Posez votre question Signaler

Des Virus partout help!

Angel83 - Dernière réponse le 5 juin 2008 à 12:16
Bonjour,
j'ai des virus qui traine, avec des pseudos antivirus qui se sont installes tous seuls, ma connection a internet est limite et des pages apparaissent tous le tps, j ai bien essaye avec agv ms il n a pas resolu tous les pb.
voici le hitrackthis de mon ordi
Merci pour votre aide!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:03 AM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\spools.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: <html>
O1 - Hosts: <frameset rows="60%,40%">
O1 - Hosts: <frame src="http://www.crous-poitiers.fr/portail.html" name="up" marginwidth="0" marginheight="0" scrolling="auto" border="0" frameborder="0">
O1 - Hosts: <frame src="frame_login.cgi" name="down" noresize marginwidth="0" marginheight="0" scrolling="auto" border="0" frameborder="0">
O1 - Hosts: </frameset>
O1 - Hosts: </html>
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll
O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O21 - SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC} - C:\WINDOWS\vltdfabw.dll
O21 - SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22} - C:\WINDOWS\vregfwlx.dll
O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
Lire la suite 

Des Virus partout help »

Suggestions
Plus
57 réponses
Réponse
+0
moins plus
momonj 981Messages postés 1 février 2008Date d'inscription 25 septembre 2010Dernière intervention 31 mai 2008 à 21:17
en effet tu a des choses bizards,mais je ne m'y connais pas assez pour te conseiller

 Ajouter un commentaire
Ajouter un commentaire
Réponse
+1
moins plus
Chiquitine29 31 mai 2008 à 21:20
houla la !!!!



c est le souk !!


instal d urgence un antivirus

telecharge et instal ANTIVIR :

http://www.01net.com/...


ensuite :


Imprime ces instructions car il va y avoir un redémarrage de l'ordinateur.

* Télécharge FixWareout de ce site sur le bureau:
http://downloads.subratam.org/Fixwareout.exe
hxxp://swandog46.geekstogo.com/Fixwareout.exe

* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

*Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt) avec un nouveau rapport HijackThis! dans ta prochaine réponse.

Supprime aussi tous les fichiers crackés et les keygens. Ce sont des nids potentiels ou réels d'infections.

L'important à suivre, c'est cette ligne :

O1 - Hosts: localhost 127.0.0.1

Si elle est encore dans le prochain rapport hijackthis, tu feras ça :


Télécharge cet outil de SiRi:

http://siri.urz.free.fr/RHosts.php

Double cliquer dessus pour l'exécuter

et cliquer sur " Restore original Hosts "

ensuite refais un scan hijackthis et poste l erapport stp

Ajouter un commentaire
Angel83 - 31 mai 2008 à 21:42
Merci pour ton aide,

j ai essaye d installer antivir mais pendant l installation j ai le msg: the file could not be copied error code 2,


Que faire?
Ajouter un commentaire
Réponse
+0
moins plus
jfkpresident 13362Messages postés 3 septembre 2007Date d'inscription 30 mai 2012Dernière intervention 31 mai 2008 à 21:23
salut !

Beaucoup d'infections sur ton log hijack !!

On va commencer par celle ci :

# Téléchargez FixWareout LonnyRJones à partir l'une de ces adresses :

* http://downloads.subratam.org/Fixwareout.exe
* http://swandog46.geekstogo.com/Fixwareout.exe

# Lancez le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
# Il vous sera demandé de redémarrer votre ordinateur, redémarrez-le.
# Votre système mettra un peu plus de temps au démarrage, c'est normal.

ensuite :

-> Relance HijackThis cliques sur « scanner seulement » ou (« do a scan only »),
coche les cases devant ces lignes :

O17 - HKLM\System\CCS\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40

et ensuite ferme toutes les fenêtres actives autres que HijackThis!, navigateur inclus,
puis clique "Fix checked"( ou « fixer objet »). Ferme HijackThis!

reposte moi un nouveau hijack.

