Ecran Bleu : Warning Spyware-VirusRésolu/Fermé

Question

Bonjour,
Depuis hier, j'ai un écran bleu avec comme message : Warning ! spyware detected on your computer! install an antivirus or spyware remover to clean your computer. 
De plus des fonctionnalités ont disparue (notamment acces au panneau de configuration et tous les programmes par le menu démarrer)
J'ai essayé Avast qui détecte de nombreuses choses lors du test mémoire mais qu'il ne peut pas supprimer

Je suis débutant en informatique, merci de m'indiquer la marche à suivre pour résoudre ce problème

Pour Info voici le rapport Hjiack This :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49: VIRUS ALERT!, on 14/08/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\WINDOWS\System32undll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\WINDOWS\System32\lxddcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Etchegoyen\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bewan.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [uwa6pcw] "C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SMrhcjd1j0eg65] C:\Program Fileshcjd1j0eg65hcjd1j0eg65.exe
O4 - HKLM\..\Run: [c8580075] rundll32.exe "C:\WINDOWS\System32\kjpnbbdh.dll",b
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: YesMessenger.lnk = C:\Program Files\YesMessenger\YesMessenger.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.bewan.com
O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.spywarestormer.com/files2/Install.cab
O16 - DPF: {2F003D51-39FD-4D18-9016-95CF70B92ABE} - http://download.movienetworks.com/install/US/altpmtscab.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5F4D3335-3194-4167-85AE-E7325F2695EF} - http://es6-scripts.dlv4.com/binaries/egaccess4/egaccess4_1068_em_XP.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - https://sdlc-esd.oracle.com/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab?GroupName=JSC&FilePath=/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab&BHost=javadl.sun.com&File=jinstall-6u6-windows-i586-jc.cab&AuthParam=1580964179_948ce1dd250aac19afc416e1e34a3af9&ext=.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://sunvegas.microgaming.com/frsunvegas/FlashAX2.cab
O20 - AppInit_DLLs: vdoozg.dll
O21 - SSODL: altmannsberger - {210b4043-35ca-4aa0-8796-191f9663dfb3} - (no file)
O21 - SSODL: featherweed - {ab340860-fd81-4a65-b345-82eb77a66b5e} - (no file)
O21 - SSODL: alaJmr - {C85800DB-62F2-AA71-FB84-69A6ADC2033F} - C:\WINDOWS\system32\ysz.dll
O22 - SharedTaskScheduler: {210b4043-35ca-4aa0-8796-191f9663dfb3} - altmannsberger - (no file)
O22 - SharedTaskScheduler: featherweed - {ab340860-fd81-4a65-b345-82eb77a66b5e} - (no file)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Firewall service (FWSvc) - Unknown owner - C:\Program Files\WinAntiVirus Pro 2006\FWSvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
O23 - Service: lxdd_device -   - C:\WINDOWS\System32\lxddcoms.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe (file missing)

Utilisateur anonyme · Answer

Salut,

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 




-> Double clique sur combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

Avant d'utiliser ComboFix : 

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. 

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message

Utilisateur anonyme · Answer

Copie le texte ci-dessous : 

File:: 
C:\WINDOWS\System32\mlJAtUKD.dll 
C:\Documents and Settings\Etchegoyen\.EXE 
C:\.EXE 
C:\WINDOWS\system32\mlJAtUKD.dll 
C:\WINDOWS\ateqoflr.exe 
C:\Program Files\Winsos\WINSOS.EXE
C:\10.1.19.109 

Folder:: 
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Winsos 
C:\Program Files\YesMessenger 

Registry:: 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6FC4541E-F704-48E9-B912-689DB6592993}] 
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"WINSOS VERIFY"=-

Driver::
Boonty Games





Ouvre le Bloc-Notes puis colle le texte copié. 
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) 
Sauvegarde ce fichier sous le nom de CFScript.txt

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous : 

http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis. 

S'il n'y a pas de rédémarrage, poste quand même les rapports.

