http://pchelpbordeaux.free.fr/tuto.html

Tutoriel d´utilisation (video) :

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

Post le rapport généré ici stp...

@+

sophie · Answer

Voilà le rapport, merci beaucoup pour votre aide :-)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:27:12, on 07/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\EPSON\ESM2\eEBSVC.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\jnkiaeis.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\utorrent\utorrent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
F:\daemon tools\daemon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\Benjamin\LOCALS~1\Temp\Rar$EX00.562\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [3cd8c406] rundll32.exe "C:\WINDOWS\System32\wrutfrcb.dll",b
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Instant Access] C:\WINDOWS\System32\prodsrvs.exe /res
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent\utorrent.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "F:\daemon tools\daemon.exe" -lang 1033
O4 - HKCU\..\Policies\Explorer\Run: [{3CD8C4A9-06D2-1036-0804-040209240021}] "C:\Program Files\Fichiers communs\{3CD8C4A9-06D2-1036-0804-040209240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O20 - AppInit_DLLs:  
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DomainService -   - C:\WINDOWS\System32\jnkiaeis.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\EPSON\ESM2\eEBSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe (file missing)

g!rly · Answer

re,

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

sophie · Answer

voilà le rapport combofix mais depuis que j'ai fait le scan mon pc rame.... ComboFix 07-12-07.3 - Benjamin 2007-12-07 19:38:37.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.159 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Fichiers communs\{3CD8C~1 C:\Program Files\Fichiers communs\{3CD8C~2 C:\Program Files\Fichiers communs\uninstall information C:\Program Files\ipwindows C:\Program Files\ipwindows\pop154.tmp C:\Program Files\ipwindows\pop161.tmp C:\Program Files\ipwindows\pop165.tmp C:\Program Files\ipwindows\pop166.tmp C:\Program Files\ipwindows\pop167.tmp C:\Program Files\ipwindows\pop16B.tmp C:\Program Files\ipwindows\pop16C.tmp C:\Program Files\ipwindows\pop16E.tmp C:\Program Files\ipwindows\pop171.tmp C:\Program Files\ipwindows\pop17C.tmp C:\Program Files\ipwindows\pop180.tmp C:\Program Files\ipwindows\pop181.tmp C:\Program Files\ipwindows\pop18A.tmp C:\Program Files\ipwindows\pop18D.tmp C:\Program Files\ipwindows\pop18E.tmp C:\Program Files\ipwindows\pop193.tmp C:\Program Files\ipwindows\pop194.tmp C:\Program Files\ipwindows\pop195.tmp C:\Program Files\ipwindows\pop198.tmp C:\Program Files\ipwindows\pop1A1.tmp C:\Program Files\ipwindows\pop1A5.tmp C:\Program Files\ipwindows\pop1B1.tmp C:\Program Files\ipwindows\pop1BA.tmp C:\Program Files\ipwindows\set152.tmp C:\Program Files\ipwindows\set153.tmp C:\Program Files\ipwindows\Uninst.exe C:\Program Files\ipwins C:\Program Files\ipwins\pop101.tmp C:\Program Files\ipwins\pop11D.tmp C:\Program Files\ipwins\pop11F.tmp C:\Program Files\ipwins\Uninst.exe C:\WINDOWS\pack.epk C:\WINDOWS\system32\bcrfturw.ini C:\WINDOWS\system32\Cache C:\WINDOWS\system32\f3 C:\WINDOWS\system32\h1 C:\WINDOWS\system32\jkkjghg.dll C:\WINDOWS\system32\khfebyw.dll C:\WINDOWS\system32\l4 C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32 heqtvmd.dll C:\WINDOWS\System32\sstts.dll C:\WINDOWS\system32\sttss.ini C:\WINDOWS\system32\sttss.ini2 C:\WINDOWS\system32\svchosts.lzma C:\WINDOWS\system32\whrflouw.dll C:\WINDOWS\system32\wrutfrcb.dll C:\WINDOWS mlpcert2007 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_COM+_MESSAGES -------\LEGACY_DOMAINSERVICE -------\LEGACY_IPRIP -------\DomainService -------\Iprip ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-07 to 2007-12-07 )))))))))))))))))))))))))))))))))))) . 2007-12-07 19:43 . 2007-12-07 19:43 66,055 --ah----- C:\WINDOWS\system32\yxst.exe 2007-12-07 19:43 . 2007-12-07 19:43 59,392 --a------ C:\WINDOWS r941.exe 2007-12-07 19:43 . 2007-12-07 19:43 50,448 --ah----- C:\WINDOWS\system32\oqbjhmv.exe 2007-12-07 19:43 . 2007-12-07 19:43 37,376 --a------ C:\WINDOWS\system32\awtqnkh.dll 2007-12-07 19:43 . 2007-12-07 19:43 36,864 --ah----- C:\WINDOWS\system32\daicsnc.exe 2007-12-07 09:28 . 2007-12-07 09:28 74,304 --a------ C:\WINDOWS\system32\wopvimtf.exe 2007-12-06 18:55 . 2007-12-07 09:20 831,657 ---hs---- C:\WINDOWS\system32\hswgpftq.ini 2007-12-06 18:45 . 2007-12-06 18:45 74,304 --a------ C:\WINDOWS\system32\jnkiaeis.exe 2007-12-06 17:40 . 2007-12-06 17:40 107 --a------ C:\WINDOWS\wininit.ini 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 22:24 . 2007-12-07 13:03 0 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-12-05 18:34 . 2007-12-05 18:34 d-------- C:\Program Files\wide 2007-12-05 18:34 . 2007-12-05 18:34 d-------- C:\Program Files\Fichiers communs\wide 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 2007-11-21 10:02 . 2007-12-06 00:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-21 10:02 . 2007-11-21 10:02 1,409 --a------ C:\WINDOWS\QTFont.for 2007-11-17 10:05 . 2007-11-17 10:05 0 --a------ C:\WINDOWS\htba . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-07 18:43 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe ----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42D2C2E9-E83F-47CA-AA39-B1471152D444}] C:\Program Files\Internet Explorer\menorusC:\WINDOWS\System32\l4\swdrv83122.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1412445-4FF8-410e-8D24-F2CF86B171A4}] C:\Program Files\PeDevice\PeDev.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Windows Logon Application"="C:\WINDOWS\System32\logon.exe" [2002-08-29 12:45] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{9C0ADB68-353A-61DD-ED09-1D8003A61111}"= C:\WINDOWS\system32\kb1111p.dll [1999-01-01 01:01 18944] "{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\System32\awtqnkh.dll [2007-12-07 19:43 37376] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\awtqnkh] awtqnkh.dll 2007-12-07 19:43 37376 C:\WINDOWS\system32\awtqnkh.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys *Newly Created Service* - ALG *Newly Created Service* - IPNAT *Newly Created Service* - SHAREDACCESS . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-07 15:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 19:43:44 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-07 19:46:27 - machine was rebooted . --- E O F ---

g!rly · Answer

re

je me demande, ce que tu as bien pu faire pour etre autant infecté?!

commence par installer un par feu;  ca limitera les degats...

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html


Copie le texte ci-dessous :

File::
C:\WINDOWS\system32\yxst.exe
C:\WINDOWS	r941.exe
C:\WINDOWS\system32\oqbjhmv.exe
C:\WINDOWS\system32\awtqnkh.dll
C:\WINDOWS\system32\daicsnc.exe
C:\WINDOWS\system32\wopvimtf.exe
C:\WINDOWS\system32\hswgpftq.ini
C:\WINDOWS\system32\jnkiaeis.exe
C:\WINDOWS\wininit.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
C:\WINDOWS\htba 
C:\Program Files\PeDevice\PeDev.dll
C:\WINDOWS\System32\logon.exe
C:\WINDOWS\System32\awtqnkh.dll
C:\WINDOWS\system32\kb1111p.dll
C:\WINDOWS\system32\awtqnkh.dll

Folder::
C:\Program Files\wide
C:\Program Files\Fichiers communs\wide
C:\Program Files\PeDevice

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42D2C2E9-E83F-47CA-AA39-B1471152D444}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1412445-4FF8-410e-8D24-F2CF86B171A4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Logon Application"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{9C0ADB68-353A-61DD-ED09-1D8003A61111}"=-
"{ED203331-9C33-49D8-8714-D24A366A04EC}"= -
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\awtqnkh]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt2.

S'il n'y a pas de rédémarrage, poste quand même le rapport.

et :

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

donc post le rapport de combofix2 et celui de sdfix

@+

sophie · Answer

Rapport combofix ComboFix 07-12-07.3 - Benjamin 2007-12-07 20:58:06.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.162 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Benjamin\Bureau\CFScript.txt * Created a new restore point FILE C:\Program Files\PeDevice\PeDev.dll C:\WINDOWS\htba C:\WINDOWS\QTFont.for C:\WINDOWS\QTFont.qfn C:\WINDOWS\System32\awtqnkh.dll C:\WINDOWS\system32\awtqnkh.dll C:\WINDOWS\system32\daicsnc.exe C:\WINDOWS\system32\hswgpftq.ini C:\WINDOWS\system32\jnkiaeis.exe C:\WINDOWS\system32\kb1111p.dll C:\WINDOWS\System32\logon.exe C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\oqbjhmv.exe C:\WINDOWS\system32\wopvimtf.exe C:\WINDOWS\system32\yxst.exe C:\WINDOWS r941.exe C:\WINDOWS\wininit.ini . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Fichiers communs\wide C:\Program Files\wide C:\Program Files\wide\Activate.exe C:\Program Files\wide\Config\pgs.xml C:\Program Files\wide\Dat\BkSites.dat C:\Program Files\wide\Dat\incmp.dat C:\Program Files\wide\Dat\index.dat C:\Program Files\wide\Engines\plugins\BORLNDMM.DLL C:\Program Files\wide\Engines\plugins\SCANADWR.DLL C:\Program Files\wide\Engines\plugins\SCANBCDR.DLL C:\Program Files\wide\Engines\plugins\SCANDLDR.DLL C:\Program Files\wide\Engines\plugins\SCANDOS1.DLL C:\Program Files\wide\Engines\plugins\SCANEMUL.DLL C:\Program Files\wide\Engines\plugins\SCANFUNC.DLL C:\Program Files\wide\Engines\plugins\SCANKRNL.DLL C:\Program Files\wide\FMTR.sys C:\Program Files\wide\fopnl.dll C:\Program Files\wide\Graphics\cross.gif C:\Program Files\wide\Graphics\ga6p.gif C:\Program Files\wide\Graphics\main.ico C:\Program Files\wide\Graphics\mini.ico C:\Program Files\wide\Graphics\support.ico C:\Program Files\wide\Graphics\uninstall.ico C:\Program Files\wide\LA\License.rtf C:\Program Files\wide\Restart.exe C:\Program Files\wide pt.dll C:\Program Files\wide\RTasks.exe C:\Program Files\wide\scnkrnl.dll C:\Program Files\wide\sqlite3.dll C:\Program Files\wide\Tools\IEFWBHO.dll C:\Program Files\wide\unins000.dat C:\Program Files\wide\unins000.exe C:\Program Files\wide\Up\gup.exe C:\WINDOWS\htba C:\WINDOWS\QTFont.for C:\WINDOWS\QTFont.qfn C:\WINDOWS\system32\accdd.ini C:\WINDOWS\system32\accdd.ini2 C:\WINDOWS\system32\awtqnkh.dll C:\WINDOWS\system32\cbxuvus.dll C:\WINDOWS\system32\ddcbcyx.dll C:\WINDOWS\System32\ddcca.dll C:\WINDOWS\system32\efcdcda.dll C:\WINDOWS\system32\hswgpftq.ini C:\WINDOWS\system32\iexplore.exe C:\WINDOWS\system32\jnkiaeis.exe C:\WINDOWS\system32\kb1111p.dll C:\WINDOWS\system32\khfcdax.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\opnkkjh.dll C:\WINDOWS\system32\wopvimtf.exe C:\WINDOWS\system32\yaywtrr.dll C:\WINDOWS\system32\yayywxw.dll C:\WINDOWS\system32\yxst.exe C:\WINDOWS\wininit.ini . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-07 to 2007-12-07 )))))))))))))))))))))))))))))))))))) . 2007-12-07 21:07 . 2007-12-07 21:07 32,456 --a------ C:\WINDOWS\system32\veyruyh.exe 2007-12-07 20:52 . 2007-12-07 20:52 32,456 --a------ C:\WINDOWS\system32\bgvnj.exe 2007-12-07 20:48 . 2007-12-07 20:48 d-------- C:\Program Files\Sunbelt Software 2007-12-07 20:47 . 2007-12-07 20:48 6,575,800 --a------ C:\Sunbelt-Personal-Firewall.exe 2007-12-07 20:38 . 2007-12-07 20:38 32,456 --a------ C:\WINDOWS\system32\etxpfit.exe 2007-12-07 20:36 . 2007-12-07 20:36 d--h----- C:\Program Files\Fichiers communs\Carlson 2007-12-07 20:36 . 2007-12-07 20:54 45,632 --a------ C:\8e9w3l6u1g1.exe 2007-12-07 20:35 . 2007-12-07 20:35 569,856 -r-hs---- C:\WINDOWS\Mrshield.exe 2007-12-07 20:35 . 2007-12-07 20:35 24,916 --ah----- C:\WINDOWS\system32\gsjyxsl.exe 2007-12-07 20:20 . 2007-12-07 20:20 16,820 --ah----- C:\WINDOWS\system32\dlhiyas.exe 2007-12-07 20:18 . 2007-12-07 20:18 32,456 --a------ C:\WINDOWS\system32\mwoyaetd.exe 2007-12-07 20:09 . 2007-12-07 20:09 129 --a------ C:\WINDOWS\system32\bhkkpvt.bat 2007-12-07 20:08 . 2007-12-07 20:09 66,055 --ah----- C:\WINDOWS\system32\hvtmpqlh.exe 2007-12-07 20:05 . 2007-12-07 20:05 32,456 --a------ C:\WINDOWS\system32\buyia.exe 2007-12-07 19:57 . 2007-12-07 19:57 6,504 --ah----- C:\WINDOWS\system32\dcipnt.exe 2007-12-07 19:51 . 2007-12-07 19:52 33,256 --ah----- C:\WINDOWS\system32\sfbzqd.exe 2007-12-07 19:49 . 2007-12-07 19:49 32,456 --a------ C:\WINDOWS\system32 wma.exe 2007-12-07 19:45 . 2007-12-07 19:46 4,968 --ah----- C:\WINDOWS\system32\haiprc.exe 2007-12-07 19:43 . 2007-12-07 19:43 1,460 --ah----- C:\WINDOWS\system32\jtdfuf.exe 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-07 20:07 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-07 20:05 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-07 20:05 17,920 ----a-w C:\WINDOWS\system32 ftp.exe 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2007-12-07_19.44.48.48 ))))))))))))))))))))))))))))))))))))))))) . + 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\ARPPRODUCTICON.exe + 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe + 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe - 2007-12-03 08:34:00 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-12-07 19:35:54 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-12-03 08:34:00 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2007-12-07 19:35:54 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2007-12-03 08:34:00 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2007-12-07 19:35:54 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2007-12-07 14:08:09 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe + 2007-12-07 20:05:54 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe - 2001-08-28 14:00:00 17,920 -c--a-w C:\WINDOWS\system32\dllcache ftp.exe + 2007-12-07 20:05:54 17,920 -c--a-w C:\WINDOWS\system32\dllcache ftp.exe + 2007-04-26 09:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2007-04-26 09:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys - 2007-12-07 18:43:21 208,513 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2007-12-07 20:06:15 208,518 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2002-08-29 11:45:10 64,902 ---h--w C:\WINDOWS\system32\lssas.exe - 2007-10-28 10:16:38 72,016 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-07 18:44:40 72,016 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-10-28 10:16:38 85,020 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2007-12-07 18:44:40 85,020 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2007-10-28 10:16:38 431,880 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-07 18:44:40 431,880 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-10-28 10:16:38 501,828 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2007-12-07 18:44:40 501,828 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2007-12-07 20:05:15 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5d0.dat . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe ----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Application Layer Gateway Service"="C:\WINDOWS\System32\algs.exe" [] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [2002-08-29 12:45] "Advanced DHTML Enable"="C:\WINDOWS\System32\veyruyh.exe" [2007-12-07 21:07] "Spooler SubSystem App"="C:\WINDOWS\System32\spoolsvc.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"= 1 (0x1) "DisableRegistryTools"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Shell"="Explorer.exe %WINDIR%\Mrshield.exe" "SFCDisable"=dword:ffffff9d R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe" R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe S2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-07 19:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 21:07:23 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-07 21:09:57 - machine was rebooted C:\ComboFix2.txt ... 2007-12-07 19:46 . --- E O F ---

