virus detecté au demarrage de IERésolu/Fermé

Question

Bonjour,

j'ai un probleme sur IE7, à chaque fois que je lance IE7 mon ativirus avast 4.8 - 1229 detecte des virus sur mon repertoire la où il ya windows
F:WINDOWS\system32\rqRIBxWx.dll  contains sample of w:32 trojan-gen
F:WINDOWS\system32\rqRIBxWx.dll  ................................................

j'ai effectuer 6fois supprimer pour permetre au page visité d'ouvrir. mais après rédemarrage tout ça revient.

svp SOS

Destrio5 · Answer

Salut,

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

bona_2 · Answer

Salut,
merci de ton aide je vais telecharger Combofix,

A+

bona_2 · Answer

salut,
le rapport de combofix, mais apparement le virus ne revient plus après le lancement de combofix
ComboFix 08-09-20.05 - user 2008-09-22 10:59:35.2 - [color=red][b]FAT32[/b][/color]x86
Lancé depuis: F:\Documents and Settings\user\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\Program Files\PCHealthCenter\sc.html . . . . impossible à supprimer
.
---- Previous Run -------
.
F:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
F:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
F:\Program Files\PCHealthCenter\[u]0[/u].gif
F:\Program Files\PCHealthCenter\1.gif
F:\Program Files\PCHealthCenter\1.ico
F:\Program Files\PCHealthCenter\2.gif
F:\Program Files\PCHealthCenter\2.ico
F:\Program Files\PCHealthCenter\3.gif
F:\Program Files\PCHealthCenter\5.exe
F:\WINDOWS\system32\byXPhfFy.dll
F:\WINDOWS\system32\cbXNEVmL.dll
F:\WINDOWS\system32\mcrh.tmp
F:\WINDOWS\system32\rqRIbxwX.dll
F:\WINDOWS\system32\XwxbIRqr.ini
F:\WINDOWS\system32\XwxbIRqr.ini2
F:\Program Files\PCHealthCenter\sc.html . . . . impossible à supprimer

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_SysLibrary

((((((((((((((((((((((((((((( Fichiers créés du 2008-08-22 au 2008-09-22 ))))))))))))))))))))))))))))))))))))
.

2008-09-22 10:10 . 2008-09-22 10:50 970,082 ---hs---- F:\WINDOWS\system32\qsipvibi.ini
2008-09-22 10:10 . 2008-09-22 10:10 103,552 --a------ F:\WINDOWS\system32\ibivpisq.dll
2008-09-19 14:22 . 2008-09-22 09:05 969,962 ---hs---- F:\WINDOWS\system32\fqjuvatn.ini
2008-09-18 13:44 . 2008-09-18 13:44 <REP> d-------- F:\Documents and Settings\user\Application Data\Radmin Communication Client
2008-09-18 10:02 . 2008-09-19 14:19 969,722 ---hs---- F:\WINDOWS\system32\yjcyrhba.ini
2008-09-18 09:54 . 2008-09-18 09:54 <REP> d-------- F:\Program Files\Runtime Software
2008-09-18 09:47 . 2008-09-18 09:47 <REP> d-------- F:\Program Files\PCHealthCenter
2008-09-16 16:59 . 2008-09-16 16:59 <REP> d-------- F:\Documents and Settings\Administrator\Application Data\Radmin Communication Client
2008-09-16 16:58 . 2008-09-16 16:58 <REP> d-------- F:\Program Files\Radmin Communication Client 3.0
2008-09-16 16:42 . 2008-09-16 16:42 <REP> d-------- F:\Program Files\PCNetSoftware
2008-09-16 15:51 . 2007-10-18 20:48 83,288 --a------ F:\WINDOWS\system32\LMIRfsClientNP.dll
2008-09-16 15:51 . 2007-10-18 20:47 75,064 --a------ F:\WINDOWS\system32\LMIinit.dll
2008-09-16 15:51 . 2007-09-12 10:20 46,112 --a------ F:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2008-09-16 15:51 . 2007-10-18 20:47 21,496 --a------ F:\WINDOWS\system32\LMIport.dll
2008-09-16 15:50 . 2008-09-16 15:50 <REP> d-------- F:\Program Files\LogMeIn
2008-09-16 15:02 . 2008-09-16 15:02 <REP> d-------- F:\Program Files\UltraVNC
2008-09-11 08:56 . 2008-09-11 08:56 268 --ah----- F:\sqmdata13.sqm
2008-09-11 08:56 . 2008-09-11 08:56 244 --ah----- F:\sqmnoopt13.sqm
2008-09-09 15:31 . 2008-09-09 15:31 <REP> d-------- F:\Program Files\VirginMega
2008-09-09 15:11 . 2008-09-09 15:11 <REP> d-------- F:\Program Files\Windows Media Connect 2
2008-09-09 14:45 . 2008-09-09 14:45 <REP> d-------- F:\WINDOWS\system32\drivers\umdf
2008-09-09 10:34 . 2008-09-09 10:34 <REP> d--h----- F:\WINDOWS\$hf_mig$
2008-09-08 09:26 . 2008-09-08 09:26 <REP> d-------- F:\Program Files\Intelore
2008-09-05 16:08 . 2008-09-05 16:08 <REP> d--hs---- F:\FOUND.000
2008-09-05 16:02 . 2008-09-05 16:02 <REP> d-------- F:\Documents and Settings\user\Application Data\ZIP RAR ACE Password Recovery
2008-09-05 15:43 . 2008-09-05 15:43 <REP> d-------- F:\Program Files\RAR Password Cracker
2008-09-05 15:35 . 2008-09-05 15:35 <REP> d-------- F:\Program Files\Active Data Recovery Software
2008-09-04 15:18 . 2008-09-04 15:18 12 --a------ F:\WINDOWS\system32\usbsys.tmp
2008-09-03 16:50 . 2008-09-03 16:50 <REP> d--hs---- F:\Documents and Settings\Administrator\UserData
2008-09-03 16:46 . 2008-09-03 16:46 <REP> d-------- F:\Documents and Settings\Administrator\Application Data\TopLang
2008-09-02 15:53 . 2008-09-02 15:53 <REP> d-------- F:\Program Files\Desktop Lock
2008-09-02 15:16 . 2008-09-02 15:16 <REP> d-------- F:\Documents and Settings\user\Application Data\TopLang
2008-09-02 14:43 . 2008-09-04 11:08 2,197 --a------ F:\WINDOWS\kmuusb.sys
2008-09-02 14:43 . 2008-09-04 11:08 6 --a------ F:\WINDOWS\kmuudr.sys
2008-09-02 14:42 . 2008-09-02 14:42 <REP> d-------- F:\Documents and Settings\All Users\Application Data\MyUSBOnly
2008-09-02 13:45 . 2008-09-02 13:45 <REP> d--hs---- F:\Program Files\KGB
2008-09-02 13:45 . 2008-09-02 13:45 <REP> d--hs---- F:\Documents and Settings\All Users\Application Data\MPK
2008-09-02 13:45 . 2008-09-02 13:45 480 --a------ F:\WINDOWS\system32\runkgb.lnk
2008-08-27 09:26 . 2008-08-27 09:26 268 --ah----- F:\sqmdata12.sqm
2008-08-27 09:26 . 2008-08-27 09:26 244 --ah----- F:\sqmnoopt12.sqm

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 08:02 18,030 ----a-w F:\WINDOWS\system32\drivers\DeskLock.sys
2008-08-20 11:30 --------- d-----w F:\Program Files\PDF2Word v1.6
2008-08-18 12:27 --------- d-----w F:\Documents and Settings\Administrator\Application Data\Babylon
2008-08-08 10:57 --------- d-----w F:\Program Files\EasyPHP1-8
2008-08-08 09:58 --------- d-----w F:\Program Files\IDAutomation.com Code 39 Free Font
2008-08-08 06:47 --------- d-----w F:\Program Files\Microsoft Silverlight
2008-08-05 11:02 --------- d-----w F:\Program Files\[u]0[/u]1-mp3search
2008-08-04 12:00 --------- d-----w F:\Program Files\myBabylon
2008-08-04 12:00 --------- d-----w F:\Program Files\Conduit
2008-08-04 12:00 --------- d-----w F:\Program Files\Babylon
2008-08-04 11:45 --------- d-----w F:\Documents and Settings\user\Application Data\Babylon
2008-08-04 11:45 --------- d-----w F:\Documents and Settings\All Users\Application Data\Babylon
2008-07-29 06:42 --------- d-----w F:\Program Files\Opera
2008-07-24 07:49 --------- d-----w F:\Program Files\Trend Micro
2008-07-24 06:40 --------- d-----w F:\Program Files\Navilog1
2008-05-28 11:59 33 ----a-w F:\Documents and Settings\user\Application Data\pwcpsw.dat
2007-12-07 13:51 92,064 ----a-w F:\Documents and Settings\user\mqdmmdm.sys
2007-12-07 13:51 9,232 ----a-w F:\Documents and Settings\user\mqdmmdfl.sys
2007-12-07 13:51 79,328 ----a-w F:\Documents and Settings\user\mqdmserd.sys
2007-12-07 13:51 66,656 ----a-w F:\Documents and Settings\user\mqdmbus.sys
2007-12-07 13:51 6,208 ----a-w F:\Documents and Settings\user\mqdmcmnt.sys
2007-12-07 13:51 5,936 ----a-w F:\Documents and Settings\user\mqdmwhnt.sys
2007-12-07 13:51 4,048 ----a-w F:\Documents and Settings\user\mqdmcr.sys
2007-12-07 13:51 25,600 ----a-w F:\Documents and Settings\user\usbsermptxp.sys
2007-12-07 13:51 22,768 ----a-w F:\Documents and Settings\user\usbsermpt.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "F:\Program Files\myBabylon\tbmyBa.dll" [2008-02-14 1555480]

[HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]
2008-02-14 14:54 1555480 --a------ F:\Program Files\myBabylon\tbmyBa.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{34ea1c70-42cc-42c5-aa29-ec58b95a343e}"= "F:\Program Files\myBabylon\tbmyBa.dll" [2008-02-14 1555480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{34EA1C70-42CC-42C5-AA29-EC58B95A343E}"= "F:\Program Files\myBabylon\tbmyBa.dll" [2008-02-14 1555480]

[HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="F:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"PcSync"="F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]
"Yahoo! Pager"="F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 222080]
"USB_FW"="F:\Program Files\Net Studio\USB_FW.exe" [2008-05-21 1299968]
"SuperCopier2.exe"="F:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCSuiteTrayApplication"="F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 229376]
"HP SchedIndexer"="F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe" [2001-02-19 86016]
"HP AutoIndexer"="F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe" [2001-02-19 77824]
"NeroFilterCheck"="F:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"COMODO Firewall Pro"="F:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-03 1115728]
"!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-06-19 6731312]
"TkBellExe"="F:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-06-18 185896]
"Babylon Client"="F:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [2007-12-20 3116768]
"Desktop Lock Loader"="F:\PROGRA~1\DESKTO~1\TLDL.EXE" [2008-05-02 151552]
"LogMeIn GUI"="F:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-09-12 63048]
"091a0f74"="F:\WINDOWS\system32\ibivpisq.dll" [2008-09-22 103552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Mpk.exe"="F:\Program Files\KGB\Mpk.exe" [2007-10-22 1281536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LoginPrompt"= 9E8C8182988584
"NoViewOnDrive"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2007-10-18 20:47 75064 F:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"F:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"F:\\Program Files\\Messenger\\msmsgs.exe"=
"F:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"F:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"F:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"F:\\Program Files\\MSN Messenger\\MsnMsgr.Exe"=
"F:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 aswSP;avast! Self Protection;F:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 DeskLock;DeskLock;F:\WINDOWS\system32\drivers\DeskLock.sys [2008-09-22 18030]
R2 aswFsBlk;aswFsBlk;F:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;F:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 46112]
R2 PoliceService;PoliceService;F:\WINDOWS\system32\srksrv.exe [2006-06-03 453120]
S2 LMIInfo;LogMeIn Kernel Information Provider;F:\Program Files\LogMeIn\x86\RaInfo.sys [2007-09-12 12992]
S3 MiniScanEye;MiniScanEye;F:\WINDOWS\system32\Drivers\minsceye.sys [2005-02-16 14382]
S3 pendfu;PenDfu (pendfu.sys);F:\WINDOWS\system32\Drivers\pendfu.sys [2005-02-14 32408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5aaead9b-6ec0-11dd-a6c8-00e04cb7960a}]
\Shell\Auto\command - lsass.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6bb002c4-2b22-11dd-83ed-00e04cb7960a}]
\Shell\Auto\command - explorer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbf8b040-4278-11dd-8439-00e04cb7960a}]
\Shell\Auto\command - I:\explorer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbf8b041-4278-11dd-8439-00e04cb7960a}]
\Shell\Auto\command - J:\explorer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fede5216-1b47-11dd-83c9-00e04cb7960a}]
\Shell\Auto\command - I:\lsass.exe
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{0366ADA7-0907-43FC-893B-588F3E32FE40} - F:\WINDOWS\system32\rqRIbxwX.dll
BHO-{52A96517-3690-45C7-98A9-1DD379F9D9B5} - F:\WINDOWS\system32\cbXNEVmL.dll
HKCU-Run-RocketDock - F:\Program Files\RocketDock\RocketDock.exe
ShellExecuteHooks-{52A96517-3690-45C7-98A9-1DD379F9D9B5} - F:\WINDOWS\system32\cbXNEVmL.dll

.
------- Examen supplémentaire -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
O8 -: E&xporter vers Microsoft Excel - F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 -: Translate with &Babylon - F:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O17 -: HKLM\CCS\Interface\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer = 62.56.162.33,62.56.240.40
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 11:06:05
Windows 5.1.2600 Service Pack 3 FAT NTAPI

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mchInjDrv]
"ImagePath"="\??\F:\DOCUME~1\user\LOCALS~1\Temp\mc22.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

PROCESSUS: F:\WINDOWS\explorer.exe
-> F:\WINDOWS\system32\ibivpisq.dll
.
------------------------ Autres processus actifs ------------------------
.
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\Comodo\Firewall\cmdagent.exe
F:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
F:\WINDOWS\system32\rundll32.exe
F:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
F:\WINDOWS\system32\INTERNAT.EXE
.
**************************************************************************
.
Heure de fin: 2008-09-22 11:13:40 - La machine a redémarré [user]
ComboFix-quarantined-files.txt 2008-09-22 08:13:30

Avant-CF: 1,149,788,160 octets libres
Après-CF: 1,131,134,976 octets libres

240

Merci et a+

Destrio5 · Answer

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

bona_2 · Answer

rapport du mbam

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1190
Windows 5.1.2600 Service Pack 3

22/09/2008 15:45:01
mbam-log-2008-09-22 (15-44-50).txt

Type de recherche: Examen rapide
Eléments examinés: 52359
Temps écoulé: 5 minute(s), 13 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
F:\WINDOWS\system32\ibivpisq.dll (Trojan.Vundo) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SysLibrary (Rootkit.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\091a0f74 (Trojan.Vundo.H) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
F:\Program Files\PCHealthCenter (Trojan.Fakealert) -> No action taken.