haspandar · Answer

Txikitine merci encore, voici le rapport de l'autoscan ComboFixComboFix 08-08-13.05 - Etchegoyen 2008-08-15 0:04:34.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.79 [GMT 2:00] Endroit: C:\Documents and Settings\Etchegoyen\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Etchegoyen\Bureau\CFScript.txt * Création d'un nouveau point de restauration * Resident AV is active [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: C:\.EXE C:\10.1.19.109 C:\Documents and Settings\Etchegoyen\.EXE C:\Program Files\Winsos\WINSOS.EXE C:\WINDOWS\ateqoflr.exe C:\WINDOWS\System32\mlJAtUKD.dll C:\WINDOWS\system32\mlJAtUKD.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\.EXE C:\10.1.19.109 C:\Documents and Settings\Etchegoyen\.EXE C:\Program Files\Fichiers communs\BOONTY Shared C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe C:\Program Files\Winsos C:\Program Files\Winsos\AUTO.txt C:\Program Files\Winsos\BUY.HTM C:\Program Files\Winsos\connect.exe C:\Program Files\Winsos\defrag.log C:\Program Files\Winsos\flashlogiciel.swf C:\Program Files\Winsos\FOPTI.SWF C:\Program Files\Winsos\FSPY.SWF C:\Program Files\Winsos\FTRACE.SWF C:\Program Files\Winsos\gestion.REP C:\Program Files\Winsos\IMG38B.GIF C:\Program Files\Winsos\IMG38C.GIF C:\Program Files\Winsos\INVITE3.SWF C:\Program Files\Winsos\license us.txt C:\Program Files\Winsos\license.txt C:\Program Files\Winsos\LISTE.SOS C:\Program Files\Winsos\LOGO.GIF C:\Program Files\Winsos\Pass.txt C:\Program Files\Winsos\pays.txt C:\Program Files\Winsos\PSAPI.DLL C:\Program Files\Winsos un.htm C:\Program Files\Winsos\RUNDLL32.EXE C:\Program Files\Winsos\TEMP\TEMP.WDZ C:\Program Files\Winsos\unins000.dat C:\Program Files\Winsos\unins000.exe C:\Program Files\Winsos\unins001.dat C:\Program Files\Winsos\unins001.exe C:\Program Files\Winsos\unins002.dat C:\Program Files\Winsos\unins002.exe C:\Program Files\Winsos\unins003.dat C:\Program Files\Winsos\unins003.exe C:\Program Files\Winsos\update.exe C:\Program Files\Winsos\UPDATE\LISTE2.SOS C:\Program Files\Winsos\UPDATE\VIRAL2.SOS C:\Program Files\Winsos\VIDE.exe C:\Program Files\Winsos\WD120ACTION.DLL C:\Program Files\Winsos\WD120COD.DLL C:\Program Files\Winsos\WD120COM.DLL C:\Program Files\Winsos\WD120CPL.DLL C:\Program Files\Winsos\WD120ETAT.DLL C:\Program Files\Winsos\WD120GRF.DLL C:\Program Files\Winsos\WD120HTML.DLL C:\Program Files\Winsos\WD120IMG.DLL C:\Program Files\Winsos\WD120IMG2.DLL C:\Program Files\Winsos\WD120MAT.DLL C:\Program Files\Winsos\WD120OBJ.DLL C:\Program Files\Winsos\WD120OLE.DLL C:\Program Files\Winsos\WD120PDF.DLL C:\Program Files\Winsos\WD120PRN.DLL C:\Program Files\Winsos\WD120RTF.DLL C:\Program Files\Winsos\WD120STD.DLL C:\Program Files\Winsos\WD120TEST.DLL C:\Program Files\Winsos\WD120VM.DLL C:\Program Files\Winsos\WD120XLS.DLL C:\Program Files\Winsos\WD120XML.DLL C:\Program Files\Winsos\WD120ZIP.DLL C:\Program Files\Winsos\WEBSITE.url C:\Program Files\Winsos\Winsos.exe C:\Program Files\Winsos\Winsos.exe.lnk C:\Program Files\Winsos\WINSOS.ico C:\Program Files\Winsos\Winsos.url C:\Program Files\Winsos\winsosdefrag.exe C:\Program Files\Winsos\winsosinfo.txt C:\Program Files\YesMessenger C:\Program Files\YesMessenger\conditions.txt C:\Program Files\YesMessenger\hookTempsInactivite.dll C:\Program Files\YesMessenger\mfc42d.dll C:\Program Files\YesMessenger\MFCO42D.DLL C:\Program Files\YesMessenger\Msvcp60d.dll C:\Program Files\YesMessenger\MSVCRTD.DLL C:\Program Files\YesMessenger\unins000.dat C:\Program Files\YesMessenger\unins000.exe C:\Program Files\YesMessenger\YesMessenger.exe C:\Program Files\YesMessenger\Yesuninstall.exe C:\WINDOWS\ateqoflr.exe C:\WINDOWS\system32\akslwnqd.dll C:\WINDOWS\system32\DKUtAJlm.ini C:\WINDOWS\system32\DKUtAJlm.ini2 C:\WINDOWS\system32\dqnwlska.ini C:\WINDOWS\system32\erigawlr.dll C:\WINDOWS\system32\mlJAtUKD.dll C:\WINDOWS\system32\pvikfk.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_BOONTY_GAMES -------\Service_Boonty Games ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-14 to 2008-08-14 )))))))))))))))))))))))))))))))))))) . 2008-08-14 19:26 . 2008-08-14 19:26 131 --a------ C:\WINDOWS\ODBC.INI 2008-08-11 14:47 . 2008-08-11 14:47 d-------- C:\Documents and Settings\LocalService\Bureau 2008-07-25 21:43 . 2001-08-23 17:47 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-07-25 21:43 . 2001-08-23 17:47 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-07-25 20:04 . 2008-07-25 20:04 0 --a------ C:\WINDOWS\OpPrintServer.INI 2008-07-25 20:02 . 2008-08-07 17:20 d-------- C:\Program Files\Canon 2008-07-23 01:06 . 2008-07-23 01:06 d-------- C:\WINDOWS\system32\FlashAX2 2008-07-23 00:27 . 2008-07-23 00:27 d-------- C:\WINDOWS\system32\FlashAX 2008-07-23 00:26 . 2008-07-23 00:26 d-------- C:\MicroGaming 2008-07-23 00:26 . 2008-07-23 00:26 d-------- C:\Documents and Settings\All Users\Application Data\Microgaming 2008-07-23 00:26 . 2008-07-23 00:30 d-------- C:\Documents and Settings\All Users\Application Data\MGS 2008-07-17 12:25 . 2008-08-14 23:56 d-------- C:\Documents and Settings\Etchegoyen\Application Data\OpenOffice.org2 2008-07-17 11:58 . 2008-07-17 11:59 d-------- C:\Program Files\OpenOffice.org 2.4 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic 2008-08-13 16:19 --------- d-----w C:\Documents and Settings\Etchegoyen\Application Data\MegauploadToolbar 2008-08-13 12:45 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-08-07 15:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-25 21:55 --------- d-----w C:\Program Files\Lx_cats 2008-07-11 08:45 --------- d-----w C:\Documents and Settings\Etchegoyen\Application Data\FaxCtr 2008-06-28 17:42 --------- d-----w C:\Program Files\Java 2008-06-24 20:36 --------- d-----w C:\Program Files\Abbyy FineReader 6.0 Sprint 2008-06-16 16:35 --------- d-----w C:\Program Files\Alice 2008-05-31 15:01 309 ----a-w C:\Documents and Settings\Etchegoyen\pays.zip . ------- Sigcheck ------- 2004-08-20 01:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\svchost.exe md5deep: C:\WINDOWS\system32\svchost.exe: error at offset 0: Permission denied 2004-08-20 01:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\winlogon.exe md5deep: C:\WINDOWS\system32\winlogon.exe: error at offset 0: Permission denied md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied 2004-08-20 01:09 1036288 2a7bd330924252a2fd80344fc949bb72 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\explorer.exe 2004-08-20 01:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\services.exe md5deep: C:\WINDOWS\system32\services.exe: error at offset 0: Permission denied 2004-08-20 01:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\lsass.exe md5deep: C:\WINDOWS\system32\lsass.exe: error at offset 0: Permission denied . ((((((((((((((((((((((((((((( snapshot@2008-08-14_22.49.42.90 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-14 20:40:52 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-08-14 22:09:36 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-08-14 20:40:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-08-14 22:09:36 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2008-08-14 20:40:52 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-08-14 22:09:36 81,920 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-08-14 22:09:54 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4fc.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-20 18:41 266497] "Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 11:38 49152] "WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 11:56 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048] "lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-05-04 08:38 291760] "lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-03-05 09:40 20480] "FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-05-04 08:40 312240] "AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408] "c8580075"="C:\WINDOWS\System32\akslwnqd.dll" [BU] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 12:00 13312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "alaJmr"= {C85800DB-62F2-AA71-FB84-69A6ADC2033F} - C:\WINDOWS\system32\ysz.dll [2001-08-28 12:00 32768] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntivirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\drivers\avgntmgr.sys [2008-05-07 23:46] R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-07-19 16:35] R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2008-07-20 18:41] R2 lxdd_device;lxdd_device;C:\WINDOWS\System32\lxddcoms.exe [2007-04-26 07:21] R2 lxddCATSCustConnectService;lxddCATSCustConnectService;C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe [2007-04-26 07:21] R3 ati2mpaa;ati2mpaa;C:\WINDOWS\System32\DRIVERS\ati2mpaa.sys [2001-08-23 17:59] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' 2008-07-10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-WINSOS VERIFY - C:\Program Files\Winsos\WINSOS.EXE ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-15 00:10:14 Windows 5.1.2600 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . --------------------- DLLs a charg‚ sous des processus courants --------------------- PROCESS: C:\WINDOWS\explorer.exe -> ?:\WINDOWS\System32\CSCDLL.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\lxddserv.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.bin C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Temps d'accomplissement: 2008-08-15 0:16:16 - machine was rebooted [Etchegoyen] ComboFix-quarantined-files.txt 2008-08-14 22:16:04 ComboFix2.txt 2008-08-14 20:52:26 Pre-Run: 74,463,326,208 octets libres Post-Run: 74,424,299,520 octets libres 235 --- E O F --- 2008-05-23 20:13:12