Ajouter un commentaire - Site web
Ajouter un commentaire
Réponse
+0
moins plus
jfkpresident 13362Messages postés 3 septembre 2007Date d'inscription 30 mai 2012Dernière intervention 31 mai 2008 à 21:25
salut chiquitine ,nos messages se sont croisé !

tu as qu'a continuer ,je reste pour suivre ...

@++ bonne continuation a vous deux .

Ajouter un commentaire - Site web
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 31 mai 2008 à 21:27
oui reste please lol

Ajouter un commentaire
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 31 mai 2008 à 21:44
ok j en avait peur en effet


fait ça :


Imprime ces instructions car il va y avoir un redémarrage de l'ordinateur.

* Télécharge FixWareout de ce site sur le bureau:
http://downloads.subratam.org/Fixwareout.exe
hxxp://swandog46.geekstogo.com/Fixwareout.exe

* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.

*Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt) avec un nouveau rapport HijackThis! dans ta prochaine réponse.



ensuite :


Télécharge cet outil de SiRi:

http://siri.urz.free.fr/RHosts.php

Double cliquer dessus pour l'exécuter

et cliquer sur " Restore original Hosts "


ensuite refais un scan hijackthis et poste le rapport stp

Ajouter un commentaire
Angel83 - 31 mai 2008 à 22:23
me revoila!

rapport fix

Username "Administrator" - 06/01/2008 4:46:09 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdrhk.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.113.75 85.255.112.40" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{124642DA-A703-4BB6-BF6E-ECD92D71C032}
"nameserver"="85.255.113.75,85.255.112.40" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}
"nameserver"="85.255.113.75,85.255.112.40" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{B64D7F17-9FB9-4695-8A6C-729BEA115344}
"nameserver"="85.255.113.75,85.255.112.40" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F2779F00-B031-49BD-9BB0-21565CFF5650}
"nameserver"="85.255.113.75,85.255.112.40" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{124642DA-A703-4BB6-BF6E-ECD92D71C032}
"DhcpNameServer"="85.255.113.75,85.255.112.40" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}
"DhcpNameServer"="85.255.113.75,85.255.112.40" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F2779F00-B031-49BD-9BB0-21565CFF5650}
"DhcpNameServer"="85.255.113.75,85.255.112.40" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F7A81E81-F60B-4565-9A80-8C9C71951DE6}
"DhcpNameServer"="85.255.113.75,85.255.112.40" <Value cleared.

