Virus Virtumonde [Résolu]

slt,


scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.
_______________

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
______________

colle un rapport hijackthis


http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :
http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
http://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\aWoLCrRk.dll
C:\Windows\system32\dwgjfgcd.ini
C:\Windows\System32\kRrCLoWa.ini
C:\Windows\System32\kRrCLoWa.ini2
C:\Windows\System32\SCIkSAHk.ini
C:\Windows\System32\SCIkSAHk.ini2
C:\Windows\system32\uotdhahy.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-06 to 2008-06-06 ))))))))))))))))))))))))))))))))))))
.

2008-06-06 14:11 . 2008-06-06 14:11 <REP> d-------- C:\VundoFix Backups
2008-06-06 12:23 . 2008-06-06 12:23 2,560 --a------ C:\Windows\_MSRSTRT.EXE
2008-06-06 12:22 . 2008-06-06 12:22 <REP> d-------- C:\Program Files\WTASK
2008-06-06 11:59 . 2008-06-06 18:41 <REP> d-------- C:\Users\Guillaume\.rainlendar2
2008-06-06 11:59 . 2008-06-06 11:59 <REP> d-------- C:\Program Files\Rainlendar2
2008-06-06 11:45 . 2008-06-06 12:24 <REP> d-------- C:\Program Files\Taskbar Hide
2008-06-06 02:03 . 2008-06-06 02:03 96,192 --a------ C:\Windows\System32\gvreohjn.dll
2008-06-06 02:03 . 2008-06-06 18:41 766 ---hs---- C:\Windows\System32\njhoervg.ini
2008-06-06 02:02 . 2008-06-06 02:02 96,192 --a------ C:\Windows\System32\fhyegyyi.dll
2008-06-06 02:02 . 2008-06-06 01:59 354 --ahs---- C:\Windows\System32\iyygeyhf.ini
2008-06-05 21:24 . 2008-06-05 21:24 <REP> d-------- C:\Program Files\Stardock
2008-06-05 21:24 . 2008-06-05 21:24 <REP> d-------- C:\Program Files\Common Files\Stardock
2008-06-05 20:49 . 2008-06-05 20:49 <REP> d-------- C:\Program Files\RocketDock
2008-06-05 20:30 . 2008-06-05 20:30 <REP> d-------- C:\Program Files\Xio
2008-06-05 20:29 . 2008-06-05 20:29 <REP> d-------- C:\Users\Guillaume\AppData\Roaming\Xion
2008-06-05 18:36 . 2008-06-05 18:36 <REP> d-------- C:\Program Files\Soulseek
2008-06-03 01:24 . 2008-06-03 01:24 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-06-03 00:49 . 2008-06-03 00:49 <REP> d-------- C:\Users\Guillaume\AppData\Roaming\River Past G5
2008-06-03 00:49 . 2008-06-03 01:50 <REP> d-------- C:\Users\All Users\River Past G5
2008-06-03 00:49 . 2008-06-03 01:50 <REP> d-------- C:\ProgramData\River Past G5
2008-06-03 00:49 . 2008-06-03 01:09 <REP> d-------- C:\Program Files\Common Files\River Past
2008-05-31 23:16 . 2008-05-31 23:16 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-05-28 08:36 . 2008-03-08 04:08 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 08:36 . 2008-03-08 06:21 1,695,744 --a------ C:\Windows\System32\gameux.dll
2008-05-27 22:14 . 2008-06-03 01:38 341,240,180 --a------ C:\Windows\MEMORY.DMP
2008-05-25 22:30 . 2008-05-25 22:30 <REP> d-------- C:\Users\Guillaume\AppData\Roaming\Publish Providers
2008-05-24 17:38 . 2008-05-24 17:38 <REP> d-------- C:\Program Files\Trend Micro
2008-05-24 17:20 . 2008-05-24 17:20 <REP> d-------- C:\Program Files\CCleaner
2008-05-19 01:01 . 2008-06-06 00:48 364 --a------ C:\Windows\wininit.ini
2008-05-18 23:39 . 2008-05-18 23:19 152,576 --a------ C:\Windows\System32\SPWizUI.dll
2008-05-18 23:39 . 2008-05-18 23:19 47,560 --a------ C:\Windows\System32\SPReview.exe
2008-05-18 23:25 . 2008-01-18 23:33 193,024 --a------ C:\Windows\System32\recdisc.exe
2008-05-18 23:25 . 2008-01-18 23:36 6,656 --a------ C:\Windows\System32\sdspres.dll
2008-05-18 23:24 . 2008-01-18 23:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
2008-05-18 23:24 . 2008-01-18 23:36 142,336 --a------ C:\Windows\System32\spp.dll
2008-05-18 23:24 . 2008-01-18 23:36 28,160 --a------ C:\Windows\System32\sxproxy.dll
2008-05-18 23:22 . 2008-01-18 23:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-05-18 23:19 . 2008-05-18 23:39 327,680 --a------ C:\Windows\SPInstall.etl
2008-05-18 23:19 . 2008-01-18 23:33 44,032 --a------ C:\Windows\System32\cbsra.exe
2008-05-18 20:35 . 2008-05-18 20:35 <REP> d-------- C:\Users\Guillaume\AppData\Roaming\Sony
2008-05-18 20:31 . 2008-05-25 22:27 <REP> d-------- C:\Program Files\Sony
2008-05-13 19:06 . 2006-05-26 12:57 31,232 --a------ C:\Windows\System32\zgate.dll
2008-05-13 19:05 . 2002-12-05 18:58 1,388,544 --a------ C:\Windows\System32\MSVBVM6N.DLL
2008-05-13 19:05 . 2004-03-09 01:00 1,081,616 --a------ C:\Windows\System32\MSCOMCTL2.OCX
2008-05-13 19:05 . 1998-06-24 02:00 369,696 --a------ C:\Windows\System32\COMCT332.OCX
2008-05-13 19:05 . 2007-03-18 00:57 209,608 --a------ C:\Windows\System32\TABCTL32.OCX
2008-05-13 19:05 . 2004-06-25 21:20 140,288 --a------ C:\Windows\System32\COMDLG32.OCX
2008-05-13 19:05 . 2007-03-18 00:58 109,248 --a------ C:\Windows\System32\MSWINSCK.OCX
2008-05-12 23:07 . 2008-05-13 01:06 <REP> d-------- C:\Windows\System32\Adobe
2008-05-11 19:36 . 2007-03-23 04:05 29,272 -ra------ C:\Windows\System32\AdobePDF.dll
2008-05-11 13:43 . 2008-05-11 20:31 <REP> d-------- C:\Users\Guillaume\AppData\Roaming\Download Manager