Utilisateur anonyme · Answer

comment va le pc ??

refai un scan hijackthis et post le rapport stp

haspandar · Answer

Voici également le rapport hijackthis...Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49: VIRUS ALERT!, on 14/08/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\WINDOWS\System32undll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\WINDOWS\System32\lxddcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Etchegoyen\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bewan.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [uwa6pcw] "C:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SMrhcjd1j0eg65] C:\Program Fileshcjd1j0eg65hcjd1j0eg65.exe
O4 - HKLM\..\Run: [c8580075] rundll32.exe "C:\WINDOWS\System32\kjpnbbdh.dll",b
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: YesMessenger.lnk = C:\Program Files\YesMessenger\YesMessenger.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.bewan.com
O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.spywarestormer.com/files2/Install.cab
O16 - DPF: {2F003D51-39FD-4D18-9016-95CF70B92ABE} - http://download.movienetworks.com/install/US/altpmtscab.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5F4D3335-3194-4167-85AE-E7325F2695EF} - http://es6-scripts.dlv4.com/binaries/egaccess4/egaccess4_1068_em_XP.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - https://sdlc-esd.oracle.com/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab?GroupName=JSC&FilePath=/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab&BHost=javadl.sun.com&File=jinstall-6u6-windows-i586-jc.cab&AuthParam=1580964179_948ce1dd250aac19afc416e1e34a3af9&ext=.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://sunvegas.microgaming.com/frsunvegas/FlashAX2.cab
O20 - AppInit_DLLs: vdoozg.dll
O21 - SSODL: altmannsberger - {210b4043-35ca-4aa0-8796-191f9663dfb3} - (no file)
O21 - SSODL: featherweed - {ab340860-fd81-4a65-b345-82eb77a66b5e} - (no file)
O21 - SSODL: alaJmr - {C85800DB-62F2-AA71-FB84-69A6ADC2033F} - C:\WINDOWS\system32\ysz.dll
O22 - SharedTaskScheduler: {210b4043-35ca-4aa0-8796-191f9663dfb3} - altmannsberger - (no file)
O22 - SharedTaskScheduler: featherweed - {ab340860-fd81-4a65-b345-82eb77a66b5e} - (no file)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Firewall service (FWSvc) - Unknown owner - C:\Program Files\WinAntiVirus Pro 2006\FWSvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
O23 - Service: lxdd_device -   - C:\WINDOWS\System32\lxddcoms.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe (file missing)