Successfully flushed the DNS Resolver Cache.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....
~~~~~ Other
C:\WINDOWS\TEMP\kdrhk.ren 63488 08/03/2004

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"runwinlogon"="C:\\WINDOWS\\winlogon.exe"
"ntuser"="C:\\WINDOWS\\system32\\drivers\\spools.exe"
"autoload"="C:\\Documents and Settings\\Administrator\\cftmon.exe"
"40a69435"="rundll32.exe \"C:\\WINDOWS\\system32\\lqqylmhp.dll\",b"
"C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"avgnt"="\"C:\\Program Files\\Avira\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus-3444"="\"C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\smss.exe\""
"Tok-Cirrhatus"=""
"ntuser"="C:\\WINDOWS\\system32\\drivers\\spools.exe"
"autoload"="C:\\Documents and Settings\\Administrator\\cftmon.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

<gras>rapport hijackthis</gras>

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:12:45 AM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll
O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O21 - SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC} - C:\WINDOWS\vltdfabw.dll
O21 - SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22} - C:\WINDOWS\vregfwlx.dll
O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
Angel83 - 31 mai 2008 à 22:30
rapport hijackthis apres Siri

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:23:44 AM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll
O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O21 - SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC} - C:\WINDOWS\vltdfabw.dll
O21 - SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22} - C:\WINDOWS\vregfwlx.dll
O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
Ajouter un commentaire
Réponse
+0
moins plus
cyrildu17 6267Messages postés 28 septembre 2007Date d'inscription 31 mai 2008 à 21:52
Salut les gars ,
Pour suivre ;)

Ajouter un commentaire
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 31 mai 2008 à 22:25
# Télécharge ceci: (merci a S!RI pour ce petit programme).

http://siri.urz.free.fr/Fix/SmitfraudFix.zip

Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1,
voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
il va générer un rapport : copie/colle le sur le poste stp.


Ajouter un commentaire
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 31 mai 2008 à 22:31
non je veux le rapport smithfraud stp

voir post 10

Ajouter un commentaire
Angel83 - 31 mai 2008 à 22:42
SmitFraudFix v2.323

Scan done at 5:35:32.79, Sun 06/01/2008
Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\privacy_danger FOUND !
C:\WINDOWS\xmpstean.exe FOUND !
C:\WINDOWS\Tasks\At?.job FOUND !
C:\WINDOWS\Tasks\At??.job FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
+--------------------------------------------------+
[!] Suspicious: boqnrwdmqed.dll
BHO: QXK Olive - {4F7764DC-5B4A-44B9-B629-E889E542C545}
TypeLib: {34042290-F6F7-4D2A-81D7-D160BCE39CFC}
Interface: {122EE594-360F-42B1-88D5-2EBB113B5DE4}
Interface: {A4F2F919-0658-4162-9B8E-5453758C75FC}

[!] Suspicious: atfxqogp.dll
Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878}
TypeLib: {DC225FE6-B048-46B4-8AEE-D720C14B6F66}
Interface: {F73CEA33-AB5A-41B2-A912-D76C8289E46B}
Classe: atfxqogp.bwxd
Classe: atfxqogp.ToolBar.1

[!] Suspicious: vltdfabw.dll
SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC}

[!] Suspicious: vregfwlx.dll
SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22}


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{B5AC49A2-94F2-42BD-F434-2604812C897D}"="Hkjr94jdfdgj"

[HKEY_CLASSES_ROOT\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\hdxjd4g.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\hdxjd4g.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{B5AF0562-94F3-42BD-F434-2604812C797D}"="Hjkfj93dffd"

[HKEY_CLASSES_ROOT\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
@="C:\WINDOWS\system32\djki397g.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
@="C:\WINDOWS\system32\djki397g.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"system"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: VIA Compatable Fast Ethernet Adapter - Packet Scheduler Miniport
DNS Server Search Order: 192.168.250.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: DhcpNameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: DhcpNameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: DhcpNameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F7A81E81-F60B-4565-9A80-8C9C71951DE6}: DhcpNameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.113.75 85.255.112.40
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 31 mai 2008 à 22:44
Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
# Relance le programme Smitfraud :
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum + un rapport hijackthis fais apres passage de smithfraud option 2 stp

Ajouter un commentaire
Angel83 - 31 mai 2008 à 23:30
la je suis en mode normal j ai l arriere plan du bureau ki est tout blanc