Fichier(s) infecté(s):
F:\WINDOWS\system32\ibivpisq.dll (Trojan.Vundo.H) -> No action taken.
F:\WINDOWS\system32\qsipvibi.ini (Trojan.Vundo.H) -> No action taken.
F:\WINDOWS\system32\CMDOW.EXE (Malware.Tool) -> No action taken.
F:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> No action taken.

Destrio5 · Answer

Tu as cliqué sur Supprimer la sélection ?

bona_2 · Answer

bien sur, j'ai cliqué sur supprimer la selection; après mbam rédemarre l'ordi.

Destrio5 · Answer

/!\ Seul bona_2 peut suivre cette procédure /!\


1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

File::
F:\WINDOWS\system32\qsipvibi.ini 
F:\WINDOWS\system32\ibivpisq.dll 
F:\WINDOWS\system32\fqjuvatn.ini 
F:\WINDOWS\system32\yjcyrhba.ini 
F:\sqmdata16.sqm 
F:\sqmnoopt16.sqm 
F:\sqmnoopt15.sqm 
F:\sqmdata15.sqm 
F:\sqmnoopt14.sqm 
F:\sqmdata14.sqm 
F:\sqmnoopt13.sqm 
F:\sqmdata13.sqm 
F:\sqmdata12.sqm 
F:\sqmdata11.sqm 
F:\sqmnoopt12.sqm 
F:\sqmnoopt11.sqm 
F:\sqmdata10.sqm 
F:\sqmnoopt10.sqm 
F:\sqmnoopt09.sqm 
F:\sqmnoopt08.sqm 
F:\sqmdata09.sqm 
F:\sqmdata08.sqm 
F:\sqmnoopt07.sqm 
F:\sqmdata07.sqm 
F:\sqmnoopt06.sqm 
F:\sqmdata06.sqm 
F:\sqmnoopt05.sqm 
F:\sqmdata05.sqm 
F:\sqmdata04.sqm
F:\sqmdata03.sqm
F:\sqmdata02.sqm
F:\sqmdata01.sqm
F:\sqmdata00.sqm
F:\sqmnoopt04.sqm 
F:\sqmnoopt03.sqm 
F:\sqmnoopt02.sqm 
F:\sqmnoopt01.sqm 
F:\sqmnoopt00.sqm 
F:\WINDOWS\system32\srksrv.exe 
F:\WINDOWS\system32\drivers\mchInjDrv.sys
F:\DOCUME~1\user\LOCALS~1\Temp\mc22.tmp

Folder::
F:\Program Files\PCHealthCenter 

Registry::
[-HKEY_CLASSES_ROOT\clsid\{34ea1c70-42cc-42c5-aa29-ec58b95a343e}] 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"TkBellExe"=-
"091a0f74"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5aaead9b-6ec0-11dd-a6c8-00e04cb7960a}] 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6bb002c4-2b22-11dd-83ed-00e04cb7960a}] 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbf8b040-4278-11dd-8439-00e04cb7960a}] 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbf8b041-4278-11dd-8439-00e04cb7960a}] 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fede5216-1b47-11dd-83c9-00e04cb7960a}] 
[-HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mchInjDrv] 

Driver::
PoliceService






---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

bona_2 · Answer

rapport du ccombofix, mais j'ai constaté un ptit pbm, l'icone de Avast sur le barre de tache ne réapparait plus idem pour le VRBD.

+ComboFix 08-09-20.05 - user 2008-09-24 9:07:42.3 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.76 [GMT 3:00]
Lancé depuis: F:\Documents and Settings\user\Bureau\ComboFix.exe
Commutateurs utilisés :: F:\Documents and Settings\user\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
F:\DOCUME~1\user\LOCALS~1\Temp\mc22.tmp
F:\sqmdata00.sqm
F:\sqmdata01.sqm
F:\sqmdata02.sqm
F:\sqmdata03.sqm
F:\sqmdata04.sqm
F:\sqmdata05.sqm
F:\sqmdata06.sqm
F:\sqmdata07.sqm
F:\sqmdata08.sqm
F:\sqmdata09.sqm
F:\sqmdata10.sqm
F:\sqmdata11.sqm
F:\sqmdata12.sqm
F:\sqmdata13.sqm
F:\sqmdata14.sqm
F:\sqmdata15.sqm
F:\sqmdata16.sqm
F:\sqmnoopt00.sqm
F:\sqmnoopt01.sqm
F:\sqmnoopt02.sqm
F:\sqmnoopt03.sqm
F:\sqmnoopt04.sqm
F:\sqmnoopt05.sqm
F:\sqmnoopt06.sqm
F:\sqmnoopt07.sqm
F:\sqmnoopt08.sqm
F:\sqmnoopt09.sqm
F:\sqmnoopt10.sqm
F:\sqmnoopt11.sqm
F:\sqmnoopt12.sqm
F:\sqmnoopt13.sqm
F:\sqmnoopt14.sqm
F:\sqmnoopt15.sqm
F:\sqmnoopt16.sqm
F:\WINDOWS\system32\drivers\mchInjDrv.sys
F:\WINDOWS\system32\fqjuvatn.ini
F:\WINDOWS\system32\ibivpisq.dll
F:\WINDOWS\system32\qsipvibi.ini
F:\WINDOWS\system32\srksrv.exe
F:\WINDOWS\system32\yjcyrhba.ini
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\sqmdata00.sqm
F:\sqmdata01.sqm
F:\sqmdata02.sqm
F:\sqmdata03.sqm
F:\sqmdata04.sqm
F:\sqmdata05.sqm
F:\sqmdata06.sqm
F:\sqmdata07.sqm
F:\sqmdata08.sqm
F:\sqmdata09.sqm
F:\sqmdata10.sqm
F:\sqmdata11.sqm
F:\sqmdata12.sqm
F:\sqmdata13.sqm
F:\sqmnoopt00.sqm
F:\sqmnoopt01.sqm
F:\sqmnoopt02.sqm
F:\sqmnoopt03.sqm
F:\sqmnoopt04.sqm
F:\sqmnoopt05.sqm
F:\sqmnoopt06.sqm
F:\sqmnoopt07.sqm
F:\sqmnoopt08.sqm
F:\sqmnoopt09.sqm
F:\sqmnoopt10.sqm
F:\sqmnoopt11.sqm
F:\sqmnoopt12.sqm
F:\sqmnoopt13.sqm
F:\WINDOWS\system32\fqjuvatn.ini
F:\WINDOWS\system32\srksrv.exe
F:\WINDOWS\system32\yjcyrhba.ini

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_POLICESERVICE
-------\Service_PoliceService

((((((((((((((((((((((((((((( Fichiers créés du 2008-08-24 au 2008-09-24 ))))))))))))))))))))))))))))))))))))
.

2008-09-22 15:36 . 2008-09-22 15:36 <REP> d-------- F:\Program Files\Malwarebytes' Anti-Malware
2008-09-22 15:36 . 2008-09-22 15:36 <REP> d-------- F:\Documents and Settings\user\Application Data\Malwarebytes
2008-09-22 15:36 . 2008-09-22 15:36 <REP> d-------- F:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-22 15:36 . 2008-09-10 00:04 38,528 --a------ F:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-22 15:36 . 2008-09-10 00:03 17,200 --a------ F:\WINDOWS\system32\drivers\mbam.sys
2008-09-22 15:15 . 2008-09-22 15:15 <REP> d--hs---- F:\FOUND.001
2008-09-18 13:44 . 2008-09-18 13:44 <REP> d-------- F:\Documents and Settings\user\Application Data\Radmin Communication Client
2008-09-18 09:54 . 2008-09-18 09:54 <REP> d-------- F:\Program Files\Runtime Software
2008-09-16 16:59 . 2008-09-16 16:59 <REP> d-------- F:\Documents and Settings\Administrator\Application Data\Radmin Communication Client
2008-09-16 16:58 . 2008-09-16 16:58 <REP> d-------- F:\Program Files\Radmin Communication Client 3.0
2008-09-16 16:42 . 2008-09-16 16:42 <REP> d-------- F:\Program Files\PCNetSoftware
2008-09-16 15:51 . 2007-10-18 20:48 83,288 --a------ F:\WINDOWS\system32\LMIRfsClientNP.dll
2008-09-16 15:51 . 2007-10-18 20:47 75,064 --a------ F:\WINDOWS\system32\LMIinit.dll
2008-09-16 15:51 . 2007-09-12 10:20 46,112 --a------ F:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2008-09-16 15:51 . 2007-10-18 20:47 21,496 --a------ F:\WINDOWS\system32\LMIport.dll
2008-09-16 15:50 . 2008-09-16 15:50 <REP> d-------- F:\Program Files\LogMeIn
2008-09-16 15:02 . 2008-09-16 15:02 <REP> d-------- F:\Program Files\UltraVNC
2008-09-09 15:31 . 2008-09-09 15:31 <REP> d-------- F:\Program Files\VirginMega
2008-09-09 15:11 . 2008-09-09 15:11 <REP> d-------- F:\Program Files\Windows Media Connect 2
2008-09-09 14:45 . 2008-09-09 14:45 <REP> d-------- F:\WINDOWS\system32\drivers\umdf
2008-09-09 10:34 . 2008-09-09 10:34 <REP> d--h----- F:\WINDOWS\$hf_mig$
2008-09-08 09:26 . 2008-09-08 09:26 <REP> d-------- F:\Program Files\Intelore
2008-09-05 16:08 . 2008-09-05 16:08 <REP> d--hs---- F:\FOUND.000
2008-09-05 16:02 . 2008-09-05 16:02 <REP> d-------- F:\Documents and Settings\user\Application Data\ZIP RAR ACE Password Recovery
2008-09-05 15:43 . 2008-09-05 15:43 <REP> d-------- F:\Program Files\RAR Password Cracker
2008-09-05 15:35 . 2008-09-05 15:35 <REP> d-------- F:\Program Files\Active Data Recovery Software
2008-09-04 15:18 . 2008-09-04 15:18 12 --a------ F:\WINDOWS\system32\usbsys.tmp
2008-09-03 16:50 . 2008-09-03 16:50 <REP> d--hs---- F:\Documents and Settings\Administrator\UserData
2008-09-03 16:46 . 2008-09-03 16:46 <REP> d-------- F:\Documents and Settings\Administrator\Application Data\TopLang
2008-09-02 15:53 . 2008-09-02 15:53 <REP> d-------- F:\Program Files\Desktop Lock
2008-09-02 15:16 . 2008-09-02 15:16 <REP> d-------- F:\Documents and Settings\user\Application Data\TopLang
2008-09-02 14:43 . 2008-09-04 11:08 2,197 --a------ F:\WINDOWS\kmuusb.sys
2008-09-02 14:43 . 2008-09-04 11:08 6 --a------ F:\WINDOWS\kmuudr.sys
2008-09-02 14:42 . 2008-09-02 14:42 <REP> d-------- F:\Documents and Settings\All Users\Application Data\MyUSBOnly
2008-09-02 13:45 . 2008-09-02 13:45 <REP> d--hs---- F:\Program Files\KGB
2008-09-02 13:45 . 2008-09-02 13:45 <REP> d--hs---- F:\Documents and Settings\All Users\Application Data\MPK
2008-09-02 13:45 . 2008-09-02 13:45 480 --a------ F:\WINDOWS\system32\runkgb.lnk