Utilisateur anonyme · Answer

Telecharge malwarebytes 

-> http://www.malwarebytes.org/mbam/program/mbam-setup.exe 

Tu l´instale; le programme va se mettre automatiquement a jour. 

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression". 

Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet". 

Puis click sur "rechercher". 

Laisse le scanner le pc... 

Si des elements on ete trouvés > click sur supprimer la selection. 

si il t´es demandé de redemarrer > click sur "yes". 

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum. 
Copie et colle le rapport stp.

PS : les rapport sont aussi rangé dans l onglet rapport/log

haspandar · Answer

Voici le rapport log aprés ce nouveau scan assez long ComboFix 08-08-13.05 - Etchegoyen 2008-08-15 0:04:34.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.79 [GMT 2:00] Endroit: C:\Documents and Settings\Etchegoyen\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Etchegoyen\Bureau\CFScript.txt * Création d'un nouveau point de restauration * Resident AV is active [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: C:\.EXE C:\10.1.19.109 C:\Documents and Settings\Etchegoyen\.EXE C:\Program Files\Winsos\WINSOS.EXE C:\WINDOWS\ateqoflr.exe C:\WINDOWS\System32\mlJAtUKD.dll C:\WINDOWS\system32\mlJAtUKD.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\.EXE C:\10.1.19.109 C:\Documents and Settings\Etchegoyen\.EXE C:\Program Files\Fichiers communs\BOONTY Shared C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe C:\Program Files\Winsos C:\Program Files\Winsos\AUTO.txt C:\Program Files\Winsos\BUY.HTM C:\Program Files\Winsos\connect.exe C:\Program Files\Winsos\defrag.log C:\Program Files\Winsos\flashlogiciel.swf C:\Program Files\Winsos\FOPTI.SWF C:\Program Files\Winsos\FSPY.SWF C:\Program Files\Winsos\FTRACE.SWF C:\Program Files\Winsos\gestion.REP C:\Program Files\Winsos\IMG38B.GIF C:\Program Files\Winsos\IMG38C.GIF C:\Program Files\Winsos\INVITE3.SWF C:\Program Files\Winsos\license us.txt C:\Program Files\Winsos\license.txt C:\Program Files\Winsos\LISTE.SOS C:\Program Files\Winsos\LOGO.GIF C:\Program Files\Winsos\Pass.txt C:\Program Files\Winsos\pays.txt C:\Program Files\Winsos\PSAPI.DLL C:\Program Files\Winsos un.htm C:\Program Files\Winsos\RUNDLL32.EXE C:\Program Files\Winsos\TEMP\TEMP.WDZ C:\Program Files\Winsos\unins000.dat C:\Program Files\Winsos\unins000.exe C:\Program Files\Winsos\unins001.dat C:\Program Files\Winsos\unins001.exe C:\Program Files\Winsos\unins002.dat C:\Program Files\Winsos\unins002.exe C:\Program Files\Winsos\unins003.dat C:\Program Files\Winsos\unins003.exe C:\Program Files\Winsos\update.exe C:\Program Files\Winsos\UPDATE\LISTE2.SOS C:\Program Files\Winsos\UPDATE\VIRAL2.SOS C:\Program Files\Winsos\VIDE.exe C:\Program Files\Winsos\WD120ACTION.DLL C:\Program Files\Winsos\WD120COD.DLL C:\Program Files\Winsos\WD120COM.DLL C:\Program Files\Winsos\WD120CPL.DLL C:\Program Files\Winsos\WD120ETAT.DLL C:\Program Files\Winsos\WD120GRF.DLL C:\Program Files\Winsos\WD120HTML.DLL C:\Program Files\Winsos\WD120IMG.DLL C:\Program Files\Winsos\WD120IMG2.DLL C:\Program Files\Winsos\WD120MAT.DLL C:\Program Files\Winsos\WD120OBJ.DLL C:\Program Files\Winsos\WD120OLE.DLL C:\Program Files\Winsos\WD120PDF.DLL C:\Program Files\Winsos\WD120PRN.DLL C:\Program Files\Winsos\WD120RTF.DLL C:\Program Files\Winsos\WD120STD.DLL C:\Program Files\Winsos\WD120TEST.DLL C:\Program Files\Winsos\WD120VM.DLL C:\Program Files\Winsos\WD120XLS.DLL C:\Program Files\Winsos\WD120XML.DLL C:\Program Files\Winsos\WD120ZIP.DLL C:\Program Files\Winsos\WEBSITE.url C:\Program Files\Winsos\Winsos.exe C:\Program Files\Winsos\Winsos.exe.lnk C:\Program Files\Winsos\WINSOS.ico C:\Program Files\Winsos\Winsos.url C:\Program Files\Winsos\winsosdefrag.exe C:\Program Files\Winsos\winsosinfo.txt C:\Program Files\YesMessenger C:\Program Files\YesMessenger\conditions.txt C:\Program Files\YesMessenger\hookTempsInactivite.dll C:\Program Files\YesMessenger\mfc42d.dll C:\Program Files\YesMessenger\MFCO42D.DLL C:\Program Files\YesMessenger\Msvcp60d.dll C:\Program Files\YesMessenger\MSVCRTD.DLL C:\Program Files\YesMessenger\unins000.dat C:\Program Files\YesMessenger\unins000.exe C:\Program Files\YesMessenger\YesMessenger.exe C:\Program Files\YesMessenger\Yesuninstall.exe C:\WINDOWS\ateqoflr.exe C:\WINDOWS\system32\akslwnqd.dll C:\WINDOWS\system32\DKUtAJlm.ini C:\WINDOWS\system32\DKUtAJlm.ini2 C:\WINDOWS\system32\dqnwlska.ini C:\WINDOWS\system32\erigawlr.dll C:\WINDOWS\system32\mlJAtUKD.dll C:\WINDOWS\system32\pvikfk.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_BOONTY_GAMES -------\Service_Boonty Games ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-14 to 2008-08-14 )))))))))))))))))))))))))))))))))))) . 2008-08-14 19:26 . 2008-08-14 19:26 131 --a------ C:\WINDOWS\ODBC.INI 2008-08-11 14:47 . 2008-08-11 14:47 d-------- C:\Documents and Settings\LocalService\Bureau 2008-07-25 21:43 . 2001-08-23 17:47 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-07-25 21:43 . 2001-08-23 17:47 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-07-25 20:04 . 2008-07-25 20:04 0 --a------ C:\WINDOWS\OpPrintServer.INI 2008-07-25 20:02 . 