voici le nveau rapport smithfraud

SmitFraudFix v2.323

Scan done at 5:43:51.60, Sun 06/01/2008
Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{B5AC49A2-94F2-42BD-F434-2604812C897D}"="Hkjr94jdfdgj"

[HKEY_CLASSES_ROOT\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\hdxjd4g.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\hdxjd4g.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{B5AF0562-94F3-42BD-F434-2604812C797D}"="Hjkfj93dffd"

[HKEY_CLASSES_ROOT\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
@="C:\WINDOWS\system32\djki397g.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
@="C:\WINDOWS\system32\djki397g.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
C:\WINDOWS\boqnrwdmqed.dll deleted.
C:\WINDOWS\atfxqogp.dll deleted.
C:\WINDOWS\vltdfabw.dll deleted.
C:\WINDOWS\vregfwlx.dll deleted.


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\privacy_danger\ Deleted
C:\WINDOWS\xmpstean.exe Deleted
C:\WINDOWS\Tasks\At?.job Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: VIA Compatable Fast Ethernet Adapter - Packet Scheduler Miniport
DNS Server Search Order: 192.168.250.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: DhcpNameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: DhcpNameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: DhcpNameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F7A81E81-F60B-4565-9A80-8C9C71951DE6}: DhcpNameServer=85.255.113.75,85.255.112.40
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.113.75 85.255.112.40
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.250.254


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{B5AC49A2-94F2-42BD-F434-2604812C897D}"="Hkjr94jdfdgj"

[HKEY_CLASSES_ROOT\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\hdxjd4g.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\hdxjd4g.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{B5AF0562-94F3-42BD-F434-2604812C797D}"="Hjkfj93dffd"

[HKEY_CLASSES_ROOT\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
@="C:\WINDOWS\system32\djki397g.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InProcServer32]
@="C:\WINDOWS\system32\djki397g.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End

HIJACK

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:04: VIRUS ALERT!, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Documents and Settings\LocalService\cftmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
F3 - REG:win.ini: run="C:\WINDOWS\system32\winupdate.exe"
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll (file missing)
O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\wwww\cftmon.exe
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 31 mai 2008 à 23:33
Telecharge malwarebytes

-> http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

ps : les rapport sont aussi rangé dans l onglet rapport/log

Ajouter un commentaire
Ajouter un commentaire
Réponse
+0
moins plus
Angel83 1 juin 2008 à 04:41
Malwarebytes' Anti-Malware 1.14
Version de la base de données: 811

6:50:43 AM 6/1/2008
mbam-log-6-1-2008 (06-50-43).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 53865
Temps écoulé: 8 minute(s), 49 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 31
Valeur(s) du Registre infectée(s): 18
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 91

Processus mémoire infecté(s):
C:\WINDOWS\system32\drivers\spools.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\wvUomNGX.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\geBqPHbc.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvuomngx (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\luapvs.tchongabho (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cf26fac0-7d4e-46d8-ae64-b277b11443ac} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf26fac0-7d4e-46d8-ae64-b277b11443ac} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b5ac49a2-94f2-42bd-f434-2604812c897d} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b5ac49a2-94f2-42bd-f434-2604812c897d} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b5af0562-94f3-42bd-f434-2604812c797d} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b5af0562-94f3-42bd-f434-2604812c797d} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{def85c80-216a-43ab-af70-1665edbe2780} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Adware.Search Toolbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Adware.Search Toolbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ICF (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\qandr (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Google Online Services (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\IQSoftware (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8b46f64-6b40-4b7f-b014-3b3509ddd86a} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8b46f64-6b40-4b7f-b014-3b3509ddd86a} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\atfxqogp.bwxd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\atfxqogp.