g!rly · Answer

post le rapport de sdfix et refais un combofix et post les deux rapports stp

sophie · Answer

rapport sdfix SDFix: Version 1.117 Run by Benjamin on 07/12/2007 at 21:19 Microsoft Windows XP [version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Name: Microsoft register shield Path: "C:\WINDOWS\Mrshield.exe" Microsoft register shield - Deleted C:\WINDOWS\system32\Microsoft\backup.ftp Found C:\WINDOWS\system32\Microsoft\backup.tftp Found Checking files: Genuine: C:\WINDOWS\system32\Microsoft\backup.tftp Dummy: C:\WINDOWS\system32\Microsoft\backup.ftp C:\WINDOWS\system32\ftp.exe C:\WINDOWS\system32 ftp.exe C:\WINDOWS\system32\dllcache\ftp.exe C:\WINDOWS\system32\dllcache ftp.exe Files copied to SDFix\Backups Restoring files if backups are found Final Check: Genuine: C:\WINDOWS\system32\Microsoft\backup.tftp C:\WINDOWS\system32 ftp.exe C:\WINDOWS\system32\dllcache ftp.exe Dummy: C:\WINDOWS\system32\Microsoft\backup.ftp C:\WINDOWS\system32\ftp.exe C:\WINDOWS\system32\dllcache\ftp.exe Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\Program Files\Fichiers communs\Carlson\carlton - Deleted C:\WINDOWS\Mrshield.exe - Deleted C:\WINDOWS\system32\algs.exe - Deleted C:\WINDOWS\system32\i - Deleted C:\WINDOWS\system32\lssas.exe - Deleted C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted C:\WINDOWS\system32\setup_74474.exe - Deleted C:\WINDOWS\system32\TFTP844 - Deleted C:\WINDOWS\Temp emovalfile.bat - Deleted Folder C:\Program Files\Fichiers communs\Carlson - Removed Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32 toskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 21:25:22 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... IPC error: 2 Le fichier spécifié est introuvable. scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:eaf5973b "s2"=dword:5ea2f835 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\" "h0"=dword:00000001 "ujdew"=hex:cb,63,eb,6e,4b,53,69,2c,0c,94,94,40,0e,dc,a8,5f,76,78,7c,4a,b9,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:86,97,a0,18,97,1c,d3,91,56,c0,21,ef,f8,62,62,0b,bb,fa,43,da,00,.. "p0"="F:\daemon tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a4,3a,e1,df,05,33,9c,48,44,c6,e2,6e,98,a5,0c,36,6a,.. "khjeh"=hex:b5,a2,e0,6b,4f,4f,73,e9,a9,96,aa,8e,61,10,53,85,06,af,94,a4,af,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:fb,47,fa,ea,4d,1e,e8,0e,6d,bf,01,7d,14,38,b3,bd,42,82,59,e4,3e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\" "h0"=dword:00000001 "ujdew"=hex:cb,63,eb,6e,4b,53,69,2c,0c,94,94,40,0e,dc,a8,5f,76,78,7c,4a,b9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:86,97,a0,18,97,1c,d3,91,56,c0,21,ef,f8,62,62,0b,bb,fa,43,da,00,.. "p0"="F:\daemon tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a4,3a,e1,df,05,33,9c,48,44,c6,e2,6e,98,a5,0c,36,6a,.. "khjeh"=hex:b5,a2,e0,6b,4f,4f,73,e9,a9,96,aa,8e,61,10,53,85,06,af,94,a4,af,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:fb,47,fa,ea,4d,1e,e8,0e,6d,bf,01,7d,14,38,b3,bd,42,82,59,e4,3e,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000091 "TracesSuccessful"=dword:00000002 scanning hidden files ... C:\Documents and Settings\Benjamin\Local Settings\Application Data\Microsoft\Messenger\baj14@hotmail.fr\SharingMetadata\julienmarie55@hotmail.fr\DFSR\Staging\CS{D7666AA6-430C-1755-FD5E-754704CD9672}\01\10-{D7666AA6-430C-1755-FD5E-754704CD9672}-v1-{741C0C78-B3A3-4962-90CF-50961B2A2F72}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API C:\Documents and Settings\Benjamin\Local Settings\Application Data\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims™ 2 : Boit@Look.lnk 540 bytes hidden from API scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 2 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Fri 7 Dec 2007 6,504 A..H. --- "C:\WINDOWS\system32\dcipnt.exe" Fri 7 Dec 2007 16,820 A..H. --- "C:\WINDOWS\system32\dlhiyas.exe" Thu 19 May 2005 56 ..SHR --- "C:\WINDOWS\system32\E6766994AD.sys" Fri 7 Dec 2007 24,916 A..H. --- "C:\WINDOWS\system32\gsjyxsl.exe" Fri 7 Dec 2007 4,968 A..H. --- "C:\WINDOWS\system32\haiprc.exe" Fri 7 Dec 2007 66,055 A..H. --- "C:\WINDOWS\system32\hvtmpqlh.exe" Fri 7 Dec 2007 1,460 A..H. --- "C:\WINDOWS\system32\jtdfuf.exe" Sun 20 Aug 2006 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Fri 7 Dec 2007 28,328 A..H. --- "C:\WINDOWS\system32\kkhbef.exe" Fri 7 Dec 2007 33,256 A..H. --- "C:\WINDOWS\system32\sfbzqd.exe" Mon 6 Nov 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 13 Apr 2006 74,240 ...H. --- "C:\Documents and Settings\Benjamin\Mes documents\~WRL0882.tmp" Wed 23 May 2007 39,424 ...H. --- "C:\Documents and Settings\Benjamin\Mes documents\~WRL1516.tmp" Wed 23 May 2007 24,064 ...H. --- "C:\Documents and Settings\Benjamin\Mes documents\~WRL2617.tmp" Wed 23 May 2007 48,128 ...H. --- "C:\Documents and Settings\Benjamin\Mes documents\~WRL2922.tmp" Finished! rapport combofix ComboFix 07-12-07.3 - Benjamin 2007-12-07 19:38:37.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.159 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Fichiers communs\{3CD8C~1 C:\Program Files\Fichiers communs\{3CD8C~2 C:\Program Files\Fichiers communs\uninstall information C:\Program Files\ipwindows C:\Program Files\ipwindows\pop154.tmp C:\Program Files\ipwindows\pop161.tmp C:\Program Files\ipwindows\pop165.tmp C:\Program Files\ipwindows\pop166.tmp C:\Program Files\ipwindows\pop167.tmp C:\Program Files\ipwindows\pop16B.tmp C:\Program Files\ipwindows\pop16C.tmp C:\Program Files\ipwindows\pop16E.tmp C:\Program Files\ipwindows\pop171.tmp C:\Program Files\ipwindows\pop17C.tmp C:\Program Files\ipwindows\pop180.tmp C:\Program Files\ipwindows\pop181.tmp C:\Program Files\ipwindows\pop18A.tmp C:\Program Files\ipwindows\pop18D.tmp C:\Program Files\ipwindows\pop18E.tmp C:\Program Files\ipwindows\pop193.tmp C:\Program Files\ipwindows\pop194.tmp C:\Program Files\ipwindows\pop195.tmp C:\Program Files\ipwindows\pop198.tmp C:\Program Files\ipwindows\pop1A1.tmp C:\Program Files\ipwindows\pop1A5.tmp C:\Program Files\ipwindows\pop1B1.tmp C:\Program Files\ipwindows\pop1BA.tmp C:\Program Files\ipwindows\set152.tmp C:\Program Files\ipwindows\set153.tmp C:\Program Files\ipwindows\Uninst.exe C:\Program Files\ipwins C:\Program Files\ipwins\pop101.tmp C:\Program Files\ipwins\pop11D.tmp C:\Program Files\ipwins\pop11F.tmp C:\Program Files\ipwins\Uninst.exe C:\WINDOWS\pack.epk C:\WINDOWS\system32\bcrfturw.ini C:\WINDOWS\system32\Cache C:\WINDOWS\system32\f3 C:\WINDOWS\system32\h1 C:\WINDOWS\system32\jkkjghg.dll C:\WINDOWS\system32\khfebyw.dll C:\WINDOWS\system32\l4 C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32 heqtvmd.dll C:\WINDOWS\System32\sstts.dll C:\WINDOWS\system32\sttss.ini C:\WINDOWS\system32\sttss.ini2 C:\WINDOWS\system32\svchosts.lzma C:\WINDOWS\system32\whrflouw.dll C:\WINDOWS\system32\wrutfrcb.dll C:\WINDOWS mlpcert2007 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_COM+_MESSAGES -------\LEGACY_DOMAINSERVICE -------\LEGACY_IPRIP -------\DomainService -------\Iprip ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-07 to 2007-12-07 )))))))))))))))))))))))))))))))))))) . 2007-12-07 19:43 . 2007-12-07 19:43 66,055 --ah----- C:\WINDOWS\system32\yxst.exe 2007-12-07 19:43 . 2007-12-07 19:43 59,392 --a------ C:\WINDOWS r941.exe 2007-12-07 19:43 . 2007-12-07 19:43 50,448 --ah----- C:\WINDOWS\system32\oqbjhmv.exe 2007-12-07 19:43 . 2007-12-07 19:43 37,376 --a------ C:\WINDOWS\system32\awtqnkh.dll 2007-12-07 19:43 . 2007-12-07 19:43 36,864 --ah----- C:\WINDOWS\system32\daicsnc.exe 2007-12-07 09:28 . 2007-12-07 09:28 74,304 --a------ C:\WINDOWS\system32\wopvimtf.exe 2007-12-06 18:55 . 2007-12-07 09:20 831,657 ---hs---- C:\WINDOWS\system32\hswgpftq.ini 2007-12-06 18:45 . 2007-12-06 18:45 74,304 --a------ C:\WINDOWS\system32\jnkiaeis.exe 2007-12-06 17:40 . 2007-12-06 17:40 107 --a------ C:\WINDOWS\wininit.ini 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 22:24 . 2007-12-07 13:03 0 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-12-05 18:34 . 2007-12-05 18:34 d-------- C:\Program Files\wide 2007-12-05 18:34 . 2007-12-05 18:34 d-------- C:\Program Files\Fichiers communs\wide 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 2007-11-21 10:02 . 2007-12-06 00:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-21 10:02 . 2007-11-21 10:02 1,409 --a------ C:\WINDOWS\QTFont.for 2007-11-17 10:05 . 2007-11-17 10:05 0 --a------ C:\WINDOWS\htba . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-07 18:43 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe ----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42D2C2E9-E83F-47CA-AA39-B1471152D444}] C:\Program Files\Internet Explorer\menorusC:\WINDOWS\System32\l4\swdrv83122.exe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1412445-4FF8-410e-8D24-F2CF86B171A4}] C:\Program Files\PeDevice\PeDev.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Windows Logon Application"="C:\WINDOWS\System32\logon.exe" [2002-08-29 12:45] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{9C0ADB68-353A-61DD-ED09-1D8003A61111}"= C:\WINDOWS\system32\kb1111p.dll [1999-01-01 01:01 18944] "{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\System32\awtqnkh.dll [2007-12-07 19:43 37376] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\awtqnkh] awtqnkh.dll 2007-12-07 19:43 37376 C:\WINDOWS\system32\awtqnkh.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys *Newly Created Service* - ALG *Newly Created Service* - IPNAT *Newly Created Service* - SHAREDACCESS . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-07 15:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 19:43:44 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-07 19:46:27 - machine was rebooted . --- E O F ---