2008-08-07 17:20 d-------- C:\Program Files\Canon 2008-07-23 01:06 . 2008-07-23 01:06 d-------- C:\WINDOWS\system32\FlashAX2 2008-07-23 00:27 . 2008-07-23 00:27 d-------- C:\WINDOWS\system32\FlashAX 2008-07-23 00:26 . 2008-07-23 00:26 d-------- C:\MicroGaming 2008-07-23 00:26 . 2008-07-23 00:26 d-------- C:\Documents and Settings\All Users\Application Data\Microgaming 2008-07-23 00:26 . 2008-07-23 00:30 d-------- C:\Documents and Settings\All Users\Application Data\MGS 2008-07-17 12:25 . 2008-08-14 23:56 d-------- C:\Documents and Settings\Etchegoyen\Application Data\OpenOffice.org2 2008-07-17 11:58 . 2008-07-17 11:59 d-------- C:\Program Files\OpenOffice.org 2.4 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic 2008-08-13 16:19 --------- d-----w C:\Documents and Settings\Etchegoyen\Application Data\MegauploadToolbar 2008-08-13 12:45 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-08-07 15:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-25 21:55 --------- d-----w C:\Program Files\Lx_cats 2008-07-11 08:45 --------- d-----w C:\Documents and Settings\Etchegoyen\Application Data\FaxCtr 2008-06-28 17:42 --------- d-----w C:\Program Files\Java 2008-06-24 20:36 --------- d-----w C:\Program Files\Abbyy FineReader 6.0 Sprint 2008-06-16 16:35 --------- d-----w C:\Program Files\Alice 2008-05-31 15:01 309 ----a-w C:\Documents and Settings\Etchegoyen\pays.zip . ------- Sigcheck ------- 2004-08-20 01:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\svchost.exe md5deep: C:\WINDOWS\system32\svchost.exe: error at offset 0: Permission denied 2004-08-20 01:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\winlogon.exe md5deep: C:\WINDOWS\system32\winlogon.exe: error at offset 0: Permission denied md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied 2004-08-20 01:09 1036288 2a7bd330924252a2fd80344fc949bb72 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\explorer.exe 2004-08-20 01:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\services.exe md5deep: C:\WINDOWS\system32\services.exe: error at offset 0: Permission denied 2004-08-20 01:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\lsass.exe md5deep: C:\WINDOWS\system32\lsass.exe: error at offset 0: Permission denied . ((((((((((((((((((((((((((((( snapshot@2008-08-14_22.49.42.90 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-14 20:40:52 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-08-14 22:09:36 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-08-14 20:40:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-08-14 22:09:36 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2008-08-14 20:40:52 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-08-14 22:09:36 81,920 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-08-14 22:09:54 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4fc.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-20 18:41 266497] "Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 11:38 49152] "WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 11:56 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048] "lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-05-04 08:38 291760] "lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-03-05 09:40 20480] "FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-05-04 08:40 312240] "AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408] "c8580075"="C:\WINDOWS\System32\akslwnqd.dll" [BU] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 12:00 13312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "alaJmr"= {C85800DB-62F2-AA71-FB84-69A6ADC2033F} - C:\WINDOWS\system32\ysz.dll [2001-08-28 12:00 32768] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntivirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\drivers\avgntmgr.sys [2008-05-07 23:46] R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-07-19 16:35] R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2008-07-20 18:41] R2 lxdd_device;lxdd_device;C:\WINDOWS\System32\lxddcoms.exe [2007-04-26 07:21] R2 lxddCATSCustConnectService;lxddCATSCustConnectService;C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe [2007-04-26 07:21] R3 ati2mpaa;ati2mpaa;C:\WINDOWS\System32\DRIVERS\ati2mpaa.sys [2001-08-23 17:59] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' 2008-07-10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-WINSOS VERIFY - C:\Program Files\Winsos\WINSOS.EXE ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-15 00:10:14 Windows 5.1.2600 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . --------------------- DLLs a charg‚ sous des processus courants --------------------- PROCESS: C:\WINDOWS\explorer.exe -> ?:\WINDOWS\System32\CSCDLL.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\lxddserv.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.bin C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Temps d'accomplissement: 2008-08-15 0:16:16 - machine was rebooted [Etchegoyen] ComboFix-quarantined-files.txt 2008-08-14 22:16:04 ComboFix2.txt 2008-08-14 20:52:26 Pre-Run: 74,463,326,208 octets libres Post-Run: 74,424,299,520 octets libres 235 --- E O F --- 2008-05-23 20:13:12