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 16:40 --------- d-----w C:\Program Files\Steam
2008-06-06 16:38 110,636,320 --sha-w C:\Windows\system32\drivers\fidbox.dat
2008-06-06 16:38 1,441,328 --sha-w C:\Windows\system32\drivers\fidbox.idx
2008-06-06 10:57 --------- d-----w C:\Users\Guillaume\AppData\Roaming\mIRC
2008-06-06 10:57 --------- d-----w C:\Program Files\mIRC
2008-06-06 10:26 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-06-05 23:59 --------- d-----w C:\ProgramData\NVIDIA
2008-06-05 21:41 --------- d-----w C:\Program Files\Common Files\Steam
2008-06-02 23:54 --------- d-----w C:\Users\Guillaume\AppData\Roaming\Skype
2008-06-02 22:01 --------- d-----w C:\Users\Guillaume\AppData\Roaming\skypePM
2008-06-02 20:20 --------- d-----w C:\Users\Guillaume\AppData\Roaming\FileZilla
2008-05-29 16:42 88,774 ----a-w C:\Windows\system32\drivers\klick.dat
2008-05-28 15:39 96,966 ----a-w C:\Windows\system32\drivers\klin.dat
2008-05-28 13:19 112,144 ----a-w C:\Windows\system32\drivers\kl1.sys
2008-05-25 20:30 --------- d-----w C:\Program Files\Steinberg
2008-05-18 22:05 174 --sha-w C:\Program Files\desktop.ini
2008-05-18 21:58 --------- d-----w C:\Program Files\Windows Sidebar
2008-05-18 21:58 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-05-18 21:58 --------- d-----w C:\Program Files\Windows Mail
2008-05-18 21:58 --------- d-----w C:\Program Files\Windows Journal
2008-05-18 21:58 --------- d-----w C:\Program Files\Windows Defender
2008-05-18 21:58 --------- d-----w C:\Program Files\Windows Collaboration
2008-05-18 21:58 --------- d-----w C:\Program Files\Windows Calendar
2008-05-18 18:30 --------- d-----w C:\Program Files\Sony Setup
2008-05-17 20:53 --------- d-----w C:\Users\Guillaume\AppData\Roaming\uTorrent
2008-05-16 01:02 --------- d-----w C:\ProgramData\Microsoft Help
2008-05-13 16:54 --------- d-----w C:\Program Files\eMule
2008-05-12 12:01 --------- d-----w C:\ProgramData\FLEXnet
2008-05-11 22:43 --------- d-----w C:\Program Files\LimeWire
2008-05-11 22:40 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-11 22:38 --------- d-----w C:\Users\Guillaume\AppData\Roaming\LimeWire
2008-05-01 18:18 --------- d-----w C:\Users\Guillaume\AppData\Roaming\Propellerhead Software
2008-04-28 17:28 --------- d-----w C:\Users\Guillaume\AppData\Roaming\Snapfish
2008-04-23 22:03 --------- d-----w C:\Program Files\Java
2008-04-23 13:35 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-04-23 13:26 --------- d-----w C:\Program Files\MSBuild
2008-04-23 13:26 --------- d-----w C:\Program Files\Microsoft Works
2008-04-23 13:25 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-23 13:22 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-04-20 16:01 --------- d-----w C:\Users\Guillaume\AppData\Roaming\OpenOffice.org2
2008-04-20 12:28 --------- d-----w C:\Program Files\Notepad++
2008-04-19 23:36 --------- d-----w C:\Users\Guillaume\AppData\Roaming\Notepad++
2008-04-19 20:50 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-04-19 16:43 --------- d-----w C:\Users\Guillaume\AppData\Roaming\InstallShield Installation Information
2008-04-13 17:44 --------- d-----w C:\Program Files\EasyPHP 2.0b1
2008-04-13 14:33 --------- d-----w C:\Program Files\Guitar Pro 5
2008-04-13 13:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-11 12:05 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-08 04:19 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-03-08 04:19 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-03-08 04:19 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-03-08 04:19 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-03-08 01:58 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-03-03 17:02 22,328 ----a-w C:\Users\Guillaume\AppData\Roaming\PnkBstrK.sys
2008-02-13 16:00 32 ----a-w C:\Users\All Users\ezsid.dat
2008-02-13 16:00 32 ----a-w C:\ProgramData\ezsid.dat
2008-02-03 19:40 675 ----a-w C:\Users\Guillaume\AppData\Roaming\waver_2.95.dat
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-30 18:13 1271032]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-06-22 14:45 133576]
"Taskbar Hide"="C:\PROGRA~1\TASKBA~1\TaskBar.exe" [ ]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-12-30 12:23 1365504]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 23:33 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 16:36 178712]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 13:27 4702208 C:\Windows\RtHDVCpl.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Diamondback"="C:\Program Files\Razer\Diamondback\razerhid.exe" [2007-02-14 12:15 147456]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 18:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 18:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 18:06 81920]
"4ef57929"="C:\Windows\system32\gvreohjn.dll" [2008-06-06 02:03 96192]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-26 17:53 218376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]