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ICF (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InstallProgram (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{b5ac49a2-94f2-42bd-f434-2604812c897d} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{b5af0562-94f3-42bd-f434-2604812c797d} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\run\runwinlogon (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\herjek (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40a69435 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebqphbc -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-640-1532467-23731) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\XP Antivirus (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Adsl Software Limited (Rogue.MalWarrior) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect (Rogue.MalWarrior) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\wvUomNGX.dll (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\Administrator\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\setup_526_1_.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsrc.dll (Adware.Search Toolbar) -> Quarantined and deleted successfully.
C:\porno.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\pbdv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vrym534.exe (Trojan.DownLoader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vrym656.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\4EC0.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\56F9.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\A2-tmpaASI.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\ie_updates3r.exe1 (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temp\3858054990.exe (Trojan.FakeALert) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temp\csrssc.exe (Trojan.FakeALert) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temp\2464944552.exe (Trojan.FakeALert) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temp\A82.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temp\4CE1.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temp\7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temp\728E.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temp\2AB8.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temporary Internet Files\Content.IE5\I1Q50XUV\wmvcodec2.03[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Temporary Internet Files\Content.IE5\I1Q50XUV\ggg3[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011186.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011213.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011215.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011227.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011231.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011235.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011250.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP30\A0011254.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP31\A0011261.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP31\A0011357.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP31\A0011367.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0011368.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0011376.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0011378.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012375.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012377.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012425.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0012429.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0013423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP32\A0013425.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP33\A0013427.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP34\A0013428.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP35\A0013429.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP35\A0013431.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP36\A0013435.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP37\A0013436.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP37\A0013541.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP38\A0013542.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013544.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013645.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013646.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013647.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP39\A0013649.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP42\A0013665.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP47\A0014907.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A5CE31C6-6906-46D3-911F-273B4CEB23D1}\RP47\A0014957.dll (Trojan.Qqpass) -> Quarantined and deleted successfully.
C:\FOUND.000\FILE0004.CHK (Trojan.Agent) -> Quarantined and deleted successfully.