haspandar · Answer

Aprés un rapide scan avec malwarebyte's antimalware voici le rapport,que dois je faire car l'écran reste toujours bleu?
Merci pour réponseMalwarebytes' Anti-Malware 1.24
Version de la base de données: 1053
Windows 5.1.2600 

11:12:43 15/08/2008
mbam-log-8-15-2008 (11-12-43).txt

Type de recherche: Examen rapide
Eléments examinés: 38867
Temps écoulé: 6 minute(s), 26 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcjd1j0eg65 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcjd1j0eg65 (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\backupwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UERSV_0001_N91S2108NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Etchegoyen\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

C EST le rapport  malewarebyte qu il faut

réouvre malewarebyte
va sur rapport/log
post le rapport apre suppression

Utilisateur anonyme · Answer

ok comment va le pc ??

reouvre malewarebyte
va sur quarntaine
supprime tout

refais un scan hijackthis et post le rapport stp

haspandar · Answer

Voici le dernier rapport malware aprés scan approfondi et avant examen hijackthis que je fais aprés ce message,le p.c va mieux!Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1053
Windows 5.1.2600 

12:13:25 15/08/2008
mbam-log-8-15-2008 (12-13-25).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|)
Eléments examinés: 71578
Temps écoulé: 41 minute(s), 46 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 35

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\QooBox\Quarantine\C\WINDOWS\ateqoflr.exe.vir (Trojan.Vapsup) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\edpw.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\wbqxfpgl.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\Downloaded Program Files\UERSV_0001_N91S2108NetInstaller.exe.vir (Rogue.Installer) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\akslwnqd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\awtrQJBS.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\davlgqjf.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\erigawlr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\khfGvwtq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\kjpnbbdh.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\mlJAtUKD.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\pvikfk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\qpsmtksr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32	uvUMgeE.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vdoozg.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\wvUnMdEV.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\wxneqe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP104\A0112908.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP151\A0136971.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138132.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138136.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138137.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138138.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138140.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138141.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138142.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138143.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138144.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138147.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP152\A0138139.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP154\A0138349.exe (Trojan.Vapsup) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP154\A0138350.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP154\A0138352.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP154\A0138353.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F4BDAA1-F77F-4B7C-A4E8-D89569986B3A}\RP154\A0138354.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

reouvre malewarebyte 
va sur quarntaine 
supprime tout 

refais un scan hijackthis et post le rapport stp

haspandar · Answer

Quarantaine de malware supprimée,je joiLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22, on 15/08/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\WINDOWS\System32\lxddcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Etchegoyen\Bureau\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [c8580075] rundll32.exe "C:\WINDOWS\System32\akslwnqd.dll",b
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: YesMessenger.lnk = C:\Program Files\YesMessenger\YesMessenger.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.bewan.com
O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab
O16 - DPF: {2F003D51-39FD-4D18-9016-95CF70B92ABE} - http://download.movienetworks.com/install/US/altpmtscab.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - https://sdlc-esd.oracle.com/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab?GroupName=JSC&FilePath=/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab&BHost=javadl.sun.com&File=jinstall-6u6-windows-i586-jc.cab&AuthParam=1580964179_948ce1dd250aac19afc416e1e34a3af9&ext=.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://sunvegas.microgaming.com/frsunvegas/FlashAX2.cab
O21 - SSODL: alaJmr - {C85800DB-62F2-AA71-FB84-69A6ADC2033F} - C:\WINDOWS\system32\ysz.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
O23 - Service: lxdd_device -   - C:\WINDOWS\System32\lxddcoms.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe (file missing)

Utilisateur anonyme · Answer

Copie le texte ci-dessous : 

File:: 
C:\WINDOWS\System32\akslwnqd.dll
C:\WINDOWS\system32\ysz.dll 

Registry:: 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"c8580075"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 
"alaJmr"=-


Ouvre le Bloc-Notes puis colle le texte copié. 
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) 
Sauvegarde ce fichier sous le nom de CFScript.txt

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous : 

http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis. 