C:\Users\Guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-06-05 21:24:16 3450608]
RocketDock.lnk - C:\Program Files\RocketDock\RocketDock.exe [2008-06-05 20:49:01 495616]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= i420vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Users^Guillaume^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk]
path=C:\Users\Guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk
backup=C:\Windows\pss\OpenOffice.org 2.3.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Guillaume^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Stardock ObjectDock.lnk]
path=C:\Users\Guillaume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
backup=C:\Windows\pss\Stardock ObjectDock.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
--a------ 2007-05-10 22:46 624248 C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 20:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-03-01 00:06 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-12-23 18:05 143360 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
--a------ 2005-10-23 01:00 385024 C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-10 16:27 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 12:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
C:\Program Files\GoogleEULA\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C13862A4-F2EE-4907-97CF-FB7E34D73810}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{1C3C1F2F-24B8-401B-AE24-05AF554BAF3A}"= UDP:C:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:Gears of War
"{8FF7B4CB-5B8D-40BA-9DCB-2B7267EE468C}"= TCP:C:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:Gears of War
"{2C88EAF4-EE7E-4305-829A-24C19A1EBDEA}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{47C1DEEC-B0D1-41E7-8607-B3F1ECD9334E}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{4B12BBBE-1107-4576-B3CF-0262D7FB077B}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{C209AB61-A323-4F4A-8180-13F0B0D2DA9D}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{0C373167-59D7-4139-A774-AA41FBCC8346}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{4CEF8803-7CD7-42BB-9A6D-82D568F4A559}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{EC5139B3-F13A-4317-803D-5AC7A792425C}"= UDP:C:\Program Files\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
"{887D334E-B331-4FF3-A460-606F89C42111}"= TCP:C:\Program Files\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
"{A09353C8-543B-4B6B-BAE7-73ECDC722758}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{F0B2750A-9CCE-45EF-8915-BB1517E719EB}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{DD65914D-FBE8-4A8F-9E5C-E4D46EA741ED}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{31FC4DBB-CA71-44A6-B26C-523AE861A02F}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{A0519F41-FE4D-4F59-A449-BC03C3C23705}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{0E8743BF-420B-484B-A3D7-294838678A93}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{0922FC96-5F5D-4282-9416-ADB086954B23}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{6037F354-B344-4E64-8B19-9AD77D0F8721}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{5D2F77D9-FDEA-43FB-86AD-7493E8AD0722}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{19C9EE20-47D9-4661-A61D-19207BEC72C2}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-04-04 15:59]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 12:43]
R3 athrusb6;Atheros Wireless LAN USB device driver 6 Series;C:\Windows\system32\DRIVERS\athru6.sys [2007-05-16 19:43]
R3 CLEDX;Team H2O CLEDX service;C:\Windows\system32\DRIVERS\cledx.sys [2005-05-09 21:08]
R3 Razerlow;Razerlow USB Filter Driver;C:\Windows\system32\Drivers\Razerlow.sys [2005-04-24 23:43]
S3 athrusb;Atheros Wireless LAN USB device driver;C:\Windows\system32\DRIVERS\athrusb.sys [2006-12-22 21:05]
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-06-05 20:39]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ca50e3a-e245-11dc-8b28-001d92001f20}]
\shell\AutoRun\command - K:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4badad9-baa3-11dc-a724-001d92001f20}]
\shell\AutoRun\command - I:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 18:41:05
Windows 6.0.6001 Service Pack 1 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