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-24 06:11 18,030 ----a-w F:\WINDOWS\system32\drivers\DeskLock.sys
2008-08-20 11:30 --------- d-----w F:\Program Files\PDF2Word v1.6
2008-08-18 12:27 --------- d-----w F:\Documents and Settings\Administrator\Application Data\Babylon
2008-08-08 10:57 --------- d-----w F:\Program Files\EasyPHP1-8
2008-08-08 09:58 --------- d-----w F:\Program Files\IDAutomation.com Code 39 Free Font
2008-08-08 06:47 --------- d-----w F:\Program Files\Microsoft Silverlight
2008-08-05 11:02 --------- d-----w F:\Program Files\[u]0[/u]1-mp3search
2008-08-04 12:00 --------- d-----w F:\Program Files\myBabylon
2008-08-04 12:00 --------- d-----w F:\Program Files\Conduit
2008-08-04 12:00 --------- d-----w F:\Program Files\Babylon
2008-08-04 11:45 --------- d-----w F:\Documents and Settings\user\Application Data\Babylon
2008-08-04 11:45 --------- d-----w F:\Documents and Settings\All Users\Application Data\Babylon
2008-07-29 06:42 --------- d-----w F:\Program Files\Opera
2008-07-24 07:49 --------- d-----w F:\Program Files\Trend Micro
2008-07-24 06:40 --------- d-----w F:\Program Files\Navilog1
2008-05-28 11:59 33 ----a-w F:\Documents and Settings\user\Application Data\pwcpsw.dat
2007-12-07 13:51 92,064 ----a-w F:\Documents and Settings\user\mqdmmdm.sys
2007-12-07 13:51 9,232 ----a-w F:\Documents and Settings\user\mqdmmdfl.sys
2007-12-07 13:51 79,328 ----a-w F:\Documents and Settings\user\mqdmserd.sys
2007-12-07 13:51 66,656 ----a-w F:\Documents and Settings\user\mqdmbus.sys
2007-12-07 13:51 6,208 ----a-w F:\Documents and Settings\user\mqdmcmnt.sys
2007-12-07 13:51 5,936 ----a-w F:\Documents and Settings\user\mqdmwhnt.sys
2007-12-07 13:51 4,048 ----a-w F:\Documents and Settings\user\mqdmcr.sys
2007-12-07 13:51 25,600 ----a-w F:\Documents and Settings\user\usbsermptxp.sys
2007-12-07 13:51 22,768 ----a-w F:\Documents and Settings\user\usbsermpt.sys
.

((((((((((((((((((((((((((((( snapshot@2008-09-22_11.12.42.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-08-13 15:39:00 123,904 ------w F:\WINDOWS\ie7updates\KB950759-IE7\advpack.dll
+ 2007-08-13 15:35:46 346,624 ------w F:\WINDOWS\ie7updates\KB950759-IE7\dxtmsft.dll
+ 2007-08-13 15:35:38 214,528 ------w F:\WINDOWS\ie7updates\KB950759-IE7\dxtrans.dll
+ 2007-08-13 15:54:10 131,584 ------w F:\WINDOWS\ie7updates\KB950759-IE7\extmgr.dll
+ 2007-08-13 15:36:26 61,952 ------w F:\WINDOWS\ie7updates\KB950759-IE7\icardie.dll
+ 2007-08-13 15:39:06 54,784 ------w F:\WINDOWS\ie7updates\KB950759-IE7\ie4uinit.exe
+ 2007-08-13 15:39:26 152,064 ------w F:\WINDOWS\ie7updates\KB950759-IE7\ieakeng.dll
+ 2007-08-13 15:39:54 229,376 ------w F:\WINDOWS\ie7updates\KB950759-IE7\ieaksie.dll
+ 2007-08-13 14:56:54 161,792 ------w F:\WINDOWS\ie7updates\KB950759-IE7\ieakui.dll
+ 2007-02-12 13:10:12 2,451,312 ------w F:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dat
+ 2007-07-11 09:27:48 383,488 ------w F:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dll
+ 2007-08-13 15:39:50 382,976 ------w F:\WINDOWS\ie7updates\KB950759-IE7\iedkcs32.dll
+ 2007-08-13 15:54:10 6,049,280 ------w F:\WINDOWS\ie7updates\KB950759-IE7\ieframe.dll
+ 2007-08-13 15:39:10 43,008 ------w F:\WINDOWS\ie7updates\KB950759-IE7\iernonce.dll
+ 2007-08-13 15:34:04 266,752 ------w F:\WINDOWS\ie7updates\KB950759-IE7\iertutil.dll
+ 2007-08-13 15:39:10 13,312 ------w F:\WINDOWS\ie7updates\KB950759-IE7\ieudinit.exe
+ 2007-08-13 15:43:56 622,080 ------w F:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe
+ 2007-08-13 15:54:10 27,136 ------w F:\WINDOWS\ie7updates\KB950759-IE7\jsproxy.dll
+ 2007-08-13 15:54:10 458,752 ------w F:\WINDOWS\ie7updates\KB950759-IE7\msfeeds.dll
+ 2007-08-13 15:54:10 50,688 ------w F:\WINDOWS\ie7updates\KB950759-IE7\msfeedsbs.dll
+ 2007-08-13 15:54:12 3,578,368 ------w F:\WINDOWS\ie7updates\KB950759-IE7\mshtml.dll
+ 2007-08-13 15:54:10 475,648 ------w F:\WINDOWS\ie7updates\KB950759-IE7\mshtmled.dll
+ 2007-08-13 15:44:26 192,000 ------w F:\WINDOWS\ie7updates\KB950759-IE7\msrating.dll
+ 2007-08-13 15:54:10 670,720 ------w F:\WINDOWS\ie7updates\KB950759-IE7\mstime.dll
+ 2007-08-13 15:44:06 101,376 ------w F:\WINDOWS\ie7updates\KB950759-IE7\occache.dll
+ 2007-08-13 15:36:12 44,544 ------w F:\WINDOWS\ie7updates\KB950759-IE7\pngfilt.dll
+ 2007-03-06 01:34:38 216,800 ------w F:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:35:48 394,976 ------w F:\WINDOWS\ie7updates\KB950759-IE7\spuninst\updspapi.dll
+ 2007-08-13 15:44:30 105,984 ------w F:\WINDOWS\ie7updates\KB950759-IE7\url.dll
+ 2007-08-13 15:54:10 1,162,240 ------w F:\WINDOWS\ie7updates\KB950759-IE7\urlmon.dll
+ 2007-08-13 15:54:10 231,424 ------w F:\WINDOWS\ie7updates\KB950759-IE7\webcheck.dll
+ 2007-08-13 15:54:10 818,688 ------w F:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
- 2007-08-13 15:39:00 123,904 ----a-w F:\WINDOWS\system32\advpack.dll
+ 2008-04-23 04:16:40 124,928 ----a-w F:\WINDOWS\system32\advpack.dll
+ 2008-09-22 10:06:08 262,144 ----a-w F:\WINDOWS\system32\config\systemprofile\NtUser.dat
- 2007-08-13 15:39:00 123,904 ------w F:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-04-23 04:16:40 124,928 ------w F:\WINDOWS\system32\dllcache\advpack.dll
- 2007-08-13 15:35:46 346,624 ------w F:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-04-23 04:16:40 347,136 ------w F:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2007-08-13 15:35:38 214,528 ------w F:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-04-23 04:16:40 214,528 ------w F:\WINDOWS\system32\dllcache\dxtrans.dll
- 2007-08-13 15:54:10 131,584 ------w F:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-04-23 04:16:40 133,120 ------w F:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-04-23 04:16:40 63,488 ------w F:\WINDOWS\system32\dllcache\icardie.dll
- 2007-08-13 15:39:06 54,784 ------w F:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2008-04-22 07:41:08 70,656 ------w F:\WINDOWS\system32\dllcache\ie4uinit.exe
- 2007-08-13 15:39:26 152,064 ------w F:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-04-23 04:16:40 153,088 ------w F:\WINDOWS\system32\dllcache\ieakeng.dll
- 2007-08-13 15:39:54 229,376 ------w F:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-04-23 04:16:40 230,400 ------w F:\WINDOWS\system32\dllcache\ieaksie.dll
- 2007-08-13 14:56:54 161,792 ------w F:\WINDOWS\system32\dllcache\ieakui.dll
+ 2008-04-20 05:07:52 161,792 ------w F:\WINDOWS\system32\dllcache\ieakui.dll
+ 2007-04-17 09:32:38 2,455,488 ------w F:\WINDOWS\system32\dllcache\ieapfltr.dat
+ 2008-04-23 04:16:40 383,488 ------w F:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2007-08-13 15:39:50 382,976 ------w F:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-04-23 04:16:40 384,512 ------w F:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-04-23 04:16:40 6,066,176 ------w F:\WINDOWS\system32\dllcache\ieframe.dll
- 2007-08-13 15:39:10 43,008 ------w F:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-04-23 04:16:40 44,544 ------w F:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-04-23 04:16:40 267,776 ------w F:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-04-22 07:39:58 13,824 ------w F:\WINDOWS\system32\dllcache\ieudinit.exe
- 2007-08-13 15:43:56 622,080 ------w F:\WINDOWS\system32\dllcache\iexplore.exe
+ 2008-04-22 07:41:30 625,664 ------w F:\WINDOWS\system32\dllcache\iexplore.exe
- 2007-08-13 15:54:10 27,136 ------w F:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-04-23 04:16:40 27,648 ------w F:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-04-23 04:16:40 459,264 ------w F:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-04-23 04:16:40 52,224 ------w F:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2007-08-13 15:54:12 3,578,368 ------w F:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-04-23 06:46:42 3,591,680 ------w F:\WINDOWS\system32\dllcache\mshtml.dll
- 2007-08-13 15:54:10 475,648 ------w F:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-04-23 04:16:40 478,208 ------w F:\WINDOWS\system32\dllcache\mshtmled.dll
- 2007-08-13 15:44:26 192,000 ------w F:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-04-23 04:16:40 193,024 ------w F:\WINDOWS\system32\dllcache\msrating.dll
- 2007-08-13 15:54:10 670,720 ------w F:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-04-23 04:16:40 671,232 ------w F:\WINDOWS\system32\dllcache\mstime.dll
- 2007-08-13 15:44:06 101,376 ------w F:\WINDOWS\system32\dllcache\occache.dll
+ 2008-04-23 04:16:40 102,912 ------w F:\WINDOWS\system32\dllcache\occache.dll
- 2007-08-13 15:36:12 44,544 ------w F:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-04-23 04:16:40 44,544 ------w F:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-08-13 15:44:30 105,984 ------w F:\WINDOWS\system32\dllcache\url.dll
+ 2008-04-23 04:16:40 105,984 ------w F:\WINDOWS\system32\dllcache\url.dll
- 2007-08-13 15:54:10 1,162,240 ------w F:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-04-23 04:16:40 1,159,680 ------w F:\WINDOWS\system32\dllcache\urlmon.dll
- 2007-08-13 15:54:10 231,424 ------w F:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-04-23 04:16:40 233,472 ------w F:\WINDOWS\system32\dllcache\webcheck.dll
- 2007-08-13 15:54:10 818,688 ------w F:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-04-23 04:16:40 826,368 ------w F:\WINDOWS\system32\dllcache\wininet.dll
- 2008-01-17 16:34:02 93,264 ----a-w F:\WINDOWS\system32\drivers\aswmon.sys
+ 2008-01-17 17:34:02 93,264 ----a-w F:\WINDOWS\system32\drivers\aswmon.sys
- 2007-08-13 15:35:46 346,624 ----a-w F:\WINDOWS\system32\dxtmsft.dll
+ 2008-04-23 04:16:40 347,136 ----a-w F:\WINDOWS\system32\dxtmsft.dll
- 2007-08-13 15:35:38 214,528 ----a-w F:\WINDOWS\system32\dxtrans.dll
+ 2008-04-23 04:16:40 214,528 ----a-w F:\WINDOWS\system32\dxtrans.dll
- 2007-08-13 15:54:10 131,584 ----a-w F:\WINDOWS\system32\extmgr.dll
+ 2008-04-23 04:16:40 133,120 ----a-w F:\WINDOWS\system32\extmgr.dll
- 2007-08-13 15:36:26 61,952 ------w F:\WINDOWS\system32\icardie.dll
+ 2008-04-23 04:16:40 63,488 ----a-w F:\WINDOWS\system32\icardie.dll
- 2007-08-13 15:39:06 54,784 ----a-w F:\WINDOWS\system32\ie4uinit.exe
+ 2008-04-22 07:41:08 70,656 ----a-w F:\WINDOWS\system32\ie4uinit.exe
- 2007-08-13 15:39:26 152,064 ----a-w F:\WINDOWS\system32\ieakeng.dll
+ 2008-04-23 04:16:40 153,088 ----a-w F:\WINDOWS\system32\ieakeng.dll
- 2007-08-13 15:39:54 229,376 ----a-w F:\WINDOWS\system32\ieaksie.dll
+ 2008-04-23 04:16:40 230,400 ----a-w F:\WINDOWS\system32\ieaksie.dll
- 2007-08-13 14:56:54 161,792 ----a-w F:\WINDOWS\system32\ieakui.dll
+ 2008-04-20 05:07:52 161,792 ----a-w F:\WINDOWS\system32\ieakui.dll
- 2007-02-12 13:10:12 2,451,312 ------w F:\WINDOWS\system32\ieapfltr.dat
+ 2007-04-17 09:32:38 2,455,488 ----a-w F:\WINDOWS\system32\ieapfltr.dat
- 2007-07-11 09:27:48 383,488 ------w F:\WINDOWS\system32\ieapfltr.dll
+ 2008-04-23 04:16:40 383,488 ----a-w F:\WINDOWS\system32\ieapfltr.dll
- 2007-08-13 15:39:50 382,976 ----a-w F:\WINDOWS\system32\iedkcs32.dll
+ 2008-04-23 04:16:40 384,512 ----a-w F:\WINDOWS\system32\iedkcs32.dll
- 2007-08-13 15:54:10 6,049,280 ------w F:\WINDOWS\system32\ieframe.dll
+ 2008-04-23 04:16:40 6,066,176 ----a-w F:\WINDOWS\system32\ieframe.dll
- 2007-08-13 15:39:10 43,008 ----a-w F:\WINDOWS\system32\iernonce.dll
+ 2008-04-23 04:16:40 44,544 ----a-w F:\WINDOWS\system32\iernonce.dll
- 2007-08-13 15:34:04 266,752 ------w F:\WINDOWS\system32\iertutil.dll
+ 2008-04-23 04:16:40 267,776 ----a-w F:\WINDOWS\system32\iertutil.dll
- 2007-08-13 15:39:10 13,312 ----a-w F:\WINDOWS\system32\ieudinit.exe
+ 2008-04-22 07:39:58 13,824 ----a-w F:\WINDOWS\system32\ieudinit.exe
- 2007-08-13 15:54:10 27,136 ----a-w F:\WINDOWS\system32\jsproxy.dll
+ 2008-04-23 04:16:40 27,648 ----a-w F:\WINDOWS\system32\jsproxy.dll
- 2007-08-13 15:54:10 458,752 ------w F:\WINDOWS\system32\msfeeds.dll
+ 2008-04-23 04:16:40 459,264 ----a-w F:\WINDOWS\system32\msfeeds.dll
- 2007-08-13 15:54:10 50,688 ------w F:\WINDOWS\system32\msfeedsbs.dll
+ 2008-04-23 04:16:40 52,224 ----a-w F:\WINDOWS\system32\msfeedsbs.dll
- 2007-08-13 15:54:12 3,578,368 ----a-w F:\WINDOWS\system32\mshtml.dll
+ 2008-04-23 06:46:42 3,591,680 ----a-w F:\WINDOWS\system32\mshtml.dll
- 2007-08-13 15:54:10 475,648 ----a-w F:\WINDOWS\system32\mshtmled.dll
+ 2008-04-23 04:16:40 478,208 ----a-w F:\WINDOWS\system32\mshtmled.dll
- 2007-08-13 15:44:26 192,000 ----a-w F:\WINDOWS\system32\msrating.dll
+ 2008-04-23 04:16:40 193,024 ----a-w F:\WINDOWS\system32\msrating.dll
- 2007-08-13 15:54:10 670,720 ----a-w F:\WINDOWS\system32\mstime.dll
+ 2008-04-23 04:16:40 671,232 ----a-w F:\WINDOWS\system32\mstime.dll
- 2007-08-13 15:44:06 101,376 ----a-w F:\WINDOWS\system32\occache.dll
+ 2008-04-23 04:16:40 102,912 ----a-w F:\WINDOWS\system32\occache.dll
- 2007-08-13 15:36:12 44,544 ----a-w F:\WINDOWS\system32\pngfilt.dll
+ 2008-04-23 04:16:40 44,544 ----a-w F:\WINDOWS\system32\pngfilt.dll
+ 2007-03-06 01:34:34 15,072 ------w F:\WINDOWS\system32\spmsg.dll
- 2007-08-13 15:44:30 105,984 ----a-w F:\WINDOWS\system32\url.dll
+ 2008-04-23 04:16:40 105,984 ----a-w F:\WINDOWS\system32\url.dll
- 2007-08-13 15:54:10 1,162,240 ----a-w F:\WINDOWS\system32\urlmon.dll
+ 2008-04-23 04:16:40 1,159,680 ----a-w F:\WINDOWS\system32\urlmon.dll
- 2007-08-13 15:54:10 231,424 ----a-w F:\WINDOWS\system32\webcheck.dll
+ 2008-04-23 04:16:40 233,472 ----a-w F:\WINDOWS\system32\webcheck.dll
- 2007-08-13 15:54:10 818,688 ----a-w F:\WINDOWS\system32\wininet.dll
+ 2008-04-23 04:16:40 826,368 ----a-w F:\WINDOWS\system32\wininet.dll
+ 2008-09-24 06:11:56 16,384 ----a-w F:\WINDOWS\Temp\Perflib_Perfdata_5c4.dat
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="F:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"PcSync"="F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]
"Yahoo! Pager"="F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 222080]
"USB_FW"="F:\Program Files\Net Studio\USB_FW.exe" [2008-05-21 1299968]
"SuperCopier2.exe"="F:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCSuiteTrayApplication"="F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 229376]
"HP SchedIndexer"="F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe" [2001-02-19 86016]
"HP AutoIndexer"="F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe" [2001-02-19 77824]
"NeroFilterCheck"="F:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"COMODO Firewall Pro"="F:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-03 1115728]
"!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-06-19 6731312]
"Babylon Client"="F:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [2007-12-20 3116768]
"Desktop Lock Loader"="F:\PROGRA~1\DESKTO~1\TLDL.EXE" [2008-05-02 151552]
"LogMeIn GUI"="F:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-09-12 63048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Mpk.exe"="F:\Program Files\KGB\Mpk.exe" [2007-10-22 1281536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LoginPrompt"= 9E8C8182988584
"NoViewOnDrive"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2007-10-18 20:47 75064 F:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"F:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"F:\\Program Files\\Messenger\\msmsgs.exe"=
"F:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"F:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"F:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"F:\\Program Files\\MSN Messenger\\MsnMsgr.Exe"=
"F:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 aswSP;avast! Self Protection;F:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 DeskLock;DeskLock;F:\WINDOWS\system32\drivers\DeskLock.sys [2008-09-24 18030]
R2 aswFsBlk;aswFsBlk;F:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 LMIInfo;LogMeIn Kernel Information Provider;F:\Program Files\LogMeIn\x86\RaInfo.sys [2007-09-12 12992]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;F:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 46112]
S3 MiniScanEye;MiniScanEye;F:\WINDOWS\system32\Drivers\minsceye.sys [2005-02-16 14382]
S3 pendfu;PenDfu (pendfu.sys);F:\WINDOWS\system32\Drivers\pendfu.sys [2005-02-14 32408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{34ea1c70-42cc-42c5-aa29-ec58b95a343e} - (no file)
BHO-{34ea1c70-42cc-42c5-aa29-ec58b95a343e} - (no file)
Toolbar-{34ea1c70-42cc-42c5-aa29-ec58b95a343e} - (no file)
WebBrowser-{34EA1C70-42CC-42C5-AA29-EC58B95A343E} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-24 09:13:50
Windows 5.1.2600 Service Pack 3 FAT NTAPI