C:\FOUND.000\FILE0010.CHK (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\XP Antivirus\xpa.exe.tmp (Rogue.XPAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\herjek.config (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svcp.csv (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ieupdates.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\herjek.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\spools.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wscmp.dll.tmp (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lqqylmhp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\update32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wscmp.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\geBqPHbc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\found.exe.exe (Worm.Zhelatin) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsub.xml (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Local Settings\Tempboome20.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\printsrv32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Desktop\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Desktop\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\wwww\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svchost.t__ (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\WINDOWS\SVCHOST.INI (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

 Ajouter un commentaire
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 1 juin 2008 à 04:49
pas couché ??

Redémarre le pc si ça n a pas été fais
réouvre malewarebyte
va sur quarantaine
supprime tout

Télécharge clean.zip, de Malekal
http://www.malekal.com/download/clean.zip



(1) Dézippe-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.

(2) Ouvre le dossier clean qui se trouve sur ton bureau, et double-clic sur clean.cmd

une fenêtre noire va apparaître pendant un instant, laisse la ouverte.

(3) Choisis l'option 1 puis patiente
Poste le rapport obtenu


pour retrouver le rapport : double clique sur > C > double clique sur " rapport_clean txt.
et copie/colle le sur ta prochaine réponse .

Ne passe pas à l'option 2 sans notre avis !

Ajouter un commentaire
Ajouter un commentaire
Réponse
+0
moins plus
Angel83 1 juin 2008 à 11:26
Non j etais pas encore couchee, je vois que toi aussi lol

voici le rapport clean

Sun 06/01/2008 a 18:08:52.14

*** Recherche C:

*** Recherche C:\WINDOWS\

*** Recherche C:\WINDOWS\system32
C:\WINDOWS\system32\mcrh.tmp FOUND

*** Recherche C:\Program Files
*** End of the report !

 Ajouter un commentaire
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 1 juin 2008 à 11:47
Salut,


réouvre clean, passe l option 2

et envoi le rapport clean stp + un rapport hijackthis fais apes passage de clean option 2 stp


Ajouter un commentaire
Angel83 - 1 juin 2008 à 14:08
rapport clean

Script executed in Safe Mode
Rapport clean par Malekal_morte - http://www.malekal.com
Script executed in Safe Mode Sun 06/01/2008 a 20:59:00.98

Microsoft Windows XP [Version 5.1.2600]

*** Suppression C:

*** Suppression C:\WINDOWS\

*** Suppression C:\WINDOWS\system32
tentative de suppression de C:\WINDOWS\system32\mcrh.tmp

*** Suppression C:\Program Files

*** Deletion of the registry keys successful..

rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:04:35 PM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll (file missing)
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\nhhwkseq.dll",b
O4 - HKLM\..\Run: [BM4395a7a9] Rundll32.exe "C:\WINDOWS\system32\rwihhocq.dll",s
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 1 juin 2008 à 14:10
Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe


-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

-> Tutoriel http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


Ajouter un commentaire
Angel83 - 1 juin 2008 à 14:43
voila!

ComboFix 08-05-29.1 - Administrator 2008-06-01 21:28:17.1 - [color=red][b]FAT32/b/colorx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.40 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!/b/color
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\LocalService\Application Data\sp1
C:\Documents and Settings\LocalService\Application Data\sp1\a.tmp
C:\Documents and Settings\wwww\Start Menu\Programs\Antivirus 2008 PRO
C:\Documents and Settings\wwww\Start Menu\Programs\Antivirus 2008 PRO\antivirus-2008pro.lnk
C:\Program Files\Antivirus 2008 PRO
C:\Program Files\Antivirus 2008 PRO\antivirus-2008pro.exe
C:\Program Files\Antivirus 2008 PRO\vscan.tsi
C:\Program Files\Antivirus 2008 PRO\zlib.dll
C:\smp.bat
C:\WINDOWS\BM4395a7a9.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\atfnecog.exe
C:\WINDOWS\system32\cbHPqBeg.ini
C:\WINDOWS\system32\cbHPqBeg.ini2
C:\WINDOWS\system32\efcCrRhI.dll
C:\WINDOWS\system32\gdeycwil.dll
C:\WINDOWS\system32\geBqPHbc.dll
C:\WINDOWS\system32\hecxqgou.dll
C:\WINDOWS\system32\IhRrCcfe.ini
C:\WINDOWS\system32\IhRrCcfe.ini2
C:\WINDOWS\system32\kjcmgbch.dll
C:\WINDOWS\system32\kksduwmv.dll
C:\WINDOWS\system32\liwcyedg.ini
C:\WINDOWS\system32\nhhwkseq.dll
C:\WINDOWS\system32\opmjllug.dll