C:\Users\Guillaume\AppData\Local\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims™ 2 : Boit@Look.lnk 1243 bytes hidden from API

Scan termin‚ avec succŠs
Les fichiers cach‚s: 1

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Program Files\RocketDock\RocketDock.dll
-> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
-> C:\Windows\system32\gvreohjn.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
C:\Windows\System32\PnkBstrA.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\conime.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Program Files\Razer\Diamondback\razertra.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-06 18:50:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-06 16:50:30

Pre-Run: 613,052,973,056 octets libres
Post-Run: 612,981,952,512 octets libres

281 --- E O F --- 2008-05-29 16:26:47

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:57:04, on 06/06/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Razer\Diamondback\razerhid.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Razer\Diamondback\razertra.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
C:\Windows\Explorer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\HijackThis\eden.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback\razerhid.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [4ef57929] rundll32.exe "C:\Windows\system32\gvreohjn.dll",b
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [Taskbar Hide] C:\PROGRA~1\TASKBA~1\TaskBar.exe -Start
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Startup: ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [4ef57929] rundll32.exe "C:\Windows\system32\gvreohjn.dll",b

________________


analyse ces fichiers sur virus total et si inféctés tu les rajoutes dans la citation de otmovit en plus de celui déjà mis
: http://www.virustotal.com/fr/


C:\Windows\System32\njhoervg.ini
C:\Windows\System32\fhyegyyi.dll
C:\Windows\System32\iyygeyhf.ini

______________


télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur http://up.sur-la-toile.com/sadW
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\Windows\System32\gvreohjn.dll


clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.


______________

vire ce qui est dans moved files en allant dans psote de travail puis C puis OTMOVIT

_________________

installe

SPYWAREBLASTER pour immuniser le système contre vundo que tu avais notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

http://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/28872.html

___________________

encore des pubs? .....

Résultat de OTMoveIt

DllUnregisterServer procedure not found in C:\Windows\System32\gvreohjn.dll
C:\Windows\System32\gvreohjn.dll NOT unregistered.
C:\Windows\System32\gvreohjn.dll moved successfully.
DllUnregisterServer procedure not found in C:\Windows\System32\fhyegyyi.dll
C:\Windows\System32\fhyegyyi.dll NOT unregistered.
C:\Windows\System32\fhyegyyi.dll moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06062008_195912

=)

Je te remercie en tout cas pour ton aide, à priori le virus est parti et plus de pub pendant que je surf :)
Merci encore !

pour virer ce que je t'ai fais utiliser:


Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

ps : pas besoin de m´envoyer le rapport si tout a ete supprimer ;-)





tu peux mettre resolu!

C'est bon tout est partis :)
Merci encore !

de rien