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mchInjDrv]
"ImagePath"="\??\F:\DOCUME~1\user\LOCALS~1\Temp\mc22.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

PROCESSUS: F:\WINDOWS\explorer.exe
-> F:\Program Files\KGB\MPK.dll
.
------------------------ Autres processus actifs ------------------------
.
F:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
F:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\Comodo\Firewall\cmdagent.exe
F:\Program Files\LogMeIn\x86\RaMaint.exe
F:\Program Files\LogMeIn\x86\LogMeIn.exe
F:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
F:\PROGRAM FILES\ALCOHOL SOFT\ALCOHOL 120\STARWIND\STARWINDSERVICEAE.EXE
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe
F:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
F:\WINDOWS\system32\INTERNAT.EXE
.
**************************************************************************
.
Heure de fin: 2008-09-24 9:24:39 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-09-24 06:24:22
ComboFix2.txt 2008-09-22 08:13:44

Avant-CF: 991ÿ256ÿ576 octets libres
Après-CF: 1,019,445,248 octets libres

417

Destrio5 · Answer

- Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (Avec Internet Explorer)

- En bas à droite, clique sur Démarrer Online-scanner

- Dans la nouvelle fenêtre qui s'affiche, clique sur J'accepte

- Accepte les Contrôles ActiveX

- Choisis Poste de travail pour le scan.

- Celui-ci terminé, sauvegarde (Choisis fichier texte) et poste le rapport

- Pour t'aider à utiliser le scan en ligne :
https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.

- Lis ceci en cas de problème d'installation du Contrôle ActiveX :
http://cybersecurite.xooit.com/t123-Les-controles-ActiveX.htm

bona_2 · Answer

slt à tous 

Destrio5, est-il possible de faire un autre scan que online kapersky, car j'avais effectuer 2x et mon'ordi rédamarre automatiquement à un bout de temps.

Merci
A+

Destrio5 · Answer

Essaie avec Panda :
https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan

bona_2 · Answer

J'ai 2 rapport là, le 2e après un desinfection de panda.



;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-09-25 17:01:23
PROTECTIONS: 1
MALWARE: 70
SUSPECTS: 1
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
avast! antivirus 4.8.1229 [VPS 080925-0]     4.8.1229                      Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00029568  adware/netpals                     Adware              No        0         Yes            No           hkey_current_user\software\destiny
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.casalemedia.com/]
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@casalemedia[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@doubleclick[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.doubleclick.net/]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           F:\FOUND.035\FILE0000.CHK
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@atdmt[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.atdmt.com/]
00139535  Application/Processor              HackTools           No        0         Yes            No           F:\Program Files\Navilog1\Process.exe
00139535  Application/Processor              HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP11\A0001849.EXE
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@tradedoubler[1].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@247realmedia[1].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.247realmedia.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.247realmedia.com/]
00145453  Cookie/Bfast                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bfast.com/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fastclick[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@tribalfusion[2].txt
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tribalfusion.com/]
00145732  Cookie/Falkag                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@as-eu.falkag[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@mediaplex[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.mediaplex.com/]
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.mediaplex.com/]
00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.linksynergy.com/]
00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.linksynergy.com/]
00149046  Cookie/Casinotropez                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@casinotropez[2].txt
00149064  Cookie/Maxserving                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@maxserving[2].txt
00152401  Cookie/Belnk                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@belnk[1].txt
00159564  Cookie/WUpd                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@revenue[1].txt
00159564  Cookie/WUpd                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.revenue.net/]
00162730  Cookie/Belnk                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@dist.belnk[2].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@com[1].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.com.com/]
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@com[2].txt
00167647  Cookie/Yadro                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.yadro.ru/]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           F:\Documents and Settings\Administrator\Cookies\administrator@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.xiti.com/]
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fe.lea.lycos.fr/]
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fe.lea.lycos[3].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[1].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[3].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[2].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.toplist.cz/]
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[4].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@statcounter[1].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167760  Cookie/Hitslink                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[counter.hitslink.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@ad.yieldmanager[2].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@ad.yieldmanager[3].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@apmebf[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.apmebf.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.apmebf.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@apmebf[2].txt
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.burstnet.com/]
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.burstnet.com/]
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@burstnet[2].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bs.serving-sys.com/]
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bs.serving-sys[1].txt
00168102  Cookie/Falkag                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@as1.falkag[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@weborama[2].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adtech[1].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.adtech.de/]
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.adtech.de/]
00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[server.iad.liveperson.net/hc/34149639]
00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@server.iad.liveperson[1].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fl01.ct2.comclick[2].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@advertising[2].txt
00170087  Cookie/Hbmediapro                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adopt.hbmediapro[3].txt
00170087  Cookie/Hbmediapro                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adopt.hbmediapro[2].txt
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[statse.webtrendslive.com/]
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@statse.webtrendslive[2].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.overture.com/]
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@overture[1].txt
00171633  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@cgi-bin[1].txt
00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@questionmarket[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@zedo[2].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.zedo.com/]
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.zedo.com/]
00172449  Cookie/MetriWeb                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@metriweb[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bluestreak.com/]
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bluestreak[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bluestreak[1].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.adrevolver.com/]
00186469  Cookie/Reliablestats               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@stats1.reliablestats[1].txt
00191644  Cookie/adultfriendfinder           TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adultfriendfinder[2].txt
00199983  Cookie/Valueclick                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@valueclick[1].txt
00199984  Cookie/Searchportal                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[searchportal.information.com/]
00217990  Cookie/WinFixer                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@winfixer[2].txt
00234869  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@media.fastclick[1].txt
00262024  Cookie/ErrorSafe                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@www.errorsafe[1].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.smartadserver.com/]
00293517  Cookie/AdDynamix                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@ads.addynamix[1].txt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\AINA\Hira_Divers_1\Andry\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\Archives_Iharo\Ryan\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\Archives_Iharo\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\Archives_Iharo\Photo\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\AINA\Hira_Divers_1\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\Archives_Iharo\Photo\Meengai\Temp.Htt
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\Archives_Iharo\Ryan\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\Archives_Iharo\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\AINA\Hira_Divers_1\Andry\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           C:\WINDOWS\Desktop\COM\desktop.ini
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\AINA\Hira_Divers_1\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\Archives_Iharo\Photo\Meengai\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            No           D:\Archives_Iharo\Photo\DESKTOP.INI
00380718  Adware/RogueAntimalware2008        Adware              No        0         Yes            No           F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir
00380718  Adware/RogueAntimalware2008        Adware              No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE
01185375  Application/Psexec.A               HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0002023.EXE
01185375  Application/Psexec.A               HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0002048.EXE
01185375  Application/Psexec.A               HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP14\A0003476.EXE
01196326  Cookie/GoClick                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.goclick.com/]
01196326  Cookie/GoClick                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.goclick.com/]
02885963  Rootkit/Booto.C                    Virus/Worm          No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP14\A0003455.SYS
02885963  Rootkit/Booto.C                    Virus/Worm          No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0002028.SYS
02885963  Rootkit/Booto.C                    Virus/Worm          No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001965.SYS
02912157  W32/Spamta.gen.worm                Virus/Worm          No        0         Yes            No           C:\Program Files\Softinterface, Inc\Convert Image\ConvertImage.exe
03541233  HackTool/Rebooter                  HackTools           No        0         Yes            No           F:\Program Files\Navilog1\Reboot.exe
03667161  Application/MicroAntivirus2009     HackTools           No        0         No             No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE[F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE][MicroAV.exe]
03667161  Application/MicroAntivirus2009     HackTools           No        0         No             No           F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir[F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir][MicroAV.exe]
03667320  Adware/RogueAntimalware2008        Adware              No        0         No             No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE[F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE][MicroAV.cpl]
03667320  Adware/RogueAntimalware2008        Adware              No        0         No             No           F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir[F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir][MicroAV.cpl]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.1]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110145.12.zip[sc.html.2]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.3]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110145.12.zip[sc.html.1]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110145.12.zip[sc.html]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.2]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.4]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104223,70.zip[sc.html]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.4]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104223,70.zip[sc.html.1]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104223,70.zip[sc.html.2]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.1]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.2]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.3]
03723613  Generic Trojan                     Virus/Trojan        No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP11\A0001694.EXE
03725600  Spyware/Virtumonde                 Spyware             No        1         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP11\A0001838.DLL
03738576  Generic Trojan                     Virus/Trojan        No        0         No             No           F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir[F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir][MicroAV1.dat]
03738576  Generic Trojan                     Virus/Trojan        No        0         No             No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE[F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE][MicroAV1.dat]
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           F:\Documents and Settings\USER\Bureau\ComboFix.exe[32788R22FWJFW\catchme.cfexe]
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           F:\Documents and Settings\USER\Local Settings\Application Data\Opera\Opera\PROFILE\CACHE4\opr001RG[32788R22FWJFW\catchme.cfexe]
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP13\A0003417.EXE[32788R22FWJFW\catchme.cfexe]
03738686  Generic Malware                    Virus/Trojan        No        0         Yes            No           F:\Program Files\Navilog1\CATCHME.EXE
03742989  Spyware/Virtumonde                 Spyware             No        1         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001964.DLL
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              J
;===================================================================================================================================================================================
No        F:\Program Files\KGB\MPK.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          J
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                J
;===================================================================================================================================================================================
;===================================================================================================================================================================================