g!rly · Answer

re,

peux tu me poster le rapport de combofix numero 3 car la c´est le meme que plus haut

@+

sophie · Answer

je n'obtiens pas de rapport combofix par contre j'ai un dossier avenger qui s'est crée et ceci:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vkquwexg

*******************

Script file located at: \??\C:\ComboFix\ComboDel.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\xxywwwx.dll not found!
File move operation C:\WINDOWS\system32\xxywwwx.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\xxywwwx.dll.vir failed!

Could not process line:
C:\WINDOWS\system32\xxywwwx.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\xxywwwx.dll.vir
Status: 0xc0000034


Completed script processing.

*******************

Finished!  Terminate.

g!rly · Answer

non mais j´allucine je t´ai jamais demandé d´utilisé avenger?

fais ceci :

click sur demarrer > executer >

dans la boite de dialogue tape ceci : Combofix /u et valide par ok remarque qu´il y a un espace en combofix et /u

puis choisie 2  a la demande

pour etre sur qu´il n´est plus present 

verifie qu´il n´est plus sur ton bureau

et 

regarde en suite a la racine de c et verifie qu´il n´y a pas de combofix ou de qoobox et pas de combofix.txt

puis 

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

sophie · Answer

Je sais bien que tu ne m'as dit dit d'utiliser avenger et je ne l'ai pas fait!

sophie · Answer

voila le rapport et merci pour ton aide et ta patience ComboFix 07-12-07.3 - Benjamin 2007-12-07 23:07:54.6 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.164 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés 2007-11-07 to 2007-12-07 )))))))))))))))))))))))))))))))))))) . 2007-12-07 22:25 . 2007-12-07 22:25 d--h----- C:\Program Files\Fichiers communs\Carlson 2007-12-07 22:22 . 2007-12-07 22:22 569,856 -r-hs---- C:\WINDOWS\Mrshield.exe 2007-12-07 22:21 . 2007-12-07 22:22 59,884 --ah----- C:\WINDOWS\system32\oqvrp.exe 2007-12-07 21:18 . 2007-12-07 21:18 d-------- C:\WINDOWS\ERUNT 2007-12-07 21:16 . 2007-12-07 21:16 165 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-07 21:15 . 2007-12-07 21:15 28,328 --ah----- C:\WINDOWS\system32\kkhbef.exe 2007-12-07 21:07 . 2007-12-07 21:07 32,456 --a------ C:\WINDOWS\system32\veyruyh.exe 2007-12-07 20:52 . 2007-12-07 20:52 32,456 --a------ C:\WINDOWS\system32\bgvnj.exe 2007-12-07 20:48 . 2007-12-07 20:48 d-------- C:\Program Files\Sunbelt Software 2007-12-07 20:47 . 2007-12-07 20:48 6,575,800 --a------ C:\Sunbelt-Personal-Firewall.exe 2007-12-07 20:38 . 2007-12-07 20:38 32,456 --a------ C:\WINDOWS\system32\etxpfit.exe 2007-12-07 20:36 . 2007-12-07 22:48 45,632 --a------ C:\8e9w3l6u1g1.exe 2007-12-07 20:35 . 2007-12-07 20:35 24,916 --ah----- C:\WINDOWS\system32\gsjyxsl.exe 2007-12-07 20:20 . 2007-12-07 20:20 16,820 --ah----- C:\WINDOWS\system32\dlhiyas.exe 2007-12-07 20:18 . 2007-12-07 20:18 32,456 --a------ C:\WINDOWS\system32\mwoyaetd.exe 2007-12-07 20:09 . 2007-12-07 20:09 129 --a------ C:\WINDOWS\system32\bhkkpvt.bat 2007-12-07 20:08 . 2007-12-07 20:09 66,055 --ah----- C:\WINDOWS\system32\hvtmpqlh.exe 2007-12-07 20:05 . 2007-12-07 20:05 32,456 --a------ C:\WINDOWS\system32\buyia.exe 2007-12-07 19:57 . 2007-12-07 19:57 6,504 --ah----- C:\WINDOWS\system32\dcipnt.exe 2007-12-07 19:51 . 2007-12-07 19:52 33,256 --ah----- C:\WINDOWS\system32\sfbzqd.exe 2007-12-07 19:49 . 2007-12-07 19:49 32,456 --a------ C:\WINDOWS\system32 wma.exe 2007-12-07 19:45 . 2007-12-07 19:46 4,968 --ah----- C:\WINDOWS\system32\haiprc.exe 2007-12-07 19:43 . 2007-12-07 19:43 1,460 --ah----- C:\WINDOWS\system32\jtdfuf.exe 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-07 22:12 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-07 21:38 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-07 21:38 17,920 ----a-w C:\WINDOWS\system32 ftp.exe 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe ----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Windows Network Firewall"="C:\WINDOWS\System32\firewall.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage rapide du logiciel HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22] Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [1999-08-06 08:53:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\xxywwwx] xxywwwx.dll R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe" R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-07 19:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 23:11:49 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-07 23:13:41 . --- E O F ---

g!rly · Answer

je reviendrais demain je pars me coucher

@+

sophie · Answer

ok, bonne nuit et encore merci

g!rly · Answer

salut sophie;benjamin,

j´ai comme une sle impression apres les evenements d´hier, avais tu relancé msn?

peux tu recommencer msnfix stp et poster le resultat ici 

@+

sophie · Answer

Salut,

j'ai relancé msn ce matin mais je l'ai tout de suite éteint me disant que ce n'était pas une bonne idée

voici le rapport msnfix

MSNFix 1.60  
 
C:\Documents and Settings\Benjamin\Bureau\MSNFix 
Fix exécuté le 08/12/2007 - 12:34:01,14 By Benjamin 
mode normal    
    
************************ Recherche les fichiers présents      
    
Aucun Fichier trouvé 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
************************ Fichiers suspects 
 
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention 
 
[C:\eMule0.47c-Installer.exe] D388CDC4DDA65263F7DB385989AF7160 
[C:\setupfre.exe] 344BFAC571828B079F2595FAC6FC1458 
[C:\spybotsd15.exe] 9286D3952F8CB08AD1BB4F3122E144CC 
[C:\Sunbelt-Personal-Firewall.exe] 841AF49B8CFAFE4CCFC1C4D70B2A3106 
[C:\PROGRA~1\Install_Messenger.exe] 4408BC2F0845D823E24B8C8B1B69895E 
[C:\PROGRA~1\uTorrent-1.6-install.exe] A4FA400AEC5E3E6AFD9ECF5774F8CAD4 

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier  [b] C:\DOCUME~1\Benjamin\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

 
  
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

g!rly · Answer

bon tres bien,

Copie le texte ci-dessous :

File::
C:\Program Files\Fichiers communs\Carlson
C:\WINDOWS\system32\oqvrp.exe
C:\WINDOWS\system32\kkhbef.exe
C:\WINDOWS\system32\veyruyh.exe
C:\WINDOWS\system32\bgvnj.exe
C:\WINDOWS\system32\etxpfit.exe
C:\8e9w3l6u1g1.exe
C:\WINDOWS\system32\gsjyxsl.exe
C:\WINDOWS\system32\dlhiyas.exe
C:\WINDOWS\system32\mwoyaetd.exe
C:\WINDOWS\system32\bhkkpvt.bat
C:\WINDOWS\system32\hvtmpqlh.exe
C:\WINDOWS\system32\buyia.exe
C:\WINDOWS\system32\dcipnt.exe
C:\WINDOWS\system32\sfbzqd.exe
C:\WINDOWS\system32
wma.exe
C:\WINDOWS\system32\haiprc.exe
C:\WINDOWS\system32\jtdfuf.exe
C:\WINDOWS\system32\daSgo01
C:\WINDOWS\System32\firewall.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Network Firewall"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\xxywwwx]


Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt

S'il n'y a pas de rédémarrage, poste quand même le rapport.

@+

sophie · Answer

voilà: ComboFix 07-12-07.3 - Benjamin 2007-12-08 13:20:56.7 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.155 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Benjamin\Bureau\CFScript.txt * Created a new restore point FILE C:\8e9w3l6u1g1.exe C:\Program Files\Fichiers communs\Carlson C:\WINDOWS\system32\bgvnj.exe C:\WINDOWS\system32\bhkkpvt.bat C:\WINDOWS\system32\buyia.exe C:\WINDOWS\system32\daSgo01 C:\WINDOWS\system32\dcipnt.exe C:\WINDOWS\system32\dlhiyas.exe C:\WINDOWS\system32\etxpfit.exe C:\WINDOWS\System32\firewall.exe C:\WINDOWS\system32\gsjyxsl.exe C:\WINDOWS\system32\haiprc.exe C:\WINDOWS\system32\hvtmpqlh.exe C:\WINDOWS\system32\jtdfuf.exe C:\WINDOWS\system32\kkhbef.exe C:\WINDOWS\system32\mwoyaetd.exe C:\WINDOWS\system32 wma.exe C:\WINDOWS\system32\oqvrp.exe C:\WINDOWS\system32\sfbzqd.exe C:\WINDOWS\system32\veyruyh.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ahsiarxe.dll C:\WINDOWS\system32\awtqnkh.dll C:\WINDOWS\system32\bccdd.ini C:\WINDOWS\system32\bccdd.ini2 C:\WINDOWS\system32\bgvnj.exe C:\WINDOWS\system32\bhkkpvt.bat C:\WINDOWS\system32\buyia.exe C:\WINDOWS\system32\dcipnt.exe C:\WINDOWS\System32\ddccb.dll C:\WINDOWS\system32\dlhiyas.exe C:\WINDOWS\system32\dnuhysbd.dll C:\WINDOWS\system32\efcdaab.dll C:\WINDOWS\system32\etxpfit.exe C:\WINDOWS\system32\exraisha.ini C:\WINDOWS\system32\gsjyxsl.exe C:\WINDOWS\system32\haiprc.exe C:\WINDOWS\system32\hggddbx.dll C:\WINDOWS\system32\hvtmpqlh.exe C:\WINDOWS\system32\jtdfuf.exe C:\WINDOWS\system32\kkhbef.exe C:\WINDOWS\system32\mwoyaetd.exe C:\WINDOWS\system32 wma.exe C:\WINDOWS\system32\oqvrp.exe C:\WINDOWS\system32 qroljh.dll C:\WINDOWS\system32\sfbzqd.exe C:\WINDOWS\system32 uvvspq.dll C:\WINDOWS\system32\veyruyh.exe C:\WINDOWS\system32\vturpmj.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))))))) . 2007-12-07 23:22 . 2007-12-07 23:22 569,856 --a------ C:\WINDOWS\system32 yn.exe 2007-12-07 23:22 . 2007-12-07 23:22 10,736 --ah----- C:\WINDOWS\system32\sgzfts.exe 2007-12-07 21:18 . 2007-12-07 21:18 d-------- C:\WINDOWS\ERUNT 2007-12-07 21:16 . 2007-12-07 21:16 165 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-07 20:48 . 2007-12-07 20:48 d-------- C:\Program Files\Sunbelt Software 2007-12-07 20:47 . 2007-12-07 20:48 6,575,800 --a------ C:\Sunbelt-Personal-Firewall.exe 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-08 12:39 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-08 08:16 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2007-12-07_23.12.16,85 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:10 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE - 2007-12-07 21:22:41 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-12-07 22:22:56 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-12-07 21:22:41 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2007-12-07 22:22:56 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2007-12-07 21:22:41 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2007-12-07 22:22:56 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2007-12-07 21:38:02 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe + 2007-12-08 08:16:26 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe - 2007-12-07 21:38:02 17,920 -c--a-w C:\WINDOWS\system32\dllcache ftp.exe + 2001-08-28 14:00:00 17,920 -c--a-w C:\WINDOWS\system32\dllcache ftp.exe - 2007-12-07 21:38:14 208,518 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2007-12-08 12:38:22 208,512 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin - 2007-12-07 21:38:02 17,920 ----a-w C:\WINDOWS\system32 ftp.exe + 2001-08-28 14:00:00 17,920 ----a-w C:\WINDOWS\system32 ftp.exe + 2007-12-08 12:38:06 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5e4.dat . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe ----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [2002-08-29 12:45] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\System32\wvuvsrq.dll [2007-12-08 13:41 37376] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\wvuvsrq] wvuvsrq.dll 2007-12-08 13:41 37376 C:\WINDOWS\system32\wvuvsrq.dll R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-07 19:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-08 13:39:05 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-08 13:42:17 - machine was rebooted C:\ComboFix2.txt ... 2007-12-07 23:13 . --- E O F ---