S'il n'y a pas de rédémarrage, poste quand même les rapports.

haspandar · Answer

Chiquitine il y a bien eu redémarrage aprés le scan combofix voici le rapport.Je retourne ensuite dans hijackthis pour envoyer le rapport.ComboFix 08-08-14.03 - Etchegoyen 2008-08-15 13:44:41.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.94 [GMT 2:00] Endroit: C:\Documents and Settings\Etchegoyen\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Etchegoyen\Bureau\CFScript.txt * Création d'un nouveau point de restauration * Resident AV is active [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: C:\WINDOWS\System32\akslwnqd.dll C:\WINDOWS\system32\ysz.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ysz.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-15 to 2008-08-15 )))))))))))))))))))))))))))))))))))) . 2008-08-15 00:36 . 2008-08-15 00:36 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-15 00:36 . 2008-08-15 00:36 d-------- C:\Documents and Settings\Etchegoyen\Application Data\Malwarebytes 2008-08-15 00:36 . 2008-08-15 00:36 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-15 00:36 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-15 00:36 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-14 19:26 . 2008-08-14 19:26 131 --a------ C:\WINDOWS\ODBC.INI 2008-08-11 14:47 . 2008-08-11 14:47 d-------- C:\Documents and Settings\LocalService\Bureau 2008-07-25 21:43 . 2001-08-23 17:47 146,944 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-07-25 21:43 . 2001-08-23 17:47 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-07-25 20:04 . 2008-07-25 20:04 0 --a------ C:\WINDOWS\OpPrintServer.INI 2008-07-25 20:02 . 2008-08-07 17:20 d-------- C:\Program Files\Canon 2008-07-23 01:06 . 2008-07-23 01:06 d-------- C:\WINDOWS\system32\FlashAX2 2008-07-23 00:27 . 2008-07-23 00:27 d-------- C:\WINDOWS\system32\FlashAX 2008-07-23 00:26 . 2008-07-23 00:26 d-------- C:\MicroGaming 2008-07-23 00:26 . 2008-07-23 00:26 d-------- C:\Documents and Settings\All Users\Application Data\Microgaming 2008-07-23 00:26 . 2008-07-23 00:30 d-------- C:\Documents and Settings\All Users\Application Data\MGS 2008-07-17 12:25 . 2008-08-15 12:29 d-------- C:\Documents and Settings\Etchegoyen\Application Data\OpenOffice.org2 2008-07-17 11:58 . 2008-07-17 11:59 d-------- C:\Program Files\OpenOffice.org 2.4 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-13 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition classic 2008-08-13 16:19 --------- d-----w C:\Documents and Settings\Etchegoyen\Application Data\MegauploadToolbar 2008-08-13 12:45 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-08-07 15:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-25 21:55 --------- d-----w C:\Program Files\Lx_cats 2008-07-11 08:45 --------- d-----w C:\Documents and Settings\Etchegoyen\Application Data\FaxCtr 2008-06-28 17:42 --------- d-----w C:\Program Files\Java 2008-06-24 20:36 --------- d-----w C:\Program Files\Abbyy FineReader 6.0 Sprint 2008-06-16 16:35 --------- d-----w C:\Program Files\Alice 2008-05-31 15:01 309 ----a-w C:\Documents and Settings\Etchegoyen\pays.zip . ------- Sigcheck ------- 2004-08-20 01:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\svchost.exe 2001-08-28 12:00 15872 480918f7961f8256059e58e99ad71aeb C:\WINDOWS\system32\svchost.exe 2004-08-20 01:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\winlogon.exe 2001-08-28 12:00 438272 be93baaaf2149ea919515fa37cde79e4 C:\WINDOWS\system32\winlogon.exe 2001-08-28 12:00 1008128 4d8f60bd0d9d34a187392e97a4f84540 C:\WINDOWS\explorer.exe 2004-08-20 01:09 1036288 2a7bd330924252a2fd80344fc949bb72 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\explorer.exe 2004-08-20 01:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\services.exe 2001-08-28 12:00 103936 223fe98008318957ce74285d3685e1e3 C:\WINDOWS\system32\services.exe 2004-08-20 01:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\lsass.exe 2001-08-28 12:00 13312 de52a425c8dd2a17862a38272b00372e C:\WINDOWS\system32\lsass.exe . ((((((((((((((((((((((((((((( snapshot@2008-08-14_22.49.42.90 ))))))))))))))))))))))))))))))))))))))))) . - 2008-08-14 20:40:52 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-08-15 11:49:08 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-08-14 20:40:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-08-15 11:49:08 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2008-08-14 20:40:52 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-08-15 11:49:08 81,920 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2008-08-14 20:33:01 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile tuser.dat + 2008-08-15 11:44:11 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile tuser.dat + 2008-08-15 11:48:45 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4d4.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-20 18:41 266497] "Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 11:38 49152] "WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2003-04-02 04:20 12288] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 11:56 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048] "lxddmon.exe"="C:\Program Files\Lexmark 2500 Series\lxddmon.exe" [2007-05-04 08:38 291760] "lxddamon"="C:\Program Files\Lexmark 2500 Series\lxddamon.exe" [2007-03-05 09:40 20480] "FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-05-04 08:40 312240] "AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57 81408] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 12:00 13312] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntivirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\drivers\avgntmgr.sys [2008-05-07 23:46] R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-07-19 16:35] R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2008-07-20 18:41] R2 lxdd_device;lxdd_device;C:\WINDOWS\System32\lxddcoms.exe [2007-04-26 07:21] R2 lxddCATSCustConnectService;lxddCATSCustConnectService;C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe [2007-04-26 07:21] R3 ati2mpaa;ati2mpaa;C:\WINDOWS\System32\DRIVERS\ati2mpaa.sys [2001-08-23 17:59] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-15 13:48:57 Windows 5.1.2600 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.bin C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\lxddserv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Temps d'accomplissement: 2008-08-15 13:56:39 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-15 11:56:28 ComboFix2.txt 2008-08-14 22:16:17 ComboFix3.txt 2008-08-14 20:52:26 Pre-Run: 74,430,337,024 octets libres Post-Run: 74,419,404,800 octets libres 137 --- E O F --- 2008-05-23 20:13:12