2e rapport après une desinfection.

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-09-25 17:08:44
PROTECTIONS: 1
MALWARE: 70
SUSPECTS: 1
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
avast! antivirus 4.8.1229 [VPS 080925-0]     4.8.1229                      Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00029568  adware/netpals                     Adware              No        0         Yes            No           hkey_current_user\software\destiny
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.casalemedia.com/]
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@casalemedia[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@doubleclick[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.doubleclick.net/]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           F:\FOUND.035\FILE0000.CHK
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@atdmt[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.atdmt.com/]
00139535  Application/Processor              HackTools           No        0         Yes            No           F:\Program Files\Navilog1\Process.exe
00139535  Application/Processor              HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP11\A0001849.EXE
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@tradedoubler[1].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@247realmedia[1].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.247realmedia.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.247realmedia.com/]
00145453  Cookie/Bfast                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bfast.com/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fastclick[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@tribalfusion[2].txt
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tribalfusion.com/]
00145732  Cookie/Falkag                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@as-eu.falkag[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@mediaplex[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.mediaplex.com/]
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.mediaplex.com/]
00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.linksynergy.com/]
00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.linksynergy.com/]
00149046  Cookie/Casinotropez                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@casinotropez[2].txt
00149064  Cookie/Maxserving                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@maxserving[2].txt
00152401  Cookie/Belnk                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@belnk[1].txt
00159564  Cookie/WUpd                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@revenue[1].txt
00159564  Cookie/WUpd                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.revenue.net/]
00162730  Cookie/Belnk                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@dist.belnk[2].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@com[1].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.com.com/]
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@com[2].txt
00167647  Cookie/Yadro                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.yadro.ru/]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           F:\Documents and Settings\Administrator\Cookies\administrator@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.xiti.com/]
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fe.lea.lycos.fr/]
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fe.lea.lycos[3].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[1].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[3].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[2].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.toplist.cz/]
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[4].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@statcounter[1].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167760  Cookie/Hitslink                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[counter.hitslink.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@ad.yieldmanager[2].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@ad.yieldmanager[3].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@apmebf[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.apmebf.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.apmebf.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@apmebf[2].txt
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.burstnet.com/]
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.burstnet.com/]
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@burstnet[2].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bs.serving-sys.com/]
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bs.serving-sys[1].txt
00168102  Cookie/Falkag                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@as1.falkag[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@weborama[2].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adtech[1].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.adtech.de/]
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.adtech.de/]
00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[server.iad.liveperson.net/hc/34149639]
00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@server.iad.liveperson[1].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fl01.ct2.comclick[2].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@advertising[2].txt
00170087  Cookie/Hbmediapro                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adopt.hbmediapro[3].txt
00170087  Cookie/Hbmediapro                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adopt.hbmediapro[2].txt
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[statse.webtrendslive.com/]
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@statse.webtrendslive[2].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.overture.com/]
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@overture[1].txt
00171633  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@cgi-bin[1].txt
00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@questionmarket[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@zedo[2].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.zedo.com/]
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.zedo.com/]
00172449  Cookie/MetriWeb                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@metriweb[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bluestreak.com/]
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bluestreak[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bluestreak[1].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0

Destrio5 · Answer

Le deuxième rapport n'a pas l'air complet.

bona_2 · Answer

2e rapport


;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-09-25 17:08:44
PROTECTIONS: 1
MALWARE: 70
SUSPECTS: 1
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
avast! antivirus 4.8.1229 [VPS 080925-0]     4.8.1229                      Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00029568  adware/netpals                     Adware              No        0         Yes            No           hkey_current_user\software\destiny
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.casalemedia.com/]
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@casalemedia[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@doubleclick[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.doubleclick.net/]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           F:\FOUND.035\FILE0000.CHK
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@atdmt[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.atdmt.com/]
00139535  Application/Processor              HackTools           No        0         Yes            No           F:\Program Files\Navilog1\Process.exe
00139535  Application/Processor              HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP11\A0001849.EXE
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@tradedoubler[1].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tradedoubler.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@247realmedia[1].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.247realmedia.com/]
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.247realmedia.com/]
00145453  Cookie/Bfast                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bfast.com/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fastclick[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.fastclick.net/]
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@tribalfusion[2].txt
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.tribalfusion.com/]
00145732  Cookie/Falkag                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@as-eu.falkag[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@mediaplex[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.mediaplex.com/]
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.mediaplex.com/]
00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.linksynergy.com/]
00145807  Cookie/Linksynergy                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.linksynergy.com/]
00149046  Cookie/Casinotropez                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@casinotropez[2].txt
00149064  Cookie/Maxserving                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@maxserving[2].txt
00152401  Cookie/Belnk                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@belnk[1].txt
00159564  Cookie/WUpd                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@revenue[1].txt
00159564  Cookie/WUpd                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.revenue.net/]
00162730  Cookie/Belnk                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@dist.belnk[2].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@com[1].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.com.com/]
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@com[2].txt
00167647  Cookie/Yadro                       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.yadro.ru/]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           F:\Documents and Settings\Administrator\Cookies\administrator@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@xiti[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.xiti.com/]
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fe.lea.lycos.fr/]
00167709  Cookie/fe.lea.lycos                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fe.lea.lycos[3].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[1].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[3].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[2].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.toplist.cz/]
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@toplist[4].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@statcounter[1].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.statcounter.com/]
00167760  Cookie/Hitslink                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[counter.hitslink.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@ad.yieldmanager[2].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@ad.yieldmanager[3].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[ad.yieldmanager.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@apmebf[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.apmebf.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.apmebf.com/]
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           F:\Documents and Settings\USER\Cookies\user@apmebf[2].txt
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.burstnet.com/]
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.burstnet.com/]
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@burstnet[2].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bs.serving-sys.com/]
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bs.serving-sys[1].txt
00168102  Cookie/Falkag                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@as1.falkag[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.weborama.fr/]
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@weborama[2].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adtech[1].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.adtech.de/]
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.adtech.de/]
00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[server.iad.liveperson.net/hc/34149639]
00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@server.iad.liveperson[1].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@fl01.ct2.comclick[2].txt
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00168116  Cookie/Comclick                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[fl01.ct2.comclick.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.advertising.com/]
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@advertising[2].txt
00170087  Cookie/Hbmediapro                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adopt.hbmediapro[3].txt
00170087  Cookie/Hbmediapro                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adopt.hbmediapro[2].txt
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[statse.webtrendslive.com/]
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@statse.webtrendslive[2].txt
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.overture.com/]
00170554  Cookie/Overture                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@overture[1].txt
00171633  Cookie/Cgi-bin                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@cgi-bin[1].txt
00171982  Cookie/QuestionMarket              TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@questionmarket[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@zedo[2].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.zedo.com/]
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.zedo.com/]
00172449  Cookie/MetriWeb                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@metriweb[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.bluestreak.com/]
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bluestreak[2].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@bluestreak[1].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.adrevolver.com/]
00186469  Cookie/Reliablestats               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@stats1.reliablestats[1].txt
00191644  Cookie/adultfriendfinder           TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@adultfriendfinder[2].txt
00199983  Cookie/Valueclick                  TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@valueclick[1].txt
00199984  Cookie/Searchportal                TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[searchportal.information.com/]
00217990  Cookie/WinFixer                    TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@winfixer[2].txt
00234869  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@media.fastclick[1].txt
00262024  Cookie/ErrorSafe                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@www.errorsafe[1].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.smartadserver.com/]
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.smartadserver.com/]
00293517  Cookie/AdDynamix                   TrackingCookie      No        0         Yes            No           C:\WINDOWS\Cookies\administrator@ads.addynamix[1].txt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\AINA\Hira_Divers_1\Andry\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\Archives_Iharo\Ryan\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\Archives_Iharo\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\Archives_Iharo\Photo\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\AINA\Hira_Divers_1\Temp.Htt
00298030  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\Archives_Iharo\Photo\Meengai\Temp.Htt
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\Archives_Iharo\Ryan\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\Archives_Iharo\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\AINA\Hira_Divers_1\Andry\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          C:\WINDOWS\Desktop\COM\desktop.ini
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\AINA\Hira_Divers_1\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\Archives_Iharo\Photo\Meengai\DESKTOP.INI
00298031  W32/Tearec.A.worm!CME-24           Virus/Worm          No        1         Yes            Yes          D:\Archives_Iharo\Photo\DESKTOP.INI
00380718  Adware/RogueAntimalware2008        Adware              No        0         Yes            No           F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir
00380718  Adware/RogueAntimalware2008        Adware              No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE
01185375  Application/Psexec.A               HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0002023.EXE
01185375  Application/Psexec.A               HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0002048.EXE
01185375  Application/Psexec.A               HackTools           No        0         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP14\A0003476.EXE
01196326  Cookie/GoClick                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.goclick.com/]
01196326  Cookie/GoClick                     TrackingCookie      No        0         Yes            No           C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\guoxcmyz.default\cookies.txt[.goclick.com/]
02885963  Rootkit/Booto.C                    Virus/Worm          No        0         Yes            Yes          F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP14\A0003455.SYS
02885963  Rootkit/Booto.C                    Virus/Worm          No        0         Yes            Yes          F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0002028.SYS
02885963  Rootkit/Booto.C                    Virus/Worm          No        0         Yes            Yes          F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001965.SYS
02912157  W32/Spamta.gen.worm                Virus/Worm          No        0         Yes            Yes          C:\Program Files\Softinterface, Inc\Convert Image\ConvertImage.exe
03541233  HackTool/Rebooter                  HackTools           No        0         Yes            No           F:\Program Files\Navilog1\Reboot.exe
03667161  Application/MicroAntivirus2009     HackTools           No        0         No             No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE[F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE][MicroAV.exe]
03667161  Application/MicroAntivirus2009     HackTools           No        0         No             No           F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir[F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir][MicroAV.exe]
03667320  Adware/RogueAntimalware2008        Adware              No        0         No             No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE[F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE][MicroAV.cpl]
03667320  Adware/RogueAntimalware2008        Adware              No        0         No             No           F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir[F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir][MicroAV.cpl]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.1]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110145.12.zip[sc.html.2]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.3]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110145.12.zip[sc.html.1]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110145.12.zip[sc.html]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.2]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.4]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104223,70.zip[sc.html]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_110550.40.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.4]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104223,70.zip[sc.html.1]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104223,70.zip[sc.html.2]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.1]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.2]
03690171  Adware/SecurityCenter              Adware              No        0         Yes            No           F:\QooBox\Quarantine\catchme2008-09-22_104701.65.zip[Documents and Settings/user/Bureau/catchme.zip][sc.html.3]
03723613  Generic Trojan                     Virus/Trojan        No        0         Yes            Yes          F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP11\A0001694.EXE
03725600  Spyware/Virtumonde                 Spyware             No        1         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP11\A0001838.DLL
03738576  Generic Trojan                     Virus/Trojan        No        0         No             No           F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir[F:\QooBox\Quarantine\F\Program Files\PCHealthCenter\5.exe.vir][MicroAV1.dat]
03738576  Generic Trojan                     Virus/Trojan        No        0         No             No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE[F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001953.EXE][MicroAV1.dat]
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           F:\Documents and Settings\USER\Bureau\ComboFix.exe[32788R22FWJFW\catchme.cfexe]
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           F:\Documents and Settings\USER\Local Settings\Application Data\Opera\Opera\PROFILE\CACHE4\opr001RG[32788R22FWJFW\catchme.cfexe]
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP13\A0003417.EXE[32788R22FWJFW\catchme.cfexe]
03738686  Generic Malware                    Virus/Trojan        No        0         Yes            No           F:\Program Files\Navilog1\CATCHME.EXE
03742989  Spyware/Virtumonde                 Spyware             No        1         Yes            No           F:\System Volume Information\_restore{3EE65515-0D74-446D-BF89-0112622AD0FE}\RP12\A0001964.DLL
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              J
;===================================================================================================================================================================================
No        F:\Program Files\KGB\MPK.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          J
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                J
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Destrio5 · Answer