C:\WINDOWS\system32\phmlyqql.ini
C:\WINDOWS\system32\qeskwhhn.ini
C:\WINDOWS\system32\qtBIOqru.ini
C:\WINDOWS\system32\qtBIOqru.ini2
C:\WINDOWS\system32\rwihhocq.dll
C:\WINDOWS\system32\sxvntdci.dll
C:\WINDOWS\system32\urqOIBtq.dll
C:\WINDOWS\system32\vmwudskk.ini
C:\WINDOWS\system32\voscenvv.exe
C:\WINDOWS\system32\wvUomNGX.dll

----- BITS: Possible infected sites -----

hxxp://statsboat.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GOOGLE_ONLINE_SERVICES
-------\Legacy_ICF
-------\Service_ksnhtr


((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.

2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
C:\WINDOWS\boqnrwdmqed.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6813E51A-D108-4693-972A-0490411C4878}"= "C:\WINDOWS\atfxqogp.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{6813e51a-d108-4693-972a-0490411c4878}]
[HKEY_CLASSES_ROOT\atfxqogp.1]
[HKEY_CLASSES_ROOT\TypeLib\{DC225FE6-B048-46B4-8AEE-D720C14B6F66}]
[HKEY_CLASSES_ROOT\atfxqogp]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus-3444"="C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus"="" []
"run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableCMD"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-01 21:35:06
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\comctl32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
.
**************************************************************************
.
Completion time: 2008-06-01 21:35:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-02 04:35:48

Pre-Run: 4,906,164,224 bytes free
Post-Run: 5,652,496,384 bytes free

164
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 1 juin 2008 à 14:46
super

refais un scan hijackthis et post le rapport stp

Ajouter un commentaire
Angel83 - 1 juin 2008 à 14:48
here it is

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:45:06 PM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: QXK Olive - {4F7764DC-5B4A-44B9-B629-E889E542C545} - C:\WINDOWS\boqnrwdmqed.dll (file missing)
O2 - BHO: (no name) - {8CA667BF-F25B-40FA-94FF-EE529946A9D1} - C:\WINDOWS\system32\shellstyl.dll
O2 - BHO: (no name) - {C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8} - C:\WINDOWS\system32\shellstyl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll (file missing)
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 1 juin 2008 à 14:57
Rends toi sur ce site :

http://www.virustotal.com/

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\kdrhk.exe

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

fais de meme pour ce fichier : C:\WINDOWS\system32\shellstyl.dll




Ajouter un commentaire
Angel83 - 1 juin 2008 à 20:17
voici le rapport pour shellstl.dll

par contre je trouve pas l autre fichier

File shellstyl.dll received on 06.01.2008 19:48:49 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED


Result: 12/31 (38.71%)
Loading server information...
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
AhnLab-V3 2008.5.30.1 2008.05.30 -
AntiVir 7.8.0.26 2008.06.01 TR/ATRAPS.Gen
Authentium 5.1.0.4 2008.06.01 -
Avast 4.8.1195.0 2008.05.31 -
AVG 7.5.0.516 2008.05.31 Downloader.Delf.12.AN
BitDefender 7.2 2008.06.01 Trojan.Spy.BZub.NHY
CAT-QuickHeal 9.50 2008.05.31 -
ClamAV 0.92.1 2008.06.01 -
DrWeb 4.44.0.09170 2008.06.01 Trojan.DownLoader.56883
eSafe 7.0.15.0 2008.06.01 -
eTrust-Vet 31.4.5837 2008.05.30 Win32/Kvol!generic
Ewido 4.0 2008.06.01 -
F-Prot 4.4.4.56 2008.06.01 -
F-Secure 6.70.13260.0 2008.06.01 -
Fortinet 3.14.0.0 2008.06.01 -
GData 2.0.7306.1023 2008.06.01 -
Ikarus T3.1.1.26.0 2008.06.01 Virus.Trojan.Win32.Pakes.cdw
Kaspersky 7.0.0.125 2008.06.01 -
McAfee 5307 2008.05.30 -
Microsoft 1.3520 2008.06.01 Trojan:Win32/Boaxxe.B
NOD32v2 3150 2008.06.01 a variant of Win32/Agent.NSG
Norman 5.80.02 2008.05.30 -
Panda 9.0.0.4 2008.06.01 Suspicious file
Prevx1 V2 2008.06.01 Fraudulent Security Program
Rising 20.46.62.00 2008.06.01 Trojan.Clicker.Win32.Delf.mm
Sophos 4.29.0 2008.06.01 -
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.06.01 -
VBA32 3.12.6.6 2008.06.01 -
VirusBuster 4.3.26:9 2008.06.01 -
Webwasher-Gateway 6.6.2 2008.06.01 Trojan.ATRAPS.Gen
Additional information
File size: 88576 bytes
MD5...: 253d9b5924390c53899d125a5f4d79dd
SHA1..: 66fd4c25631f0242a3cfe984630870f2ff0446f8
SHA256: 30eff06bb3100512a8541894cbabce46f4d6af314766fcfbb1b9853101c5f3ae
SHA512: d68dd46b71644d3af48c0e0d1304e6772db77e0d76ee7fd56755480b21cb0515
d120b7ea28d5793faee04bf94018d37f46bd2187bd428c78d0b3cb9ef718861e
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x43a840
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x25000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x26000 0x15000 0x14c00 7.89 feb73d01fe0c2f653bd0f2ad39f81e16
.rsrc 0x3b000 0x1000 0xa00 3.60 f223b7beea8cb0242ef360cdd34bdeaf

( 7 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree
> advapi32.dll: RegCloseKey
> ole32.dll: IsEqualGUID
> oleaut32.dll: LoadTypeLib
> shell32.dll: SHGetMalloc
> user32.dll: SetTimer
> wininet.dll: InternetCrackUrlA