g!rly · Answer

re,

Copie le texte ci-dessous :

File::
C:\WINDOWS\system32	yn.exe
C:\WINDOWS\system32\sgzfts.exe
C:\WINDOWS\system32\wvuvsrq.dll

Folder::

Registry::
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{ED203331-9C33-49D8-8714-D24A366A04EC}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wvuvsrq]

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 


Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt3 accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

sophie · Answer

Rapport combofix ComboFix 07-12-08.1 - Benjamin 2007-12-08 15:00:07.9 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.173 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Benjamin\Bureau\CFScript.txt * Created a new restore point FILE C:\8e9w3l6u1g1.exe C:\Program Files\Fichiers communs\Carlson C:\WINDOWS\system32\bgvnj.exe C:\WINDOWS\system32\bhkkpvt.bat C:\WINDOWS\system32\buyia.exe C:\WINDOWS\system32\daSgo01 C:\WINDOWS\system32\dcipnt.exe C:\WINDOWS\system32\dlhiyas.exe C:\WINDOWS\system32\etxpfit.exe C:\WINDOWS\System32\firewall.exe C:\WINDOWS\system32\gsjyxsl.exe C:\WINDOWS\system32\haiprc.exe C:\WINDOWS\system32\hvtmpqlh.exe C:\WINDOWS\system32\jtdfuf.exe C:\WINDOWS\system32\kkhbef.exe C:\WINDOWS\system32\mwoyaetd.exe C:\WINDOWS\system32 wma.exe C:\WINDOWS\system32\oqvrp.exe C:\WINDOWS\system32\sfbzqd.exe C:\WINDOWS\system32\veyruyh.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\pmnoljj.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))))))) . 2007-12-08 14:27 . 2007-12-08 14:28 65,004 --ah----- C:\WINDOWS\system32\zrsx.exe 2007-12-08 14:27 . 2007-12-08 14:27 14,600 --ah----- C:\WINDOWS\system32\wacumik.exe 2007-12-08 14:27 . 2007-12-08 14:28 1,460 --ah----- C:\WINDOWS\system32\uzgb.exe 2007-12-08 14:18 . 2007-12-08 14:18 1,024 --ah----- C:\WINDOWS\system32\lxtcau.exe 2007-12-08 13:50 . 2007-12-08 13:50 66,055 --ah----- C:\WINDOWS\system32\ptocjvvc.exe 2007-12-08 13:50 . 2007-12-08 13:50 66,055 --ah----- C:\WINDOWS\system32\ddnolyw.exe 2007-12-08 13:50 . 2007-12-08 13:50 66,055 --ah----- C:\WINDOWS\system32\awgosbn.exe 2007-12-08 13:50 . 2007-12-08 13:50 9,376 --ah----- C:\WINDOWS\system32\bhmqdg.exe 2007-12-08 13:41 . 2007-12-08 13:41 39,160 --ah----- C:\WINDOWS\system32\zejn.exe 2007-12-07 21:18 . 2007-12-07 21:18 d-------- C:\WINDOWS\ERUNT 2007-12-07 21:16 . 2007-12-07 21:16 165 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-07 20:48 . 2007-12-07 20:48 d-------- C:\Program Files\Sunbelt Software 2007-12-07 20:47 . 2007-12-07 20:48 6,575,800 --a------ C:\Sunbelt-Personal-Firewall.exe 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-08 14:14 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-08 08:16 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe ----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [2002-08-29 12:45] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-07 19:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2800.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll . ************************************************************************** catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-08 15:14:19 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-08 15:16:57 - machine was rebooted . --- E O F ---

g!rly · Answer

salut

je ta´vais demander de faire ceci :

Copie le texte ci-dessous :

File::
C:\WINDOWS\system32	yn.exe
C:\WINDOWS\system32\sgzfts.exe
C:\WINDOWS\system32\wvuvsrq.dll

Folder::

Registry::
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{ED203331-9C33-49D8-8714-D24A366A04EC}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wvuvsrq]

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

je me demande ce qu´il se passe en faite

dis moi ce que tu as fais

@+

sophie · Answer

j'ai essayer d'ouvrir le fichier party.jpg que j'ai reçu par msn, quand je me suis rendue compte que c'était un virus, j'ai essayé de le supprimer. ça n'a pas marché donc je suis venue demander de l'aide. C'est tout ce que j'ai fait. Mon cas est despéré? j'ai une connexion réseau "carlton" qui est apparue, je ne sais pas ce que c'est... voici le rapport ComboFix 07-12-08.1 - Benjamin 2007-12-08 17:15:38.11 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.192 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Benjamin\Bureau\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\sgzfts.exe C:\WINDOWS\system32 yn.exe C:\WINDOWS\system32\wvuvsrq.dll . ((((((((((((((((((((((((((((( Fichiers créés 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))))))) . 2007-12-08 16:13 . 2007-12-08 16:13 d--h----- C:\Program Files\Fichiers communs\Carlson 2007-12-08 16:12 . 2007-12-08 16:12 569,856 -r-hs---- C:\WINDOWS\Mrshield.exe 2007-12-08 16:12 . 2007-12-08 17:08 45,632 --a------ C:\8e9w3l6u1g1.exe 2007-12-08 16:12 . 2007-12-08 16:12 3,584 --ah----- C:\WINDOWS\system32 lihjh.exe 2007-12-08 16:12 . 2007-12-08 16:12 0 --ah----- C:\WINDOWS\system32\iyvupgi.exe 2007-12-08 16:11 . 2007-12-08 16:11 16,384 --ah----- C:\WINDOWS\system32\dswlmkvx.exe 2007-12-08 16:06 . 2007-12-08 16:06 47,602 --ah----- C:\WINDOWS\system32\fgtimrzv.exe 2007-12-08 16:06 . 2007-12-08 16:06 130 --a------ C:\WINDOWS\system32 myxqsad.bat 2007-12-08 14:27 . 2007-12-08 14:28 65,004 --ah----- C:\WINDOWS\system32\zrsx.exe 2007-12-08 14:27 . 2007-12-08 14:27 14,600 --ah----- C:\WINDOWS\system32\wacumik.exe 2007-12-08 14:27 . 2007-12-08 14:28 1,460 --ah----- C:\WINDOWS\system32\uzgb.exe 2007-12-08 14:18 . 2007-12-08 14:18 1,024 --ah----- C:\WINDOWS\system32\lxtcau.exe 2007-12-08 13:50 . 2007-12-08 13:50 66,055 --ah----- C:\WINDOWS\system32\ptocjvvc.exe 2007-12-08 13:50 . 2007-12-08 13:50 66,055 --ah----- C:\WINDOWS\system32\ddnolyw.exe 2007-12-08 13:50 . 2007-12-08 13:50 66,055 --ah----- C:\WINDOWS\system32\awgosbn.exe 2007-12-08 13:50 . 2007-12-08 13:50 9,376 --ah----- C:\WINDOWS\system32\bhmqdg.exe 2007-12-08 13:41 . 2007-12-08 13:41 39,160 --ah----- C:\WINDOWS\system32\zejn.exe 2007-12-07 21:18 . 2007-12-07 21:18 d-------- C:\WINDOWS\ERUNT 2007-12-07 21:16 . 2007-12-07 21:16 165 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-08 16:27 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-08 16:07 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-08 16:07 17,920 ----a-w C:\WINDOWS\system32 ftp.exe 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe ----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage rapide du logiciel HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22] Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [1999-08-06 08:53:00] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"= 1 (0x1) "DisableRegistryTools"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Shell"="Explorer.exe %WINDIR%\Mrshield.exe" R2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe" R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe S2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-08 15:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll PROCESS: C:\WINDOWS\explorer.exe [6.00.2800.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll . ************************************************************************** catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-08 17:27:23 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-08 17:28:19 . --- E O F ---

g!rly · Answer

re,

pour te dire quelle est mom inquietude :

nous avons commencé la desinfection apres le msnfix avec combofix, apres est survenu ce "plan" avec avenger? je suspect une autre personne ayant acces a ton pc d´avoir executé cette manoeuvre? je n´en suis pas sur pour autant et je ne voie pas par quel biai? mais la situation est telle que je voie dans combofix des fichiers qui ne devraient plus y etre, ceux qui on ete effacés par msnfix au depart et qui ne sont meme plus detecté par ce dernier et encore moins par combofix,

on va essayer encore avec combofix :

Copie le texte ci-dessous :

File::
C:\Program Files\Fichiers communs\Carlson
C:\WINDOWS\Mrshield.exe
C:\8e9w3l6u1g1.exe
C:\WINDOWS\system32\rlihjh.exe
C:\WINDOWS\system32\iyvupgi.exe
C:\WINDOWS\system32\dswlmkvx.exe
C:\WINDOWS\system32\fgtimrzv.exe
C:\WINDOWS\system32\rmyxqsad.bat
C:\WINDOWS\system32\zrsx.exe
C:\WINDOWS\system32\wacumik.exe
C:\WINDOWS\system32\uzgb.exe
C:\WINDOWS\system32\lxtcau.exe
C:\WINDOWS\system32\ptocjvvc.exe
C:\WINDOWS\system32\ddnolyw.exe
C:\WINDOWS\system32\awgosbn.exe
C:\WINDOWS\system32\bhmqdg.exe
C:\WINDOWS\system32\zejn.exe 

Folder::


Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0
"DisableRegistryTools"=0

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 


Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt ( le drenier) accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

sophie · Answer

ComboFix 07-12-08.1 - Benjamin 2007-12-08 18:17:18.12 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.191 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Benjamin\Bureau\CFScript.txt * Created a new restore point FILE C:\8e9w3l6u1g1.exe C:\Program Files\Fichiers communs\Carlson C:\WINDOWS\Mrshield.exe C:\WINDOWS\system32\awgosbn.exe C:\WINDOWS\system32\bhmqdg.exe C:\WINDOWS\system32\ddnolyw.exe C:\WINDOWS\system32\dswlmkvx.exe C:\WINDOWS\system32\fgtimrzv.exe C:\WINDOWS\system32\iyvupgi.exe C:\WINDOWS\system32\lxtcau.exe C:\WINDOWS\system32\ptocjvvc.exe C:\WINDOWS\system32 lihjh.exe C:\WINDOWS\system32 myxqsad.bat C:\WINDOWS\system32\uzgb.exe C:\WINDOWS\system32\wacumik.exe C:\WINDOWS\system32\zejn.exe C:\WINDOWS\system32\zrsx.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\8e9w3l6u1g1.exe C:\WINDOWS\Mrshield.exe C:\WINDOWS\system32\awgosbn.exe C:\WINDOWS\system32\bhmqdg.exe C:\WINDOWS\system32\ddnolyw.exe C:\WINDOWS\system32\dswlmkvx.exe C:\WINDOWS\system32\fgtimrzv.exe C:\WINDOWS\system32\iyvupgi.exe C:\WINDOWS\system32\lxtcau.exe C:\WINDOWS\system32\ptocjvvc.exe C:\WINDOWS\system32 lihjh.exe C:\WINDOWS\system32 myxqsad.bat C:\WINDOWS\system32\uzgb.exe C:\WINDOWS\system32\wacumik.exe C:\WINDOWS\system32\zejn.exe C:\WINDOWS\system32\zrsx.exe . ((((((((((((((((((((((((((((( Fichiers créés 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))))))) . 2007-12-08 17:54 . 2007-12-08 17:54 d-------- C:\Program Files\Sunbelt Software 2007-12-08 17:46 . 2007-12-08 17:47 d-------- C:\WINDOWS\Internet Logs 2007-12-08 16:13 . 2007-12-08 16:13 d--h----- C:\Program Files\Fichiers communs\Carlson 2007-12-07 21:18 . 2007-12-07 21:18 d-------- C:\WINDOWS\ERUNT 2007-12-07 21:16 . 2007-12-07 21:16 165 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-08 17:16 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-08 16:56 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-08 16:56 17,920 ----a-w C:\WINDOWS\system32 ftp.exe 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2007-12-08_17.27.23,90 ))))))))))))))))))))))))))))))))))))))))) . + 2007-12-08 16:54:53 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\ARPPRODUCTICON.exe - 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe + 2007-12-08 16:54:53 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe - 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe + 2007-12-08 16:54:54 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe - 2007-12-08 16:07:45 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe + 2007-12-08 16:56:32 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe - 2007-12-08 16:07:45 17,920 -c--a-w C:\WINDOWS\system32\dllcache ftp.exe + 2007-12-08 16:56:32 17,920 -c--a-w C:\WINDOWS\system32\dllcache ftp.exe + 2007-04-26 09:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2007-04-26 09:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys - 2007-12-08 16:08:28 208,513 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2007-12-08 16:56:47 208,512 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2007-12-08 16:56:01 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5cc.dat . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe ----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage rapide du logiciel HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22] Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [1999-08-06 08:53:00] R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe" R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-08 15:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll . ************************************************************************** catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-08 18:21:39 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-08 18:23:33 C:\ComboFix2.txt ... 2007-12-08 17:28 . --- E O F ---

g!rly · Answer

ok

ce que je te propose maintenant est de desinstaller avast et de le remplacer par antivir

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors 

Telecharge et instal l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner... 

une fois antivir ouvert click sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite puis dans la nouvelle fenetre a gauche >scanner > scan all files et en dessous >scanner priority = High
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level 

puis fais un scan complet de ta macine avec antivir en mode sans echec avec antivir :

Comment redémarrer en mode sans echec? 

   Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
   Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
   capture d´ecran : http://www.coupdepoucepc.com/images_cdppc4/fichespratiques/windowsxp/modese/modese2.jpg
   Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
   Ps : si F8 ne marche pas utilise la touche F5.

post le rapport de antivir ici 

@+

sophie · Answer

rapport antivir

AntiVir PersonalEdition Classic
Report file date: samedi 8 décembre 2007  19:29

Scanning for 835736 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 1)  [5.1.2600]
Username:         Benjamin
Computer name:    BENJ

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.1        2048 Bytes  13/09/2007 14:27:04
ANTIVIR3.VDF : 7.0.0.2        2048 Bytes  13/09/2007 14:27:13
AVEWIN32.DLL : 7.6.0.15    2806272 Bytes  17/09/2007 17:43:56
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Active Processes
Configuration file...............: c:\program files\avira\antivir personaledition classic\process.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: on
Extended process scan............: on
Scan registry....................: off
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: samedi 8 décembre 2007  19:29

The scan of running processes will be started
Scan process 'avscan.exe' - '31' Module(s) have been scanned
Scan process 'avcenter.exe' - '94' Module(s) have been scanned
Scan process 'explorer.exe' - '72' Module(s) have been scanned
Scan process 'svchost.exe' - '56' Module(s) have been scanned
Scan process 'svchost.exe' - '26' Module(s) have been scanned
Scan process 'lsass.exe' - '41' Module(s) have been scanned
Scan process 'services.exe' - '32' Module(s) have been scanned
Scan process 'winlogon.exe' - '54' Module(s) have been scanned
Scan process 'csrss.exe' - '11' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned
10 processes with 419 modules were scanned


End of the scan: samedi 8 décembre 2007  19:30
Used time: 00:10 min

The scan has been done completely.

      0 Scanning directories
    419 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
    419 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes

g!rly · Answer

oui tu n´as pas vraiment scanné la!

tu n´as pas regardé les tutos ou quoid ? et pas suivie ce que je t´avais dis pour la configuration du scanner?

fais un effort apres tout le mal que je me suis donné

@+

sophie · Answer

je suis vraiment désolée j'avais mal configurer.... voici le rapport du scan AntiVir PersonalEdition Classic Report file date: samedi 8 décembre 2007 19:52 Scanning for 835736 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 1) [5.1.2600] Username: Benjamin Computer name: BENJ Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15 ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55 ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 14:27:04 ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 14:27:13 AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 17:43:56 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24 AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00 AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21 Configuration settings for the scan: Jobname..........................: Local Drives Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: G:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: high Start of the scan: samedi 8 décembre 2007 19:53 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 10 processes with 10 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'E:\' [NOTE] No virus was found! Boot sector 'F:\' [NOTE] No virus was found! Boot sector 'A:\' [NOTE] In the drive 'A:\' no data medium is inserted! Starting to scan the registry. The registry was scanned ( '31' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip [DETECTION] Contains suspicious code HEUR/PwdZIP [INFO] The file was moved to '47d4e885.qua'! C:\Documents and Settings\Benjamin\Bureau\Upload_Me.zip [0] Archive type: ZIP --> DOCUME~1/Benjamin/Bureau/Upload_Me/Mrshield.exe [DETECTION] Contains suspicious code HEUR/Crypted [INFO] The file was moved to '47c6e8e4.qua'! C:\qoobox\Quarantine\C\WINDOWS\Mrshield.exe.vir [DETECTION] Contains suspicious code HEUR/Crypted [INFO] The file was moved to '47cdf0e2.qua'! C:\SDFix\backups\backups.zip [0] Archive type: ZIP --> backups/Mrshield.exe [DETECTION] Contains suspicious code HEUR/Crypted [INFO] The file was moved to '47bdf14d.qua'! C:\WINDOWS\system32\bzhprlg.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47c2f3a6.qua'! C:\WINDOWS\system32\exdcvwk.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47bef3c1.qua'! C:\WINDOWS\system32\gcjasz.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47c4f3b0.qua'! C:\WINDOWS\system32\mluqsb.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47cff3d0.qua'! C:\WINDOWS\system32 eckxfoday.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47bdf3d9.qua'! C:\WINDOWS\system32\odgjvnkmeh.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47c1f3e0.qua'! C:\WINDOWS\system32\pqkxecby.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47c5f3f2.qua'! C:\WINDOWS\system32 rz1BC.tmp [DETECTION] Is the Trojan horse TR/Dldr.Agent.bca.9 [INFO] The file was moved to '47d4f405.qua'! C:\WINDOWS\system32\uqovwplt.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47c9f409.qua'! C:\WINDOWS\system32\xvosctihm.exe [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47c9f424.qua'! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'E:\' Begin scan in 'F:\' Begin scan in 'A:\' Search path A:\ could not be opened! Le périphérique n'est pas prêt. Begin scan in 'D:\' Search path D:\ could not be opened! Le périphérique n'est pas prêt. Begin scan in 'G:\' Search path G:\ could not be opened! Le périphérique n'est pas prêt. End of the scan: samedi 8 décembre 2007 21:04 Used time: 1:11:40 min The scan has been done completely. 6570 Scanning directories 160608 Files were scanned 1 viruses and/or unwanted programs were found 13 Files were classified as suspicious: 0 files were deleted 0 files were repaired 14 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 160607 Files not concerned 2752 Archives were scanned 2 Warnings 1 Notes

g!rly · Answer

salut sophie/benjamin

vide la quarantaine d´antivir et refais un combofix et posyt le rapport ici stp

@+

sophie · Answer

Salut g!rly, voilà le rapport ComboFix 07-12-08.1 - Benjamin 2007-12-09 22:01:39.13 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.226 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés 2007-11-09 to 2007-12-09 )))))))))))))))))))))))))))))))))))) . 2007-12-08 19:22 . 2007-12-08 19:22 d-------- C:\Program Files\Avira 2007-12-08 19:06 . 2007-12-08 19:22 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-12-08 18:32 . 2007-12-08 18:32 45,632 --a------ C:\8e9w3l6u1g1.exe 2007-12-08 17:54 . 2007-12-08 17:54 d-------- C:\Program Files\Sunbelt Software 2007-12-08 17:46 . 2007-12-08 17:47 d-------- C:\WINDOWS\Internet Logs 2007-12-08 16:13 . 2007-12-08 16:13 d--h----- C:\Program Files\Fichiers communs\Carlson 2007-12-07 21:18 . 2007-12-07 21:18 d-------- C:\WINDOWS\ERUNT 2007-12-07 21:16 . 2007-12-08 19:51 495 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-09 21:05 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-08 16:56 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-08 16:56 17,920 ----a-w C:\WINDOWS\system32 ftp.exe 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES 2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2007-12-08_17.27.23,90 ))))))))))))))))))))))))))))))))))))))))) . + 2007-12-08 16:54:53 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\ARPPRODUCTICON.exe - 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe + 2007-12-08 16:54:53 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe - 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe + 2007-12-08 16:54:54 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe + 2007-12-09 21:01:20 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat - 2007-12-08 16:07:45 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe + 2007-12-08 16:56:32 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe - 2007-12-08 16:07:45 17,920 -c--a-w C:\WINDOWS\system32\dllcache ftp.exe + 2007-12-08 16:56:32 17,920 -c--a-w C:\WINDOWS\system32\dllcache ftp.exe + 2007-08-09 12:04:11 40,768 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys + 2007-07-18 13:22:19 21,312 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys + 2007-12-08 22:50:42 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys + 2007-04-26 09:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2007-04-26 09:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys + 2007-03-01 09:34:36 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys - 2007-12-08 16:08:28 208,513 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2007-12-09 20:56:04 208,514 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe ----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak ealsched.exe ----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe ----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe ----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe ----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe ----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe ----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe ----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe ----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe ----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-08 23:50] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage rapide du logiciel HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22] Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [1999-08-06 08:53:00] R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" S2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe" S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-12-09 15:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll PROCESS: C:\WINDOWS\explorer.exe [6.00.2800.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll . ************************************************************************** catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-09 22:05:24 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-09 22:07:14 C:\ComboFix2.txt ... 2007-12-08 18:23 C:\ComboFix3.txt ... 2007-12-08 17:28 . --- E O F ---

g!rly · Answer

re,

ca a l´air de c´etre calmé ;-)

supprime ceci :

C:\8e9w3l6u1g1.exe

C:\Program Files\Fichiers communs\Carlson

puis fais ceci :

A.V.G :

-> Télécharger AVG Anti-Spyware (ewido)

   http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware

-> L´installer.

-> lancer AVG Anti-Spyware et clicker sur le bouton Mise à jour. Patienter...
   
   p.s : si les mises a jours ne se font pas, elles sont telechargable ici :

   http://downloads.ewido.net/avgas-signatures-full-current.exe

-> Sur la page "analyse":

   choisir d´abord l'onglet "paramètres".
   
   sous « Comment réagir » clicker sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer ».

-> Lancer le scan, (c´est long...).

-> A la fin du scan copier Et coller le rapport ici. 

-> Une aide en image au cas ou :

   Tutoriel d´installation et de parametrages :

   http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html   

@+

sophie · Answer

voila le rapport par contre je n'ai pas pu supprimer carlton parce que je ne l'ai pas trouvé... 

AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	23:29:29 09/12/2007

 + Résultat de l'analyse:	



HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Aucune action entreprise.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Aucune action entreprise.
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Aucune action entreprise.
HKU\S-1-5-21-1390067357-1606980848-725345543-1003\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Aucune action entreprise.
HKU\.DEFAULT\Software\ToolBar -> Adware.WebSearch : Aucune action entreprise.
HKU\.DEFAULT\Software\ToolBar\all -> Adware.WebSearch : Aucune action entreprise.
HKU\.DEFAULT\Software\ToolBar\all\History -> Adware.WebSearch : Aucune action entreprise.
HKU\S-1-5-18\Software\ToolBar -> Adware.WebSearch : Aucune action entreprise.
HKU\S-1-5-18\Software\ToolBar\all -> Adware.WebSearch : Aucune action entreprise.
HKU\S-1-5-18\Software\ToolBar\all\History -> Adware.WebSearch : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@247realmedia[2].txt -> TrackingCookie.247realmedia : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@2o7[2].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@adbrite[1].txt -> TrackingCookie.Adbrite : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@adtech[1].txt -> TrackingCookie.Adtech : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@advertising[2].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@adviva[2].txt -> TrackingCookie.Adviva : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@bluestreak[1].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@fl01.ct2.comclick[2].txt -> TrackingCookie.Comclick : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@ivwbox[1].txt -> TrackingCookie.Ivwbox : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@auto.search.msn[2].txt -> TrackingCookie.Msn : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@data3.perf.overture[1].txt -> TrackingCookie.Overture : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@overture[1].txt -> TrackingCookie.Overture : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@perf.overture[1].txt -> TrackingCookie.Overture : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@ads.planetactive[2].txt -> TrackingCookie.Planetactive : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@pro-market[2].txt -> TrackingCookie.Pro-market : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@questionmarket[2].txt -> TrackingCookie.Questionmarket : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@revsci[1].txt -> TrackingCookie.Revsci : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@smartadserver[1].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@statcounter[2].txt -> TrackingCookie.Statcounter : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@tacoda[1].txt -> TrackingCookie.Tacoda : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@m.webtrends[2].txt -> TrackingCookie.Webtrends : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
C:\Documents and Settings\Benjamin\Cookies\benjamin@zedo[1].txt -> TrackingCookie.Zedo : Aucune action entreprise.