KGB, ça te dit quelque chose ?

bona_2 · Answer

KGB, c'est un logiciel que j'utilise recement, mais je peut le désinstaller s'il pose un problème

Destrio5 · Answer

Mais il sert à quoi ?

bona_2 · Answer

KGB employee monitor, utliser pour le contrôle des PC à distance, c'est juste une version essai

Destrio5 · Answer

/!\ Seul bona_2 peut suivre cette procédure /!\


1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

File::
D:\AINA\Hira_Divers_1\Andry\Temp.Htt
D:\Archives_Iharo\Ryan\Temp.Htt
D:\Archives_Iharo\Temp.Htt
D:\Archives_Iharo\Photo\Temp.Htt
D:\AINA\Hira_Divers_1\Temp.Htt
D:\Archives_Iharo\Photo\Meengai\Temp.Htt
D:\Archives_Iharo\Ryan\DESKTOP.INI
D:\Archives_Iharo\DESKTOP.INI
D:\AINA\Hira_Divers_1\Andry\DESKTOP.INI
C:\WINDOWS\Desktop\COM\desktop.ini
D:\AINA\Hira_Divers_1\DESKTOP.INI
D:\Archives_Iharo\Photo\Meengai\DESKTOP.INI
D:\Archives_Iharo\Photo\DESKTOP.INI 






---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

bona_2 · Answer

ComboFix 08-09-20.05 - user 2008-09-29 10:24:12.4 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.78 [GMT 3:00] Lancé depuis: F:\Documents and Settings\user\Bureau\ComboFix.exe Commutateurs utilisés :: F:\Documents and Settings\user\Bureau\CFScript.txt * Un nouveau point de restauration a été créé [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . - Mode FONCTIONNALITES REDUITES - FILE :: C:\WINDOWS\Desktop\COM\desktop.ini D:\AINA\Hira_Divers_1\Andry\DESKTOP.INI D:\AINA\Hira_Divers_1\Andry\Temp.Htt D:\AINA\Hira_Divers_1\DESKTOP.INI D:\AINA\Hira_Divers_1\Temp.Htt D:\Archives_Iharo\DESKTOP.INI D:\Archives_Iharo\Photo\DESKTOP.INI D:\Archives_Iharo\Photo\Meengai\DESKTOP.INI D:\Archives_Iharo\Photo\Meengai\Temp.Htt D:\Archives_Iharo\Photo\Temp.Htt D:\Archives_Iharo\Ryan\DESKTOP.INI D:\Archives_Iharo\Ryan\Temp.Htt D:\Archives_Iharo\Temp.Htt . ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-28 au 2008-09-29 )))))))))))))))))))))))))))))))))))) . 2008-09-25 13:32 . 2008-06-19 17:24 28,544 --a------ F:\WINDOWS\system32\drivers\pavboot.sys 2008-09-25 13:31 . 2008-09-25 13:31 d-------- F:\Program Files\Panda Security 2008-09-25 12:49 . 2008-09-25 12:49 d--hs---- F:\FOUND.002 2008-09-24 14:40 . 2003-08-16 11:07 172,032 --a------ F:\WINDOWS\system32\poweroff.exe 2008-09-24 13:57 . 2008-09-24 13:57 d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-09-22 15:36 . 2008-09-22 15:36 d-------- F:\Program Files\Malwarebytes' Anti-Malware 2008-09-22 15:36 . 2008-09-22 15:36 d-------- F:\Documents and Settings\user\Application Data\Malwarebytes 2008-09-22 15:36 . 2008-09-22 15:36 d-------- F:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-22 15:36 . 2008-09-10 00:04 38,528 --a------ F:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-22 15:36 . 2008-09-10 00:03 17,200 --a------ F:\WINDOWS\system32\drivers\mbam.sys 2008-09-22 15:15 . 2008-09-22 15:15 d--hs---- F:\FOUND.001 2008-09-18 13:44 . 2008-09-18 13:44 d-------- F:\Documents and Settings\user\Application Data\Radmin Communication Client 2008-09-18 09:54 . 2008-09-18 09:54 d-------- F:\Program Files\Runtime Software 2008-09-16 16:59 . 2008-09-16 16:59 d-------- F:\Documents and Settings\Administrator\Application Data\Radmin Communication Client 2008-09-16 16:58 . 2008-09-16 16:58 d-------- F:\Program Files\Radmin Communication Client 3.0 2008-09-16 16:42 . 2008-09-16 16:42 d-------- F:\Program Files\PCNetSoftware 2008-09-16 15:51 . 2007-10-18 20:48 83,288 --a------ F:\WINDOWS\system32\LMIRfsClientNP.dll 2008-09-16 15:51 . 2007-10-18 20:47 75,064 --a------ F:\WINDOWS\system32\LMIinit.dll 2008-09-16 15:51 . 2007-09-12 10:20 46,112 --a------ F:\WINDOWS\system32\drivers\LMIRfsDriver.sys 2008-09-16 15:51 . 2007-10-18 20:47 21,496 --a------ F:\WINDOWS\system32\LMIport.dll 2008-09-16 15:50 . 2008-09-16 15:50 d-------- F:\Program Files\LogMeIn 2008-09-16 15:02 . 2008-09-16 15:02 d-------- F:\Program Files\UltraVNC 2008-09-09 15:31 . 2008-09-09 15:31 d-------- F:\Program Files\VirginMega 2008-09-09 15:11 . 2008-09-09 15:11 d-------- F:\Program Files\Windows Media Connect 2 2008-09-09 14:45 . 2008-09-09 14:45 d-------- F:\WINDOWS\system32\drivers\umdf 2008-09-09 10:34 . 2008-09-09 10:34 d--h----- F:\WINDOWS\$hf_mig$ 2008-09-08 09:26 . 2008-09-08 09:26 d-------- F:\Program Files\Intelore 2008-09-05 16:08 . 2008-09-05 16:08 d--hs---- F:\FOUND.000 2008-09-05 16:02 . 2008-09-05 16:02 d-------- F:\Documents and Settings\user\Application Data\ZIP RAR ACE Password Recovery 2008-09-05 15:43 . 2008-09-05 15:43 d-------- F:\Program Files\RAR Password Cracker 2008-09-05 15:35 . 2008-09-05 15:35 d-------- F:\Program Files\Active Data Recovery Software 2008-09-04 15:18 . 2008-09-04 15:18 12 --a------ F:\WINDOWS\system32\usbsys.tmp 2008-09-03 16:50 . 2008-09-03 16:50 d--hs---- F:\Documents and Settings\Administrator\UserData 2008-09-03 16:46 . 2008-09-03 16:46 d-------- F:\Documents and Settings\Administrator\Application Data\TopLang 2008-09-02 15:53 . 2008-09-02 15:53 d-------- F:\Program Files\Desktop Lock 2008-09-02 15:16 . 2008-09-02 15:16 d-------- F:\Documents and Settings\user\Application Data\TopLang 2008-09-02 14:43 . 2008-09-04 11:08 2,197 --a------ F:\WINDOWS\kmuusb.sys 2008-09-02 14:43 . 2008-09-04 11:08 6 --a------ F:\WINDOWS\kmuudr.sys 2008-09-02 14:42 . 2008-09-02 14:42 d-------- F:\Documents and Settings\All Users\Application Data\MyUSBOnly 2008-09-02 13:45 . 2008-09-02 13:45 d--hs---- F:\Program Files\KGB 2008-09-02 13:45 . 2008-09-02 13:45 d--hs---- F:\Documents and Settings\All Users\Application Data\MPK 2008-09-02 13:45 . 2008-09-02 13:45 480 --a------ F:\WINDOWS\system32\runkgb.lnk . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-29 07:25 18,030 ----a-w F:\WINDOWS\system32\drivers\DeskLock.sys 2008-08-20 11:30 --------- d-----w F:\Program Files\PDF2Word v1.6 2008-08-18 12:27 --------- d-----w F:\Documents and Settings\Administrator\Application Data\Babylon 2008-08-08 10:57 --------- d-----w F:\Program Files\EasyPHP1-8 2008-08-08 09:58 --------- d-----w F:\Program Files\IDAutomation.com Code 39 Free Font 2008-08-08 06:47 --------- d-----w F:\Program Files\Microsoft Silverlight 2008-08-05 11:02 --------- d-----w F:\Program Files\[u]0[/u]1-mp3search 2008-08-04 12:00 --------- d-----w F:\Program Files\myBabylon 2008-08-04 12:00 --------- d-----w F:\Program Files\Conduit 2008-08-04 12:00 --------- d-----w F:\Program Files\Babylon 2008-08-04 11:45 --------- d-----w F:\Documents and Settings\user\Application Data\Babylon 2008-08-04 11:45 --------- d-----w F:\Documents and Settings\All Users\Application Data\Babylon 2008-07-29 06:42 --------- d-----w F:\Program Files\Opera 2008-05-28 11:59 33 ----a-w F:\Documents and Settings\user\Application Data\pwcpsw.dat 2007-12-07 13:51 92,064 ----a-w F:\Documents and Settings\user\mqdmmdm.sys 2007-12-07 13:51 9,232 ----a-w F:\Documents and Settings\user\mqdmmdfl.sys 2007-12-07 13:51 79,328 ----a-w F:\Documents and Settings\user\mqdmserd.sys 2007-12-07 13:51 66,656 ----a-w F:\Documents and Settings\user\mqdmbus.sys 2007-12-07 13:51 6,208 ----a-w F:\Documents and Settings\user\mqdmcmnt.sys 2007-12-07 13:51 5,936 ----a-w F:\Documents and Settings\user\mqdmwhnt.sys 2007-12-07 13:51 4,048 ----a-w F:\Documents and Settings\user\mqdmcr.sys 2007-12-07 13:51 25,600 ----a-w F:\Documents and Settings\user\usbsermptxp.sys 2007-12-07 13:51 22,768 ----a-w F:\Documents and Settings\user\usbsermpt.sys . ((((((((((((((((((((((((((((( snapshot_2008-09-24_ 9.23.30.07 ))))))))))))))))))))))))))))))))))))))))) . + 2008-06-30 07:39:58 128,256 ----a-w F:\WINDOWS\Downloaded Program Files\as2stubie.dll + 2005-05-16 16:34:48 213,048 ----a-w F:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2008-08-13 12:03:26 65,536 ----a-w F:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2008-08-13 12:03:26 798,720 ----a-w F:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll + 2008-09-29 07:26:02 16,384 ----a-w F:\WINDOWS\Temp\Perflib_Perfdata_5c8.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360] "MsnMsgr"="F:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "PcSync"="F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984] "Yahoo! Pager"="F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 222080] "USB_FW"="F:\Program Files\Net Studio\USB_FW.exe" [2008-05-21 1299968] "SuperCopier2.exe"="F:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PCSuiteTrayApplication"="F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 229376] "HP SchedIndexer"="F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe" [2001-02-19 86016] "HP AutoIndexer"="F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe" [2001-02-19 77824] "NeroFilterCheck"="F:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "COMODO Firewall Pro"="F:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-03 1115728] "!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-06-19 6731312] "Babylon Client"="F:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [2007-12-20 3116768] "Desktop Lock Loader"="F:\PROGRA~1\DESKTO~1\TLDL.EXE" [2008-05-02 151552] "LogMeIn GUI"="F:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-09-12 63048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] "Mpk.exe"="F:\Program Files\KGB\Mpk.exe" [2007-10-22 1281536] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LoginPrompt"= 9E8C8182988584 "NoViewOnDrive"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2007-10-18 20:47 75064 F:\WINDOWS\system32\LMIinit.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "F:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"= "F:\Program Files\Messenger\msmsgs.exe"= "F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"= "F:\Program Files\Yahoo!\Messenger\YServer.exe"= "F:\Program Files\Skype\Phone\Skype.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "F:\Program Files\MSN Messenger\MsnMsgr.Exe"= "F:\Program Files\MSN Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5900:TCP"= 5900:TCP:vnc5900 "5800:TCP"= 5800:TCP:vnc5800 R0 pavboot;pavboot;F:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] R1 aswSP;avast! Self Protection;F:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R1 DeskLock;DeskLock;F:\WINDOWS\system32\drivers\DeskLock.sys [2008-09-29 18030] R2 aswFsBlk;aswFsBlk;F:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 LMIInfo;LogMeIn Kernel Information Provider;F:\Program Files\LogMeIn\x86\RaInfo.sys [2007-09-12 12992] R2 LMIRfsDriver;LogMeIn Remote File System Driver;F:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 46112] R2 Poweroff;Poweroff;F:\WINDOWS\system32\poweroff.exe [2003-08-16 172032] S3 MiniScanEye;MiniScanEye;F:\WINDOWS\system32\Drivers\minsceye.sys [2005-02-16 14382] S3 pendfu;PenDfu (pendfu.sys);F:\WINDOWS\system32\Drivers\pendfu.sys [2005-02-14 32408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-29 10:29:09 Windows 5.1.2600 Service Pack 3 FAT NTAPI Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mchInjDrv] "ImagePath"="\??\F:\DOCUME~1\user\LOCALS~1\Temp\mc22.tmp" . --------------------- DLLs chargées dans les processus actifs --------------------- PROCESSUS: F:\WINDOWS\explorer.exe -> F:\Program Files\KGB\MPK.dll . ------------------------ Autres processus actifs ------------------------ . F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe F:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe F:\Program Files\Comodo\Firewall\cmdagent.exe F:\Program Files\LogMeIn\x86\RaMaint.exe F:\Program Files\LogMeIn\x86\LogMeIn.exe F:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe F:\Program Files\Alwil Software\Avast4\ashWebSv.exe F:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe F:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe F:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe F:\WINDOWS\system32\INTERNAT.EXE . ************************************************************************** . Heure de fin: 2008-09-29 10:39:41 - La machine a redémarré ComboFix-quarantined-files.txt 2008-09-29 07:39:20 ComboFix3.txt 2008-09-22 08:13:44 ComboFix2.txt 2008-09-24 06:24:44 Avant-CF: 387ÿ211ÿ264 octets libres Après-CF: 656,965,632 octets libres 210