( 5 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, InitEntry0

Prevx info: http://info.prevx.com/...
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX
Ajouter un commentaire
Réponse
+0
moins plus
balltrap34 16272Messages postés 8 janvier 2004Date d'inscription 1 juin 2008 à 17:43
salut
atention se qui suit est exclusivement reserver a cette ordinateur il ne faut absolument pas l utyiliser pour un autre sous peine de planter le pc

normalement tu as deja telecharger combofix et il doit etre sur ton bureau

ouvre le bloc note et colle ce qui est en gras ci dessous


Files::
C:\WINDOWS\system32\kdrhk.exe
C:\WINDOWS\system32\shellstyl.dll
C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe
C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll
C:\WINDOWS\boqnrwdmqed.dll
C:\WINDOWS\system32\umovsb.tmp
C:\bxqhsfpe.exe
C:\WINDOWS\system32\sex3.ico
C:\WINDOWS\system32\sex2.ico.tmp
C:\WINDOWS\system32\sex1.ico.tmp
C:\WINDOWS\system32\winsrc.dll.tmp
C:\WINDOWS\system32\sex3.ico.tmp
C:\WINDOWS\system32\iodrfeup.tmp
C:\WINDOWS\emop.exe


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
[-HKEY_CLASSES_ROOT\CLSID\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
[-HKEY_CLASSES_ROOT\CLSID\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
[-HKEY_CLASSES_ROOT\CLSID\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
[-HKEY_CLASSES_ROOT\clsid\{6813e51a-d108-4693-972a-0490411c4878}]
[-HKEY_CLASSES_ROOT\atfxqogp.1]
[-HKEY_CLASSES_ROOT\TypeLib\{DC225FE6-B048-46B4-8AEE-D720C14B6F66}]
[-HKEY_CLASSES_ROOT\atfxqogp]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus-3444"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus"=-


enregistre le et donne lui comme nom CFScript.txt




[list]Fais un glisser/déposer de ce fichier [b]CFScript/b sur le fichier ComboFix.exe comme sur la capture
[img]http://img.photobucket.com/albums/v666/sUBs/CFScript.gif/img[list]
[*]Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) ,[b] tape 1/b puis valide.
[*]Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
[*]Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
[*]Si le fichier ne s'ouvre pas, il se trouve ici > C:\[b]ComboFix.txt/b/list

Ajouter un commentaire - Site web
Angel83 - 1 juin 2008 à 20:14
ComboFix 08-05-29.1 - Administrator 2008-06-02 2:58:57.2 - [color=red][b]FAT32/b/colorx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.68 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!/b/color
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\wwww\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk

.
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.

2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-01_21.35.28.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-02 04:34:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 09:35:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F06C515-7084-4700-B436-AFBF63A3C519}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableCMD"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 03:00:25
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
.
Completion time: 2008-06-02 3:00:54
ComboFix-quarantined-files.txt 2008-06-02 10:00:54
ComboFix2.txt 2008-06-02 04:35:54

Pre-Run: 5,652,193,280 bytes free
Post-Run: 5,648,465,920 bytes free

105
Ajouter un commentaire
Réponse
+0
moins plus
Chiquitine29 1 juin 2008 à 20:18
re

fais ce qui est expliqué par balltrap post 27 stp

Ajouter un commentaire
Angel83 - 1 juin 2008 à 20:25
ComboFix 08-05-29.1 - Administrator 2008-06-02 2:58:57.2 - [color=red][b]FAT32/b/colorx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.68 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!/b/color
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\wwww\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk

.
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.

2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
.

((((((((((((((((((((((((((((( snapshot@2008-06-01_21.35.28.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-02 04:34:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 09:35:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F06C515-7084-4700-B436-AFBF63A3C519}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableCMD"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 03:00:25
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
.
Completion time: 2008-06-02 3:00:54
ComboFix-quarantined-files.txt 2008-06-02 10:00:54
ComboFix2.txt 2008-06-02 04:35:54

Pre-Run: 5,652,193,280 bytes free
Post-Run: 5,648,465,920 bytes free

105
Ajouter un commentaire
1 2 Suivant
Posez votre question
Ce document intitulé « Des Virus partout help! » issu de CommentCaMarche (www.commentcamarche.net) est mis à disposition sous les termes de la licence Creative Commons. Vous pouvez copier, modifier des copies de cette page, dans les conditions fixées par la licence, tant que cette note apparaît clairement.
Dossier à la une
Passage au tout numérique : quel coût pour les particuliers ?
Des Virus partout help! - page 2