haspandar · Answer

Voici le rapport hijackthis...Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:01, on 15/08/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\WINDOWS\System32\lxddcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Etchegoyen\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: YesMessenger.lnk = C:\Program Files\YesMessenger\YesMessenger.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.bewan.com
O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab
O16 - DPF: {2F003D51-39FD-4D18-9016-95CF70B92ABE} - http://download.movienetworks.com/install/US/altpmtscab.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - https://sdlc-esd.oracle.com/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab?GroupName=JSC&FilePath=/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab&BHost=javadl.sun.com&File=jinstall-6u6-windows-i586-jc.cab&AuthParam=1580964179_948ce1dd250aac19afc416e1e34a3af9&ext=.cab
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://sunvegas.microgaming.com/frsunvegas/FlashAX2.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
O23 - Service: lxdd_device -   - C:\WINDOWS\System32\lxddcoms.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe (file missing)

Utilisateur anonyme · Answer

réouvre hijackthis 
fais scan only
coches ces lignes 

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') 

O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab 
O16 - DPF: {2F003D51-39FD-4D18-9016-95CF70B92ABE} - http://download.movienetworks.com/install/US/altpmtscab.cab 
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab 
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx 
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - https://sdlc-esd.oracle.com/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab?GroupName=JSC&FilePath=/ESD42/JSCDL/jre/6u6-b90/jinstall-6u6-windows-i586-jc.cab&BHost=javadl.sun.com&File=jinstall-6u6-windows-i586-jc.cab&AuthParam=1580964179_948ce1dd250aac19afc416e1e34a3af9&ext=.cab 
O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab 
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab 
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab 
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://sunvegas.microgaming.com/frsunvegas/FlashAX2.cab 


tu les coches et tu clic sur fix checked 

ensuite fais ceci :

Démarrer > executer > tape : services.msc 

- Clic droit sur le service cité - PC Tools AntiVirus Engine 
- propriétés 
- et dans "type de démarrage" et mets le sur « désactivé ». 
- Ensuite si le "Status du service" est sur "Démarré" faire : « arrêté » 

Tutorial : https://www.zebulon.fr/dossiers/windows/31-services.html 



ensuite tu as 2 antivirus , désinstal avast :

Pour désinstaller Avast telecharge cet outil

https://www.avast.com/fr-fr/uninstall-utility


désinstal java car pas a jours et telecharge et instal cette version :

https://sdlc-esd.oracle.com/ESD44/JSCDL/jdk/6u7/jre-6u7-windows-i586-p-s.exe?GroupName=JSC&FilePath=/ESD44/JSCDL/jdk/6u7/jre-6u7-windows-i586-p-s.exe&BHost=javadl.sun.com&File=jre-6u7-windows-i586-p-s.exe&AuthParam=1580978146_46494a57fbc0e7c89e79cfb72e28cd3a&ext=.exe


met internet explorer a jousr : 


IE 7 : ftp://ftp.telecharger.com/01net/IE7Setup.exe


ensuite :

-> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo): 


http://download.piriform.com/ccsetup210.exe

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

-> Tuto : https://www.malekal.com/tutoriel-ccleaner/


ensuite :

telecharge et instal regcleaner: 

http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html 

tutorial : https://www.malekal.com/nettoyer-sa-base-de-registre-avec-windows-registry-cleaner/



ensuite :

* pour supprimer les outils/fix utilisés : 

Télécharge ToolsCleaner sur ton bureau. 
--> 
ftp://ftp.commentcamarche.com/download/ToolsCleaner2.exe
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
http://pc-system.fr/ 

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

et fais ceci :

Désactive et réactive ta restauration system

Tuto xp : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

haspandar · Answer

J'ai fait toutes les opérations saurf mise a jour du paquet java( incompatible),dans le rapport toolcleaner il y a une erreur de suppressio-->- Recherche: 

C:\Qoobox: trouvé !
C:\Documents and Settings\Etchegoyen\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Etchegoyen\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Etchegoyen\Recent\HijackThis.lnk: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\Etchegoyen\Bureau\ComboFix.exe: Erreur de suppression !
C:\Documents and Settings\Etchegoyen\Bureau\HijackThis.exe: supprimé !
C:\Documents and Settings\Etchegoyen\Recent\HijackThis.lnk: supprimé !
C:\Qoobox: supprimé !

Point de restauration crée !
Corbeille vidée!
Fichiers temporaires nettoyés !
Sauvegarde du registre crée!n.Dois je tout de meme activer et désactiver un point de restauration?

Utilisateur anonyme · Answer

Dois je tout de meme activer et désactiver un point de restauration

oui c est important 

supprime combofix manuellement 

pour java va ici :https://www.java.com/fr/download/manual.jsp

si tu n as pas d autres soucis change le statut du sujet en resolu stp

http://www.commentcamarche.net/faq/sujet 11365 marquer un fil de discussion comme etant resolu



--A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                   Bonne écoute 
                   @ + TChiki.

Ecran Bleu : Warning Spyware-Virus

19 réponses

Discussions similaires

Newsletters