bona_2 · Answer

rapport après une mise à jour de combofix ComboFix 08-09-27.06 - user 2008-09-29 10:58:09.5 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.42 [GMT 3:00] Lancé depuis: F:\Documents and Settings\user\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-28 au 2008-09-29 )))))))))))))))))))))))))))))))))))) . 2008-09-25 13:32 . 2008-06-19 17:24 28,544 --a------ F:\WINDOWS\system32\drivers\pavboot.sys 2008-09-25 13:31 . 2008-09-25 13:31 d-------- F:\Program Files\Panda Security 2008-09-25 12:49 . 2008-09-25 12:49 d--hs---- F:\FOUND.002 2008-09-24 14:40 . 2003-08-16 11:07 172,032 --a------ F:\WINDOWS\system32\poweroff.exe 2008-09-24 13:57 . 2008-09-24 13:57 d-------- F:\WINDOWS\system32\Kaspersky Lab 2008-09-22 15:36 . 2008-09-22 15:36 d-------- F:\Program Files\Malwarebytes' Anti-Malware 2008-09-22 15:36 . 2008-09-22 15:36 d-------- F:\Documents and Settings\user\Application Data\Malwarebytes 2008-09-22 15:36 . 2008-09-22 15:36 d-------- F:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-22 15:36 . 2008-09-10 00:04 38,528 --a------ F:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-22 15:36 . 2008-09-10 00:03 17,200 --a------ F:\WINDOWS\system32\drivers\mbam.sys 2008-09-22 15:15 . 2008-09-22 15:15 d--hs---- F:\FOUND.001 2008-09-18 13:44 . 2008-09-18 13:44 d-------- F:\Documents and Settings\user\Application Data\Radmin Communication Client 2008-09-18 09:54 . 2008-09-18 09:54 d-------- F:\Program Files\Runtime Software 2008-09-16 16:59 . 2008-09-16 16:59 d-------- F:\Documents and Settings\Administrator\Application Data\Radmin Communication Client 2008-09-16 16:58 . 2008-09-16 16:58 d-------- F:\Program Files\Radmin Communication Client 3.0 2008-09-16 16:42 . 2008-09-16 16:42 d-------- F:\Program Files\PCNetSoftware 2008-09-16 15:51 . 2007-10-18 20:48 83,288 --a------ F:\WINDOWS\system32\LMIRfsClientNP.dll 2008-09-16 15:51 . 2007-10-18 20:47 75,064 --a------ F:\WINDOWS\system32\LMIinit.dll 2008-09-16 15:51 . 2007-09-12 10:20 46,112 --a------ F:\WINDOWS\system32\drivers\LMIRfsDriver.sys 2008-09-16 15:51 . 2007-10-18 20:47 21,496 --a------ F:\WINDOWS\system32\LMIport.dll 2008-09-16 15:50 . 2008-09-16 15:50 d-------- F:\Program Files\LogMeIn 2008-09-16 15:02 . 2008-09-16 15:02 d-------- F:\Program Files\UltraVNC 2008-09-09 15:31 . 2008-09-09 15:31 d-------- F:\Program Files\VirginMega 2008-09-09 15:11 . 2008-09-09 15:11 d-------- F:\Program Files\Windows Media Connect 2 2008-09-09 14:45 . 2008-09-09 14:45 d-------- F:\WINDOWS\system32\drivers\umdf 2008-09-09 10:34 . 2008-09-09 10:34 d--h----- F:\WINDOWS\$hf_mig$ 2008-09-08 09:26 . 2008-09-08 09:26 d-------- F:\Program Files\Intelore 2008-09-05 16:08 . 2008-09-05 16:08 d--hs---- F:\FOUND.000 2008-09-05 16:02 . 2008-09-05 16:02 d-------- F:\Documents and Settings\user\Application Data\ZIP RAR ACE Password Recovery 2008-09-05 15:43 . 2008-09-05 15:43 d-------- F:\Program Files\RAR Password Cracker 2008-09-05 15:35 . 2008-09-05 15:35 d-------- F:\Program Files\Active Data Recovery Software 2008-09-04 15:18 . 2008-09-04 15:18 12 --a------ F:\WINDOWS\system32\usbsys.tmp 2008-09-03 16:50 . 2008-09-03 16:50 d--hs---- F:\Documents and Settings\Administrator\UserData 2008-09-03 16:46 . 2008-09-03 16:46 d-------- F:\Documents and Settings\Administrator\Application Data\TopLang 2008-09-02 15:53 . 2008-09-02 15:53 d-------- F:\Program Files\Desktop Lock 2008-09-02 15:16 . 2008-09-02 15:16 d-------- F:\Documents and Settings\user\Application Data\TopLang 2008-09-02 14:43 . 2008-09-04 11:08 2,197 --a------ F:\WINDOWS\kmuusb.sys 2008-09-02 14:43 . 2008-09-04 11:08 6 --a------ F:\WINDOWS\kmuudr.sys 2008-09-02 14:42 . 2008-09-02 14:42 d-------- F:\Documents and Settings\All Users\Application Data\MyUSBOnly 2008-09-02 13:45 . 2008-09-02 13:45 d--hs---- F:\Program Files\KGB 2008-09-02 13:45 . 2008-09-02 13:45 d--hs---- F:\Documents and Settings\All Users\Application Data\MPK 2008-09-02 13:45 . 2008-09-02 13:45 480 --a------ F:\WINDOWS\system32\runkgb.lnk . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-29 07:25 18,030 ----a-w F:\WINDOWS\system32\drivers\DeskLock.sys 2008-08-20 11:30 --------- d-----w F:\Program Files\PDF2Word v1.6 2008-08-18 12:27 --------- d-----w F:\Documents and Settings\Administrator\Application Data\Babylon 2008-08-08 10:57 --------- d-----w F:\Program Files\EasyPHP1-8 2008-08-08 09:58 --------- d-----w F:\Program Files\IDAutomation.com Code 39 Free Font 2008-08-08 06:47 --------- d-----w F:\Program Files\Microsoft Silverlight 2008-08-05 11:02 --------- d-----w F:\Program Files\[u]0[/u]1-mp3search 2008-08-04 12:00 --------- d-----w F:\Program Files\myBabylon 2008-08-04 12:00 --------- d-----w F:\Program Files\Conduit 2008-08-04 12:00 --------- d-----w F:\Program Files\Babylon 2008-08-04 11:45 --------- d-----w F:\Documents and Settings\user\Application Data\Babylon 2008-08-04 11:45 --------- d-----w F:\Documents and Settings\All Users\Application Data\Babylon 2008-07-29 06:42 --------- d-----w F:\Program Files\Opera 2008-05-28 11:59 33 ----a-w F:\Documents and Settings\user\Application Data\pwcpsw.dat 2007-12-07 13:51 92,064 ----a-w F:\Documents and Settings\user\mqdmmdm.sys 2007-12-07 13:51 9,232 ----a-w F:\Documents and Settings\user\mqdmmdfl.sys 2007-12-07 13:51 79,328 ----a-w F:\Documents and Settings\user\mqdmserd.sys 2007-12-07 13:51 66,656 ----a-w F:\Documents and Settings\user\mqdmbus.sys 2007-12-07 13:51 6,208 ----a-w F:\Documents and Settings\user\mqdmcmnt.sys 2007-12-07 13:51 5,936 ----a-w F:\Documents and Settings\user\mqdmwhnt.sys 2007-12-07 13:51 4,048 ----a-w F:\Documents and Settings\user\mqdmcr.sys 2007-12-07 13:51 25,600 ----a-w F:\Documents and Settings\user\usbsermptxp.sys 2007-12-07 13:51 22,768 ----a-w F:\Documents and Settings\user\usbsermpt.sys . ((((((((((((((((((((((((((((( snapshot_2008-09-24_ 9.23.30.07 ))))))))))))))))))))))))))))))))))))))))) . + 2008-06-30 07:39:58 128,256 ----a-w F:\WINDOWS\Downloaded Program Files\as2stubie.dll + 2005-05-16 16:34:48 213,048 ----a-w F:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2008-08-13 12:03:26 65,536 ----a-w F:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2008-08-13 12:03:26 798,720 ----a-w F:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll + 2008-09-29 07:26:02 16,384 ----a-w F:\WINDOWS\Temp\Perflib_Perfdata_5c8.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360] "MsnMsgr"="F:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "PcSync"="F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984] "Yahoo! Pager"="F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "AlcoholAutomount"="F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 222080] "USB_FW"="F:\Program Files\Net Studio\USB_FW.exe" [2008-05-21 1299968] "SuperCopier2.exe"="F:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PCSuiteTrayApplication"="F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 229376] "HP SchedIndexer"="F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe" [2001-02-19 86016] "HP AutoIndexer"="F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe" [2001-02-19 77824] "NeroFilterCheck"="F:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "COMODO Firewall Pro"="F:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-03 1115728] "!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-06-19 6731312] "Babylon Client"="F:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [2007-12-20 3116768] "Desktop Lock Loader"="F:\PROGRA~1\DESKTO~1\TLDL.EXE" [2008-05-02 151552] "LogMeIn GUI"="F:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-09-12 63048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] "Mpk.exe"="F:\Program Files\KGB\Mpk.exe" [2007-10-22 1281536] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LoginPrompt"= 9E8C8182988584 "NoViewOnDrive"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoViewOnDrive"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2007-10-18 20:47 75064 F:\WINDOWS\system32\LMIinit.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "F:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"= "F:\Program Files\Messenger\msmsgs.exe"= "F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"= "F:\Program Files\Yahoo!\Messenger\YServer.exe"= "F:\Program Files\Skype\Phone\Skype.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "F:\Program Files\MSN Messenger\MsnMsgr.Exe"= "F:\Program Files\MSN Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5900:TCP"= 5900:TCP:vnc5900 "5800:TCP"= 5800:TCP:vnc5800 R0 pavboot;pavboot;F:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] R1 aswSP;avast! Self Protection;F:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R1 DeskLock;DeskLock;F:\WINDOWS\system32\drivers\DeskLock.sys [2008-09-29 18030] R2 aswFsBlk;aswFsBlk;F:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 LMIInfo;LogMeIn Kernel Information Provider;F:\Program Files\LogMeIn\x86\RaInfo.sys [2007-09-12 12992] R2 LMIRfsDriver;LogMeIn Remote File System Driver;F:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 46112] R2 Poweroff;Poweroff;F:\WINDOWS\system32\poweroff.exe [2003-08-16 172032] S3 MiniScanEye;MiniScanEye;F:\WINDOWS\system32\Drivers\minsceye.sys [2005-02-16 14382] S3 pendfu;PenDfu (pendfu.sys);F:\WINDOWS\system32\Drivers\pendfu.sys [2005-02-14 32408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . . ------- Examen supplémentaire ------- . R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/ R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} O8 -: E&xporter vers Microsoft Excel - F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 -: Translate with &Babylon - F:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm O17 -: HKLM\CCS\Interface\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer = 62.56.162.33,62.56.240.40 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-29 11:01:00 Windows 5.1.2600 Service Pack 3 FAT NTAPI Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\mchInjDrv] "ImagePath"="\??\F:\DOCUME~1\user\LOCALS~1\Temp\mc22.tmp" . --------------------- DLLs chargées dans les processus actifs --------------------- PROCESSUS: F:\WINDOWS\explorer.exe -> F:\Program Files\KGB\MPK.dll . Heure de fin: 2008-09-29 11:02:22 ComboFix-quarantined-files.txt 2008-09-29 08:02:14 ComboFix4.txt 2008-09-22 08:13:44 ComboFix3.txt 2008-09-24 06:24:44 ComboFix2.txt 2008-09-29 07:39:46 Avant-CF: 599ÿ662ÿ592 octets libres Après-CF: 586,883,072 octets libres 183