Fin du rapport

g!rly · Answer

salut sophie/benjamin

Téléchargez ceci (de gchris) : http://komun.chez-alice.fr/Repertoire/Utilitaires.Desinfection.html
Dézippez-le sur votre bureau (clic droit -> extraire tout).
Vérifiez que vous êtes bien connecté à internet.
Dans le dossier créé, double-cliquez sur le fichier "Ad-Fix.bat" ou "Ad-fix"
Choisissez l'option 1.
Si vous avez un message de votre pare-feu qui vous demande si vous voulez autoriser le fichier URL2FILE.EXE à
se connecter à Internet, Autorisez, c'est nécessaire à ad-fix pour vérifier la version.
Quand c'est finit (cela peut prendre plusieurs minutes), un rapport s'ouvre avec le bloc-notes.
Merci de faire un copier/coller ici du contenu du rapport (Ad-Fix.txt)

@+

sophie · Answer

salut g!rly, voici le rapport adfix


         Ad-Fix v0.101e
         by gchris
 
 
OPTION 1 (Scan) :
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                  Démarré à : 

 9:35:12,53 10/12/2007  


                  Executé depuis : 

C:\Documents and Settings\Benjamin\Bureau\Ad-Fix


                  Os : 

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
            Recherche de fichier manquant
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
           Recherche de fichiers cachés (pas forcément mauvais)
 
 
    Fichiers cachés à la racine du disque système :
 
boot.ini
Bootfont.bin
IO.SYS
MSDOS.SYS
NTDETECT.COM
ntldr
pagefile.sys
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
 
    Fichiers cachés dans le répertoire Windows :
 
WindowsShell.Manifest
winnt.bmp
winnt256.bmp
 
    Fichiers cachés dans le répertoire System32 :
 
cdplayer.exe.manifest
E6766994AD.sys
KGyGaAvL.sys
logonui.exe.manifest
mpqss.ini
mpqss.ini2
ncpa.cpl.manifest
nwc.cpl.manifest
sapi.cpl.manifest
WindowsLogon.manifest
wuaucpl.cpl.manifest
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
           Analyse du registre
 

---------- USER AGENT -- POST PLATFORM

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

----------

----------  AppInit_DLLs

g!rly · Answer

re,

passe ces antispywares et supprime tout ce qu´ils trouvent :

http://www.commentcamarche.net/telecharger/telecharger 122 spybot

et

http://www.commentcamarche.net/telecharger/telecharger 83 ad aware 2007 free

et

repost un nouveau hijack this et dis moi ce que les antispywares ont trouvés

@+

sophie · Answer

Salut g!rly,

je suis désolée de ne pas t'avoir répondu plus tôt mais j'ai du m'absenter quelques jours, bref voici le rapport hijack 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:13:18, on 15/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\EPSON\ESM2\eEBSVC.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32	xttjxav.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\mrofinu1000106.exe
C:\Program Files\utorrent\utorrent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
F:\daemon tools\daemon.exe
C:\DOCUME~1\Benjamin\APPLIC~1\RACLE~1\dexplore.exe
C:\Program Files\WinAble\winable.exe
C:\Documents and Settings\Benjamin\Application Data\?racle\?ti2evxx.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
E:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {093F13EC-B472-44C0-ACD7-94CEC61C9AA3} - C:\Program Files\Internet Explorer\menorus4444.dll
O2 - BHO: (no name) - {27037ACB-24EE-46B2-8875-38078C2B8338} - C:\Program Files\Internet Explorer\menorus83122.dll
O2 - BHO: (no name) - {502EECA6-40D9-4F8A-90D9-61343883FE42} - C:\WINDOWS\System32\ssqpm.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: {dbb3ca56-52b0-4ca8-1f34-c55ab8d9e27a} - {a72e9d8b-a55c-43f1-8ac4-0b2565ac3bbd} - C:\WINDOWS\System32\onrygumk.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\augjvpsf.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B5D8DD67-6D88-3A79-8B29-38E6738F5C97} - C:\WINDOWS\System32\ydx.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: 0 - {E04D5A82-8FFA-4BE0-2A94-59F00D78BBDE} - C:\Program Files\WindowsUpdate\quzaletun.dll
O2 - BHO: (no name) - {ED203331-9C33-49D8-8714-D24A366A04EC} - C:\WINDOWS\system32\awtqnkh.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\augjvpsf.dll (file missing)
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [3cd8c406] rundll32.exe "C:\WINDOWS\System32	qijbkqm.dll",b
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\System32\csrs.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent\utorrent.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "F:\daemon tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Aaaa] "C:\DOCUME~1\Benjamin\APPLIC~1\RACLE~1\dexplore.exe" -vt yazb
O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe
O4 - HKCU\..\Run: [Fgrkoel] "C:\Documents and Settings\Benjamin\Application Data\?racle\?ti2evxx.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\nores.mht!http://adxrnet.net/code/chm/xpre.chm::/xpreload.ocx
O20 - Winlogon Notify: augjvpsf - augjvpsf.dll (file missing)
O20 - Winlogon Notify: awtqnkh - C:\WINDOWS\SYSTEM32\awtqnkh.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DomainService -   - C:\WINDOWS\System32	xttjxav.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\EPSON\ESM2\eEBSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Unknown owner - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe (file missing)
O23 - Service: Microsoft register shield - Unknown owner - C:\WINDOWS\Mrshield.exe (file missing)
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe (file missing)
O24 - Desktop Component 0: (no name) - C:\Program Files\WindowsUpdatetejezanem.html

g!rly · Answer

salut sophie

je m excuse aussi pour le delay, je suis en vacances et il m est difficile de me connecter...