Destrio5 · Answer

Poste un nouveau rapport HijackThis.

bona_2 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:41:11, on 29/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\Comodo\Firewall\cmdagent.exe
F:\Program Files\LogMeIn\x86\RaMaint.exe
F:\Program Files\LogMeIn\x86\LogMeIn.exe
F:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\poweroff.exe
F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
F:\Program Files\Comodo\Firewall\CPF.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\Program Files\Babylon\Babylon-Pro\Babylon.exe
F:\PROGRA~1\DESKTO~1\TLDL.EXE
F:\Program Files\LogMeIn\x86\LogMeInSystray.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
F:\Program Files\Net Studio\USB_FW.exe
F:\Program Files\SuperCopier2\SuperCopier2.exe
F:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
F:\WINDOWS\System32\alg.exe
F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe
F:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
F:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
F:\WINDOWS\system32\INTERNAT.EXE
F:\WINDOWS\explorer.exe
F:\Program Files\MSN Messenger\msnmsgr.exe
F:\Program Files\internet explorer\iexplore.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - F:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Easy Gif Animator Toolbar Helper - {96372AB6-15EB-4316-B497-71C741BC548C} - F:\Program Files\Easy Gif Animator Extension\v3.3.0.0\EasyGifAnimator_Toolbar.dll
O3 - Toolbar: Easy Gif Animator Toolbar - {35065594-9169-4A34-B167-FC4865038E53} - F:\Program Files\Easy Gif Animator Extension\v3.3.0.0\EasyGifAnimator_Toolbar.dll
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [HP SchedIndexer] F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe
O4 - HKLM\..\Run: [HP AutoIndexer] F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Babylon Client] F:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [Desktop Lock Loader] F:\PROGRA~1\DESKTO~1\TLDL.EXE /BOOT
O4 - HKLM\..\Run: [LogMeIn GUI] "F:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "F:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PcSync] F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AlcoholAutomount] "F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [USB_FW] F:\Program Files\Net Studio\USB_FW.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] F:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKLM\..\Policies\Explorer\Run: [Mpk.exe] F:\Program Files\KGB\Mpk.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = F:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP LaserJet Director.lnk = F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://F:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - F:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer = 62.56.162.33,62.56.240.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer = 62.56.162.33,62.56.240.40
O17 - HKLM\System\CS2\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer = 62.56.162.33,62.56.240.40
O17 - HKLM\System\CS3\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer = 62.56.162.33,62.56.240.40
O17 - HKLM\System\CS4\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer = 62.56.162.33,62.56.240.40
O17 - HKLM\System\CS5\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer = 62.56.162.33,62.56.240.40
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - F:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - F:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - F:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Poweroff - Jorgen Bosman - F:\WINDOWS\system32\poweroff.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

Destrio5 · Answer

Tu as encore des problèmes ou on peut passer à la dernière étape ?

bona_2 · Answer

jusqu'ici, non sauf qd je click 2 fois sur un liens internet une autre fenetre de pub apparait; de genre smart... si c'est pas un problème on peut passer à l'etape suivante

Destrio5 · Answer

Smart Antivirus ?

bona_2 · Answer

bien sur, et après une publicité du laptop Dell qui apparait

Destrio5 · Answer

- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) : 
http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/ 

- Enregistre-le sur le bureau

- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

- Un rapport sera généré, poste-le dans ta prochaine réponse.

[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix

bona_2 · Answer

SmitFraudFix v2.354

Rapport fait à 14:01:28,73, 29/09/2008
Executé à partir de F:\Documents and Settings\user\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\Comodo\Firewall\cmdagent.exe
F:\Program Files\LogMeIn\x86\RaMaint.exe
F:\Program Files\LogMeIn\x86\LogMeIn.exe
F:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\poweroff.exe
F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\Program Files\KGB\Mpk.exe
F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
F:\Program Files\Comodo\Firewall\CPF.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\Program Files\Babylon\Babylon-Pro\Babylon.exe
F:\PROGRA~1\DESKTO~1\TLDL.EXE
F:\Program Files\LogMeIn\x86\LogMeInSystray.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
F:\Program Files\Net Studio\USB_FW.exe
F:\Program Files\SuperCopier2\SuperCopier2.exe
F:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
F:\WINDOWS\System32\alg.exe
F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe
F:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
F:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
F:\WINDOWS\system32\INTERNAT.EXE
F:\WINDOWS\explorer.exe
F:\Program Files\MSN Messenger\msnmsgr.exe
F:\Program Files\internet explorer\iexplore.exe
F:\WINDOWS\system32\cmd.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» F:\


»»»»»»»»»»»»»»»»»»»»»»»» F:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» F:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» F:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» F:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» F:\Documents and Settings\user


»»»»»»»»»»»»»»»»»»»»»»»» F:\Documents and Settings\user\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» F:\DOCUME~1\user\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» F:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="F:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte Fast Ethernet compatible VIA - Miniport d'ordonnancement de paquets
DNS Server Search Order: 62.56.162.33
DNS Server Search Order: 62.56.240.40

HKLM\SYSTEM\CCS\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer=62.56.162.33,62.56.240.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer=62.56.162.33,62.56.240.40
HKLM\SYSTEM\CS2\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer=62.56.162.33,62.56.240.40
HKLM\SYSTEM\CS3\Services\Tcpip\..\{17821C9B-63E4-43EF-ADF4-FA97CBD4BED5}: NameServer=62.56.162.33,62.56.240.40


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Destrio5 · Answer

Tu peux me poster un rapport Navilog1 ?

bona_2 · Answer

Search Navipromo version 3.6.1 commencé le 29/09/2008 à 14:14:02,84

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis F:\Program Files
avilog1
Session actuelle : "user" 

Mise à jour le 19.07.2008 à 20h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13 
Système de fichiers : FAT32

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "F:\WINDOWS" ***


*** Recherche dossiers dans "F:\Program Files" ***


*** Recherche dossiers dans "F:\Documents and Settings\All Users\menudÉ~1\progra~1" ***


*** Recherche dossiers dans "F:\Documents and Settings\All Users\menudÉ~1" ***


*** Recherche dossiers dans "f:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "F:\Documents and Settings\user\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\ADMINI~2\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\TOKY\applic~1" *** 


*** Recherche dossiers dans "F:\Documents and Settings\user\locals~1\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\ADMINI~2\locals~1\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\TOKY\locals~1\applic~1" *** 


*** Recherche dossiers dans "F:\Documents and Settings\user\menud+~1\progra~1" *** 

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier Navipromo trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "F:\WINDOWS\system32" *

* Recherche dans "F:\Documents and Settings\user\locals~1\applic~1" * 

* Recherche dans "F:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 

* Recherche dans "F:\DOCUME~1\ADMINI~2\locals~1\applic~1" * 

* Recherche dans "F:\DOCUME~1\TOKY\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "F:\WINDOWS\system32" :


* Dans "F:\Documents and Settings\user\locals~1\applic~1" : 


* Dans "F:\DOCUME~1\ADMINI~1\locals~1\applic~1" : 


* Dans "F:\DOCUME~1\ADMINI~2\locals~1\applic~1" : 


* Dans "F:\DOCUME~1\TOKY\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 29/09/2008 à 14:15:36,31 ***

Destrio5 · Answer

C'est une vieille version. Utilise celle-ci :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

bona_2 · Answer

Search Navipromo version 3.6.5 commencé le 29/09/2008 à 14:23:52,00

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis F:\Program Files
avilog1
Session actuelle : "user" 

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13 
Système de fichiers : FAT32

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "F:\WINDOWS" ***


*** Recherche dossiers dans "F:\Program Files" ***


*** Recherche dossiers dans "F:\Documents and Settings\All Users\menudÉ~1\progra~1" ***


*** Recherche dossiers dans "F:\Documents and Settings\All Users\menudÉ~1" ***


*** Recherche dossiers dans "f:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "F:\Documents and Settings\user\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\ADMINI~2\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\TOKY\applic~1" *** 


*** Recherche dossiers dans "F:\Documents and Settings\user\locals~1\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\ADMINI~2\locals~1\applic~1" *** 


*** Recherche dossiers dans "F:\DOCUME~1\TOKY\locals~1\applic~1" *** 


*** Recherche dossiers dans "F:\Documents and Settings\user\menud+~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "F:\WINDOWS\system32" *

* Recherche dans "F:\Documents and Settings\user\locals~1\applic~1" * 

* Recherche dans "F:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 

* Recherche dans "F:\DOCUME~1\ADMINI~2\locals~1\applic~1" * 

* Recherche dans "F:\DOCUME~1\TOKY\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "F:\WINDOWS\system32" :


* Dans "F:\Documents and Settings\user\locals~1\applic~1" : 


* Dans "F:\DOCUME~1\ADMINI~1\locals~1\applic~1" : 


* Dans "F:\DOCUME~1\ADMINI~2\locals~1\applic~1" : 


* Dans "F:\DOCUME~1\TOKY\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 29/09/2008 à 14:25:59,04 ***

Destrio5 · Answer

---> Tu peux désinstaller Navilog1

As-tu des pubs avec écrit CiD ?

bona_2 · Answer

on dirait que le pub n'apparait plus, je vais desinstaller navilog

Destrio5 · Answer

---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download

---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

---> Télécharge Tools Cleaner sur ton bureau.
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
Clique sur Recherche et laisse le scan agir.
Clique sur Suppression pour finaliser. 
Tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter pour obtenir le rapport. 
Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme

---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php

---> Je te conseille également de remplacer Avast par Antivir

bona_2 · Answer

Navilog est maintenant désinstallé de mon ordi

bona_2 · Answer

[ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

F:\Combofix.txt: trouvé !
F:\fixnavi.txt: trouvé !
F:\cleannavi.txt: trouvé !
F:\Qoobox: trouvé !
F:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
F:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
F:\Documents and Settings\user\Bureau\HijackThis.lnk: trouvé !
F:\Documents and Settings\user\Bureau\ComboFix.exe: trouvé !
F:\Documents and Settings\user\Bureau\SmitFraudFix.exe: trouvé !
F:\Documents and Settings\user\Bureau\hijackthis.log: trouvé !
F:\Documents and Settings\user\Bureau\SmitFraudfix: trouvé !
F:\Documents and Settings\user\Bureau
avilogv2_29sept\Navilog1.exe: trouvé !
F:\Documents and Settings\user\Bureau
avilogv2_29sept\ComboFix.exe: trouvé !
F:\Documents and Settings\user\Bureau
avilogv2_29sept\SmitFraudFix.exe: trouvé !
F:\Program Files\Navilog1: trouvé !
F:\Program Files\Trend Micro\HijackThis: trouvé !
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
F:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
-->- Suppression: 

F:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
F:\Documents and Settings\user\Bureau\HijackThis.lnk: supprimé !
F:\Documents and Settings\user\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
F:\Documents and Settings\user\Bureau\SmitFraudFix.exe: supprimé !
F:\Documents and Settings\user\Bureau
avilogv2_29sept\Navilog1.exe: supprimé !
F:\Documents and Settings\user\Bureau
avilogv2_29sept\ComboFix.exe: supprimé !
F:\Documents and Settings\user\Bureau
avilogv2_29sept\SmitFraudFix.exe: supprimé !
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
F:\Combofix.txt: supprimé !
F:\fixnavi.txt: supprimé !
F:\cleannavi.txt: supprimé !
F:\Documents and Settings\user\Bureau\hijackthis.log: supprimé !
F:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
F:\Qoobox: supprimé !
F:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
F:\Documents and Settings\user\Bureau\SmitFraudfix: supprimé !
F:\Program Files\Navilog1: supprimé !
F:\Program Files\Trend Micro\HijackThis: supprimé !

Destrio5 · Answer

Tu peux supprimer Tools Cleaner et ComboFix.

bona_2 · Answer

Merci à toi Destrio5, mon problème est résolu maintenant, j'essaye d'utiliser Antivir.
A+

Destrio5 · Answer

Ok, bonne journée ;)

bona_2 · Answer

un ptit souci, je scan avec antivir, sur C:/windows/system il detecte screensaverpopular.src, est-ce qu'on peut supprimer.
Mrc

Destrio5 · Answer

Oui.

bona_2 · Answer

Ok, Merci
Résolu

Virus detecté au demarrage de IE

45 réponses

Discussions similaires

Newsletters