tu est encore pas mal infecte .-(

refais combofix et post le resultat ici 

a+

sophie · Answer

salut g!rly, voici le rapport combofix, mon pac rame pas mal.... ComboFix 07-12-20.1 - Benjamin 2007-12-20 9:49:11.14 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.115 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Benjamin\Application Data\RACLE~1 C:\Documents and Settings\Benjamin\Application Data\RACLE~1\?racle\ C:\Documents and Settings\Benjamin\Application Data\RACLE~1\?ti2evxx.exe C:\Documents and Settings\Benjamin\Application Data\RACLE~1\dexplore.exe C:\Documents and Settings\Benjamin\Application Data\WinTouch\wintouch.cfg C:\Documents and Settings\Benjamin\Application Data\WinTouch\WinTouch.exe C:\Documents and Settings\Benjamin\Application Data\WinTouch\WTUninstaller.exe C:\Documents and Settings\Benjamin\Menu Démarrer\Programmes\Outerinfo C:\Documents and Settings\Benjamin\Menu Démarrer\Programmes\Outerinfo\Terms.lnk C:\Documents and Settings\Benjamin\Menu Démarrer\Programmes\Outerinfo\Uninstall.lnk C:\Program Files\Internet Explorer\menorus4444.dll C:\Program Files\Internet Explorer\menorus83122.dll C:\Program Files\outerinfo C:\Program Files\outerinfo\FF\chrome.manifest C:\Program Files\outerinfo\FF\components\FF.dll C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt C:\Program Files\outerinfo\FF\install.rdf C:\Program Files\outerinfo\Terms.rtf C:\Program Files\WindowsUpdate\quzaletun.dll C:\Program Files\WindowsUpdate\quzaletun589.dll C:\Program Files\WindowsUpdate\quzaletun741.dll C:\Program Files\WindowsUpdate\quzaletun746.dll C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files.\xpreload.ocx C:\WINDOWS\svchost.exe C:\WINDOWS\system32\8_exception.nls C:\WINDOWS\system32\alniwfpl.ini C:\WINDOWS\system32\ambishjy.dll C:\WINDOWS\system32\awtqnkh.dll C:\WINDOWS\system32\awtqqol.dll C:\WINDOWS\system32\awtqqqo.dll C:\WINDOWS\system32\byxvuuu.dll C:\WINDOWS\system32\byxwtqn.dll C:\WINDOWS\system32\cbxuvtq.dll C:\WINDOWS\system32\cdkhnsoy.dll C:\WINDOWS\system32\csrs.exe C:\WINDOWS\system32\eqsjwdsk.dll C:\WINDOWS\system32\fccdecd.dll C:\WINDOWS\system32\gayuibdt.dll C:\WINDOWS\system32\hggffeb.dll C:\WINDOWS\system32\hmlyocym.dll C:\WINDOWS\system32\iexplore.exe C:\WINDOWS\system32\jkkllmj.dll C:\WINDOWS\system32\krngnaue.exe C:\WINDOWS\system32\ljjghfe.dll C:\WINDOWS\system32\ljjhhgh.dll C:\WINDOWS\system32\losfgadc.exe C:\WINDOWS\system32\lpfwinla.dll C:\WINDOWS\system32\mpqss.ini C:\WINDOWS\system32\mpqss.ini2 C:\WINDOWS\system32 nnmmjk.dll C:\WINDOWS\system32 temkwrf.dll C:\WINDOWS\system32\onrygumk.dll C:\WINDOWS\system32\opnkheb.dll C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\pevfbaip.ini C:\WINDOWS\system32\pgsfhyop.exe C:\WINDOWS\system32\piabfvep.dll C:\WINDOWS\system32\qomjkjg.dll C:\WINDOWS\system32 qrqpnk.dll C:\WINDOWS\system32 qrrrpo.dll C:\WINDOWS\System32\ssqpm.dll C:\WINDOWS\system32 uvsqrr.dll C:\WINDOWS\system32\uibkebkq.dll C:\WINDOWS\system32\urqnlii.dll C:\WINDOWS\system32\urqnlmk.dll C:\WINDOWS\system32\vtstssr.dll C:\WINDOWS\system32\vtubwjoc.dll C:\WINDOWS\system32\vturrqn.dll C:\WINDOWS\system32\vtuvuuu.dll C:\WINDOWS\system32\wcpsvcc.exe C:\WINDOWS\system32\xwpadxbd.dll C:\WINDOWS\system32\xxyvvut.dll C:\WINDOWS\system32\yayawvu.dll C:\WINDOWS\system32\yayywxw.dll C:\WINDOWS\system32\ydx.dll C:\WINDOWS\system32\yjhsibma.ini C:\WINDOWS\TEMP\125109.exe C:\WINDOWS\TEMP\125296.exe C:\WINDOWS\TEMP\125312.exe C:\WINDOWS k58.exe C:\WINDOWS\TTC-4444.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\LEGACY_DOMAINSERVICE -------\LEGACY_NETWORK_MONITOR -------\LEGACY_RUNTIME -------\DomainService ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-20 to 2007-12-20 )))))))))))))))))))))))))))))))))))) . 2007-12-20 09:34 . 2007-12-20 09:34 32,456 --a------ C:\WINDOWS\system32\sqmvapp.exe 2007-12-20 09:34 . 2007-12-20 09:34 32,456 --a------ C:\WINDOWS\system32\cbyjlbl.exe 2007-12-20 01:08 . 2007-12-20 01:08 32,456 --a------ C:\WINDOWS\system32 xdosv.exe 2007-12-20 01:07 . 2007-12-20 01:07 32,456 --a------ C:\WINDOWS\system32\ggohnxzg.exe 2007-12-19 17:45 . 2007-12-19 17:45 32,456 --a------ C:\WINDOWS\system32\beon.exe 2007-12-19 17:44 . 2007-12-19 17:44 32,456 --a------ C:\WINDOWS\system32\ojnuiof.exe 2007-12-19 16:49 . 2007-12-19 16:49 32,456 --a------ C:\WINDOWS\system32\mglhxmyr.exe 2007-12-19 16:48 . 2007-12-19 16:48 32,456 --a------ C:\WINDOWS\system32\ptzoiy.exe 2007-12-19 16:44 . 2007-12-19 16:44 32,456 --a------ C:\WINDOWS\system32\ypyi.exe 2007-12-19 16:44 . 2007-12-19 16:44 32,456 --a------ C:\WINDOWS\system32\opvpobwe.exe 2007-12-19 16:42 . 2007-12-19 16:42 0 --ah----- C:\WINDOWS\system32\giznwa.exe 2007-12-19 15:08 . 2007-12-19 15:08 32,456 --a------ C:\WINDOWS\system32\aymdg.exe 2007-12-19 15:07 . 2007-12-19 15:07 76,540 --a------ C:\WINDOWS\system32\xbpe.exe 2007-12-19 15:07 . 2007-12-19 15:07 32,456 --a------ C:\WINDOWS\system32 cmauz.exe 2007-12-19 15:07 . 2007-12-19 15:07 32,456 --a------ C:\WINDOWS\system32\fkwf.exe 2007-12-19 15:07 . 2007-12-19 15:07 9,296 --a------ C:\i2n4r9g1l2.exe 2007-12-19 15:07 . 2007-12-19 15:07 114 --a------ C:\WINDOWS\system32\wheb.bat 2007-12-19 09:56 . 2007-12-20 10:02 21,760 --a------ C:\WINDOWS\Qvb40.sys 2007-12-19 09:42 . 2007-12-19 09:42 32,456 --a------ C:\WINDOWS\system32\vanmzja.exe 2007-12-19 09:28 . 2007-12-19 09:28 32,456 --a------ C:\WINDOWS\system32\miear.exe 2007-12-19 09:28 . 2007-12-19 09:28 32,456 --a------ C:\WINDOWS\system32\heppjcbe.exe 2007-12-19 09:26 . 2007-12-19 09:26 32,456 --a------ C:\WINDOWS\system32\wtheivsm.exe 2007-12-19 00:30 . 2007-12-19 00:30 32,456 --a------ C:\WINDOWS\system32\lgzrs.exe 2007-12-19 00:30 . 2007-12-19 00:30 32,456 --a------ C:\WINDOWS\system32\fwjqa.exe 2007-12-19 00:25 . 2007-12-19 00:25 32,456 --a------ C:\WINDOWS\system32\lluxki.exe 2007-12-19 00:25 . 2007-12-19 00:25 32,456 --a------ C:\WINDOWS\system32\gxoumd.exe 2007-12-19 00:22 . 2007-12-19 16:48 548,510 --a------ C:\WINDOWS\Britney_Spears_jpg.zip 2007-12-19 00:22 . 2007-12-19 16:51 40,960 --a------ C:\6i2n4r9g1l2.exe 2007-12-19 00:19 . 2007-12-19 00:19 32,456 --a------ C:\WINDOWS\system32\auzrfnm.exe 2007-12-19 00:14 . 2007-12-19 00:14 1,460 --ah----- C:\WINDOWS\system32\jrahnth.exe 2007-12-17 11:41 . 2007-12-17 13:23 0 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-12-17 11:40 . 2007-12-19 00:24 21,760 --a------ C:\WINDOWS\system32\drivers\Qvb40.sys 2007-12-15 15:48 . 2007-12-15 17:10 d--hs---- C:\WINDOWS\QmVuamk 2007-12-15 15:47 . 2007-12-15 15:47 d-------- C:\WINDOWS\system32 ey2 2007-12-15 15:47 . 2007-12-17 14:16 d-------- C:\WINDOWS\system32 ef1 2007-12-15 15:47 . 2007-12-15 15:47 d-------- C:\WINDOWS\system32\ineWc01 2007-12-15 15:47 . 2007-12-15 15:48 d-------- C:\Temp pBe12 2007-12-15 15:47 . 2007-12-20 10:00 d-------- C:\Temp 2007-12-15 10:38 . 2007-12-17 13:22 952,752 ---hs---- C:\WINDOWS\system32\mqkbjiqt.ini 2007-12-14 14:18 . 2007-12-15 09:22 941,585 ---hs---- C:\WINDOWS\system32\aculifcu.ini 2007-12-13 11:46 . 2007-12-13 11:46 929,496 ---hs---- C:\WINDOWS\system32\shfimyre.ini 2007-12-12 11:56 . 2007-12-12 11:56 66,055 --ah----- C:\WINDOWS\system32\swbz.exe 2007-12-12 11:45 . 2007-12-13 08:37 913,965 ---hs---- C:\WINDOWS\system32\gewofray.ini 2007-12-12 01:59 . 2007-12-12 01:59 127 --a------ C:\WINDOWS\system32\ftyig.bat 2007-12-11 21:36 . 2007-12-12 01:59 913,442 ---hs---- C:\WINDOWS\system32\glncpxjj.ini 2007-12-11 17:35 . 2007-12-11 17:35 d-------- C:\Program Files\Lavasoft 2007-12-11 17:35 . 2007-12-11 17:35 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-12-11 17:34 . 2007-12-11 17:34 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-12-11 11:01 . 2007-12-11 11:01 148 --a------ C:\WINDOWS\wininit.ini 2007-12-10 19:32 . 2007-12-11 21:33 897,204 ---hs---- C:\WINDOWS\system32 akguggi.ini 2007-12-10 10:11 . 2007-12-10 10:11 66,055 --ah----- C:\WINDOWS\system32\jpxbfwr.exe 2007-12-10 09:35 . 2007-02-09 10:26 184,320 --a------ C:\WINDOWS\system32\delnext.exe 2007-12-10 09:35 . 2005-03-11 04:29 82,188 --a------ C:\WINDOWS\system32\zip.exe 2007-12-09 23:01 . 2007-12-09 23:01 d-------- C:\Documents and Settings\Benjamin\Application Data\Grisoft 2007-12-09 23:00 . 2007-12-09 23:00 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-08 19:22 . 2007-12-08 19:22 d-------- C:\Program Files\Avira 2007-12-08 19:06 . 2007-12-08 19:22 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-12-08 17:54 . 2007-12-08 17:54 d-------- C:\Program Files\Sunbelt Software 2007-12-08 17:46 . 2007-12-08 17:47 d-------- C:\WINDOWS\Internet Logs 2007-12-08 16:13 . 2007-12-19 00:22 d--h----- C:\Program Files\Fichiers communs\Carlson 2007-12-07 21:18 . 2007-12-07 21:18 d-------- C:\WINDOWS\ERUNT 2007-12-07 21:16 . 2007-12-20 09:55 12,798 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-20 09:04 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-19 15:48 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-19 15:48 17,920 ----a-w C:\WINDOWS\system32 ftp.exe 2007-12-17 12:22 --------- d-----w C:\Program Files\uTorrent 2007-12-12 16:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-12 16:08 --------- d-----w C:\Program Files\EA GAMES 2007-12-12 16:05 --------- d-----w C:\Program Files\GameSpy Arcade 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-07-29 15:24 472 --sha-r C:\WINDOWS\QmVuamk\kApRuA4.vbs 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] "Fgrkoel"="C:\Documents and Settings\Benjamin\Application Data\?racle\?ti2evxx.exe" [] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18] "Aaaa"="C:\DOCUME~1\Benjamin\APPLIC~1\RACLE~1\dexplore.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-08 23:50] "Application Layer Gateway Service"="C:\WINDOWS\System32\algs.exe" [] "Client Server Runtime Process"="C:\WINDOWS\System32\csrs.exe" [] "Windows Network Firewall"="C:\WINDOWS\System32\firewall.exe" [] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [2002-08-29 12:45] "Advanced DHTML Enable"="C:\WINDOWS\System32\sqmvapp.exe" [2007-12-20 09:34] "svchost.exe"="C:\WINDOWS\svchost.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] R0 Qvb40;Qvb40;C:\WINDOWS\System32\Drivers\Qvb40.sys [2007-12-19 00:24] R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04] R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys [2007-04-26 10:21] R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" [2006-06-30 00:54] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe [2001-08-28 15:00] R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] S2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe" [] S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys [2004-02-06 05:44] S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys [2006-06-30 00:42] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-19 15:00:05 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-20 10:04:13 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll . Completion time: 2007-12-20 10:05:51 - machine was rebooted C:\ComboFix2.txt ... 2007-12-09 22:07 C:\ComboFix3.txt ... 2007-12-08 18:23

sophie · Answer

salut g!rly, voici le rapport combofix, mon pac rame pas mal.... ComboFix 07-12-20.1 - Benjamin 2007-12-20 9:49:11.14 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.115 [GMT 1:00] Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Benjamin\Application Data\RACLE~1 C:\Documents and Settings\Benjamin\Application Data\RACLE~1\?racle\ C:\Documents and Settings\Benjamin\Application Data\RACLE~1\?ti2evxx.exe C:\Documents and Settings\Benjamin\Application Data\RACLE~1\dexplore.exe C:\Documents and Settings\Benjamin\Application Data\WinTouch\wintouch.cfg C:\Documents and Settings\Benjamin\Application Data\WinTouch\WinTouch.exe C:\Documents and Settings\Benjamin\Application Data\WinTouch\WTUninstaller.exe C:\Documents and Settings\Benjamin\Menu Démarrer\Programmes\Outerinfo C:\Documents and Settings\Benjamin\Menu Démarrer\Programmes\Outerinfo\Terms.lnk C:\Documents and Settings\Benjamin\Menu Démarrer\Programmes\Outerinfo\Uninstall.lnk C:\Program Files\Internet Explorer\menorus4444.dll C:\Program Files\Internet Explorer\menorus83122.dll C:\Program Files\outerinfo C:\Program Files\outerinfo\FF\chrome.manifest C:\Program Files\outerinfo\FF\components\FF.dll C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt C:\Program Files\outerinfo\FF\install.rdf C:\Program Files\outerinfo\Terms.rtf C:\Program Files\WindowsUpdate\quzaletun.dll C:\Program Files\WindowsUpdate\quzaletun589.dll C:\Program Files\WindowsUpdate\quzaletun741.dll C:\Program Files\WindowsUpdate\quzaletun746.dll C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files.\xpreload.ocx C:\WINDOWS\svchost.exe C:\WINDOWS\system32\8_exception.nls C:\WINDOWS\system32\alniwfpl.ini C:\WINDOWS\system32\ambishjy.dll C:\WINDOWS\system32\awtqnkh.dll C:\WINDOWS\system32\awtqqol.dll C:\WINDOWS\system32\awtqqqo.dll C:\WINDOWS\system32\byxvuuu.dll C:\WINDOWS\system32\byxwtqn.dll C:\WINDOWS\system32\cbxuvtq.dll C:\WINDOWS\system32\cdkhnsoy.dll C:\WINDOWS\system32\csrs.exe C:\WINDOWS\system32\eqsjwdsk.dll C:\WINDOWS\system32\fccdecd.dll C:\WINDOWS\system32\gayuibdt.dll C:\WINDOWS\system32\hggffeb.dll C:\WINDOWS\system32\hmlyocym.dll C:\WINDOWS\system32\iexplore.exe C:\WINDOWS\system32\jkkllmj.dll C:\WINDOWS\system32\krngnaue.exe C:\WINDOWS\system32\ljjghfe.dll C:\WINDOWS\system32\ljjhhgh.dll C:\WINDOWS\system32\losfgadc.exe C:\WINDOWS\system32\lpfwinla.dll C:\WINDOWS\system32\mpqss.ini C:\WINDOWS\system32\mpqss.ini2 C:\WINDOWS\system32 nnmmjk.dll C:\WINDOWS\system32 temkwrf.dll C:\WINDOWS\system32\onrygumk.dll C:\WINDOWS\system32\opnkheb.dll C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\pevfbaip.ini C:\WINDOWS\system32\pgsfhyop.exe C:\WINDOWS\system32\piabfvep.dll C:\WINDOWS\system32\qomjkjg.dll C:\WINDOWS\system32 qrqpnk.dll C:\WINDOWS\system32 qrrrpo.dll C:\WINDOWS\System32\ssqpm.dll C:\WINDOWS\system32 uvsqrr.dll C:\WINDOWS\system32\uibkebkq.dll C:\WINDOWS\system32\urqnlii.dll C:\WINDOWS\system32\urqnlmk.dll C:\WINDOWS\system32\vtstssr.dll C:\WINDOWS\system32\vtubwjoc.dll C:\WINDOWS\system32\vturrqn.dll C:\WINDOWS\system32\vtuvuuu.dll C:\WINDOWS\system32\wcpsvcc.exe C:\WINDOWS\system32\xwpadxbd.dll C:\WINDOWS\system32\xxyvvut.dll C:\WINDOWS\system32\yayawvu.dll C:\WINDOWS\system32\yayywxw.dll C:\WINDOWS\system32\ydx.dll C:\WINDOWS\system32\yjhsibma.ini C:\WINDOWS\TEMP\125109.exe C:\WINDOWS\TEMP\125296.exe C:\WINDOWS\TEMP\125312.exe C:\WINDOWS k58.exe C:\WINDOWS\TTC-4444.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\LEGACY_DOMAINSERVICE -------\LEGACY_NETWORK_MONITOR -------\LEGACY_RUNTIME -------\DomainService ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-20 to 2007-12-20 )))))))))))))))))))))))))))))))))))) . 2007-12-20 09:34 . 2007-12-20 09:34 32,456 --a------ C:\WINDOWS\system32\sqmvapp.exe 2007-12-20 09:34 . 2007-12-20 09:34 32,456 --a------ C:\WINDOWS\system32\cbyjlbl.exe 2007-12-20 01:08 . 2007-12-20 01:08 32,456 --a------ C:\WINDOWS\system32 xdosv.exe 2007-12-20 01:07 . 2007-12-20 01:07 32,456 --a------ C:\WINDOWS\system32\ggohnxzg.exe 2007-12-19 17:45 . 2007-12-19 17:45 32,456 --a------ C:\WINDOWS\system32\beon.exe 2007-12-19 17:44 . 2007-12-19 17:44 32,456 --a------ C:\WINDOWS\system32\ojnuiof.exe 2007-12-19 16:49 . 2007-12-19 16:49 32,456 --a------ C:\WINDOWS\system32\mglhxmyr.exe 2007-12-19 16:48 . 2007-12-19 16:48 32,456 --a------ C:\WINDOWS\system32\ptzoiy.exe 2007-12-19 16:44 . 2007-12-19 16:44 32,456 --a------ C:\WINDOWS\system32\ypyi.exe 2007-12-19 16:44 . 2007-12-19 16:44 32,456 --a------ C:\WINDOWS\system32\opvpobwe.exe 2007-12-19 16:42 . 2007-12-19 16:42 0 --ah----- C:\WINDOWS\system32\giznwa.exe 2007-12-19 15:08 . 2007-12-19 15:08 32,456 --a------ C:\WINDOWS\system32\aymdg.exe 2007-12-19 15:07 . 2007-12-19 15:07 76,540 --a------ C:\WINDOWS\system32\xbpe.exe 2007-12-19 15:07 . 2007-12-19 15:07 32,456 --a------ C:\WINDOWS\system32 cmauz.exe 2007-12-19 15:07 . 2007-12-19 15:07 32,456 --a------ C:\WINDOWS\system32\fkwf.exe 2007-12-19 15:07 . 2007-12-19 15:07 9,296 --a------ C:\i2n4r9g1l2.exe 2007-12-19 15:07 . 2007-12-19 15:07 114 --a------ C:\WINDOWS\system32\wheb.bat 2007-12-19 09:56 . 2007-12-20 10:02 21,760 --a------ C:\WINDOWS\Qvb40.sys 2007-12-19 09:42 . 2007-12-19 09:42 32,456 --a------ C:\WINDOWS\system32\vanmzja.exe 2007-12-19 09:28 . 2007-12-19 09:28 32,456 --a------ C:\WINDOWS\system32\miear.exe 2007-12-19 09:28 . 2007-12-19 09:28 32,456 --a------ C:\WINDOWS\system32\heppjcbe.exe 2007-12-19 09:26 . 2007-12-19 09:26 32,456 --a------ C:\WINDOWS\system32\wtheivsm.exe 2007-12-19 00:30 . 2007-12-19 00:30 32,456 --a------ C:\WINDOWS\system32\lgzrs.exe 2007-12-19 00:30 . 2007-12-19 00:30 32,456 --a------ C:\WINDOWS\system32\fwjqa.exe 2007-12-19 00:25 . 2007-12-19 00:25 32,456 --a------ C:\WINDOWS\system32\lluxki.exe 2007-12-19 00:25 . 2007-12-19 00:25 32,456 --a------ C:\WINDOWS\system32\gxoumd.exe 2007-12-19 00:22 . 2007-12-19 16:48 548,510 --a------ C:\WINDOWS\Britney_Spears_jpg.zip 2007-12-19 00:22 . 2007-12-19 16:51 40,960 --a------ C:\6i2n4r9g1l2.exe 2007-12-19 00:19 . 2007-12-19 00:19 32,456 --a------ C:\WINDOWS\system32\auzrfnm.exe 2007-12-19 00:14 . 2007-12-19 00:14 1,460 --ah----- C:\WINDOWS\system32\jrahnth.exe 2007-12-17 11:41 . 2007-12-17 13:23 0 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-12-17 11:40 . 2007-12-19 00:24 21,760 --a------ C:\WINDOWS\system32\drivers\Qvb40.sys 2007-12-15 15:48 . 2007-12-15 17:10 d--hs---- C:\WINDOWS\QmVuamk 2007-12-15 15:47 . 2007-12-15 15:47 d-------- C:\WINDOWS\system32 ey2 2007-12-15 15:47 . 2007-12-17 14:16 d-------- C:\WINDOWS\system32 ef1 2007-12-15 15:47 . 2007-12-15 15:47 d-------- C:\WINDOWS\system32\ineWc01 2007-12-15 15:47 . 2007-12-15 15:48 d-------- C:\Temp pBe12 2007-12-15 15:47 . 2007-12-20 10:00 d-------- C:\Temp 2007-12-15 10:38 . 2007-12-17 13:22 952,752 ---hs---- C:\WINDOWS\system32\mqkbjiqt.ini 2007-12-14 14:18 . 2007-12-15 09:22 941,585 ---hs---- C:\WINDOWS\system32\aculifcu.ini 2007-12-13 11:46 . 2007-12-13 11:46 929,496 ---hs---- C:\WINDOWS\system32\shfimyre.ini 2007-12-12 11:56 . 2007-12-12 11:56 66,055 --ah----- C:\WINDOWS\system32\swbz.exe 2007-12-12 11:45 . 2007-12-13 08:37 913,965 ---hs---- C:\WINDOWS\system32\gewofray.ini 2007-12-12 01:59 . 2007-12-12 01:59 127 --a------ C:\WINDOWS\system32\ftyig.bat 2007-12-11 21:36 . 2007-12-12 01:59 913,442 ---hs---- C:\WINDOWS\system32\glncpxjj.ini 2007-12-11 17:35 . 2007-12-11 17:35 d-------- C:\Program Files\Lavasoft 2007-12-11 17:35 . 2007-12-11 17:35 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-12-11 17:34 . 2007-12-11 17:34 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-12-11 11:01 . 2007-12-11 11:01 148 --a------ C:\WINDOWS\wininit.ini 2007-12-10 19:32 . 2007-12-11 21:33 897,204 ---hs---- C:\WINDOWS\system32 akguggi.ini 2007-12-10 10:11 . 2007-12-10 10:11 66,055 --ah----- C:\WINDOWS\system32\jpxbfwr.exe 2007-12-10 09:35 . 2007-02-09 10:26 184,320 --a------ C:\WINDOWS\system32\delnext.exe 2007-12-10 09:35 . 2005-03-11 04:29 82,188 --a------ C:\WINDOWS\system32\zip.exe 2007-12-09 23:01 . 2007-12-09 23:01 d-------- C:\Documents and Settings\Benjamin\Application Data\Grisoft 2007-12-09 23:00 . 2007-12-09 23:00 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-08 19:22 . 2007-12-08 19:22 d-------- C:\Program Files\Avira 2007-12-08 19:06 . 2007-12-08 19:22 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-12-08 17:54 . 2007-12-08 17:54 d-------- C:\Program Files\Sunbelt Software 2007-12-08 17:46 . 2007-12-08 17:47 d-------- C:\WINDOWS\Internet Logs 2007-12-08 16:13 . 2007-12-19 00:22 d--h----- C:\Program Files\Fichiers communs\Carlson 2007-12-07 21:18 . 2007-12-07 21:18 d-------- C:\WINDOWS\ERUNT 2007-12-07 21:16 . 2007-12-20 09:55 12,798 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-12-06 16:51 . 2007-12-06 16:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe 2007-12-05 18:32 . 2007-12-05 18:32 d-------- C:\WINDOWS\system32\daSgo01 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-20 09:04 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent 2007-12-19 15:48 44,032 ----a-w C:\WINDOWS\system32\ftp.exe 2007-12-19 15:48 17,920 ----a-w C:\WINDOWS\system32 ftp.exe 2007-12-17 12:22 --------- d-----w C:\Program Files\uTorrent 2007-12-12 16:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-12 16:08 --------- d-----w C:\Program Files\EA GAMES 2007-12-12 16:05 --------- d-----w C:\Program Files\GameSpy Arcade 2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems 2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems 2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink 2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro 2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT 2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe 2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe 2005-07-29 15:24 472 --sha-r C:\WINDOWS\QmVuamk\kApRuA4.vbs 2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys 2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] "µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47] "DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16] "Fgrkoel"="C:\Documents and Settings\Benjamin\Application Data\?racle\?ti2evxx.exe" [] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18] "Aaaa"="C:\DOCUME~1\Benjamin\APPLIC~1\RACLE~1\dexplore.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE] "Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-08 23:50] "Application Layer Gateway Service"="C:\WINDOWS\System32\algs.exe" [] "Client Server Runtime Process"="C:\WINDOWS\System32\csrs.exe" [] "Windows Network Firewall"="C:\WINDOWS\System32\firewall.exe" [] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [2002-08-29 12:45] "Advanced DHTML Enable"="C:\WINDOWS\System32\sqmvapp.exe" [2007-12-20 09:34] "svchost.exe"="C:\WINDOWS\svchost.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45] R0 Qvb40;Qvb40;C:\WINDOWS\System32\Drivers\Qvb40.sys [2007-12-19 00:24] R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04] R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys [2007-04-26 10:21] R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe" [2006-06-30 00:54] R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe [2001-08-28 15:00] R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] S2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe" [] S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys [2004-02-06 05:44] S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys [2006-06-30 00:42] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-19 15:00:05 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job" - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-20 10:04:13 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll . Completion time: 2007-12-20 10:05:51 - machine was rebooted C:\ComboFix2.txt ... 2007-12-09 22:07 C:\ComboFix3.txt ... 2007-12-08 18:23

g!rly · Answer

bonsoir sophie,

je te souhaite tout d´abord une bonne année 2008 ;-)

je viens tout juste de rentré de vacances...

ton pc ne semble pas tenir la grande forme ;-(

peux tu poster un nouveau hijack this ansi qu´un nouveau combofix stp

@+

sophie · Answer

Salut g!rly,

Trés bonne année à toi aussi!
En fait j'ai fini par formater mon pc qui ni ne répondait plus de rien! Maintenant tout va bien alors je te remercie beaucoup pour ton aide et j'espère ne plus en avoir besoin maintenant!

g!rly · Answer

re,

merci,

de rien,

on touche du bois ;-)

bye`

cob4ever · Answer

Scan saved at 18:59:29, on 10/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\lxdicoms.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe
C:\Program Files\Power Manager\PM.exe
C:\Program Files\Hotkey Management\FuncKey.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe
C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\iobmmqgbc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\Christophe Midot\Mes documents\cob4ever\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [fscp] C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe
O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
O4 - HKLM\..\Run: [FuncKey] "C:\Program Files\Hotkey Management\FuncKey.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [Windows Updater Servc] C:\WINDOWS\system32\xpuupdate.exe
O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe"
O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [DNSE] "C:\Program Files\Fichiers communs\SystemDoctor\DNSE.exe" -c
O4 - HKLM\..\Run: [DC6V_Check] "C:\Program Files\Fichiers communs\SystemDoctor\usdrdc.exe"
O4 - HKLM\..\Run: [WellPhone DirectSync - ScheduleSync] C:\PROGRA~1\WELLPH~1\SCHEDU~1.EXE
O4 - HKLM\..\Run: [postSetupCheck] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrt.dll" DllStart
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [iobmmqgbc] C:\WINDOWS\system32\iobmmqgbc.exe
O4 - HKLM\..\RunServices: [iobmmqgbc] C:\WINDOWS\system32\iobmmqgbc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWSeminder\fsc-reminder.exe 2454093 10
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {76EE578D-314B-4755-8365-6E1722C001A2} (Bahu Photo Uploader) - https://bahu.com/BahuPhotoUploader.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://cab.contraviruspro.com/install1.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: FspadSvc - Unknown owner - C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxdi_device -   - C:\WINDOWS\system32\lxdicoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Print Spooler Service (qwgy2uoieyfug) - Unknown owner - C:\WINDOWS\system32\iobmmqgbc.exe

cob4ever · Answer

C:\Documents and Settings\Christophe Midot\Mes documents\cob4ever\MSNFix 
Fix exécuté le 10/03/2008 - 19:36:52,53 By Christophe Midot 
mode normal    
    
************************ Recherche les fichiers présents      
    
Aucun Fichier trouvé 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
 
 
 
************************ Nettoyage du registre 
 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 10032008_19373298.zip
 


------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

g!rly · Answer

http://www.technicland.com/malpolitus.swf

g!rly · Answer

j´arrives pas a dormir ;-(

g!rly · Answer

on a regardé que des photos, tu parles d´une soirée LOL

Flore · Answer

msn fix n'a pas marché pour moi, c'est de l'arnaque...=(

g!rly · Answer

Bonjour,

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

msnfix est loin d´etre une arnaque!

Utilisateur anonyme · Answer

!!!!!!!! tout à fait^^

g!rly · Answer

T´es d´accord, a la bonne heure ! LOL

g!rly · Answer

hi hi

Virus party : rapport MSNfix

58 réponses

Discussions similaires

Newsletters