Rapport hijackthis a décripter!!!

Tu peux me passer le lien vers ton message

ok...je fait comme tu dis et je revien poster le rapport.merci a +!!

j'ai fait comme tu as dis...seul prob:je n'arrive pas a telecharger LopS&D par le lien que tu m'as donné et j'ai tenté l'avoir sur cçm mais trouvé que pour XP suis sur VISTA!!! voici les rapports:
C:\ProgramData\Thunk Else Show.l27vhj7 moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05122008_180932

merde!!je ne trouve plus le rapport combofix!!???je dois recommencer??ou un hijackthis ira?

enfin!voila le rapport combofix...j'espere j'ai pas fait tro grosse gaffe!!!j'ai laissé eMule en marche et quand je m'en suis apperçu je n'ai pas oser toucher a quoi que ce soit:j'ai donc laissé faire comme ça et ça a été très long!!!!!

ComboFix 08-05-11.1 - jeff 2008-05-12 21:08:54.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6000.0.1252.1.1036.18.63 [GMT 2:00]
Endroit: C:\Users\jeff\Desktop\ComboFix.exe
Command switches used :: C:\Users\jeff\Desktop\CFscript.txt

FILE ::
C:\ProgramData\okay meet.tc66x
C:\ProgramData\Thunk Else Show.l27vhj7
.

((((((((((((((((((((((((((((( Fichiers créés 2008-04-12 to 2008-05-12 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 17:32 --------- d-----w C:\Users\jeff\AppData\Roaming\LimeWire
2008-05-12 14:04 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-05-12 12:36 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-11 21:26 --------- d-----w C:\ProgramData\Google Updater
2008-05-10 16:10 --------- d-----w C:\ProgramData\Messenger Plus!
2008-05-10 16:09 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-05-10 16:09 --------- d-----w C:\Program Files\Circle Developement
2008-05-10 15:54 --------- d-----w C:\ProgramData\WLInstaller
2008-05-09 19:03 --------- d-----w C:\Program Files\Yahoo!
2008-05-09 19:03 --------- d-----w C:\Program Files\CCleaner
2008-05-09 13:47 --------- d-----w C:\Program Files\Adverts
2008-05-09 12:11 --------- d-----w C:\Program Files\Trend Micro
2008-05-03 20:50 --------- d-----w C:\Program Files\a-squared Free
2008-05-03 13:41 --------- d-----w C:\ProgramData\BOONTY
2008-05-03 13:39 --------- d-----w C:\Program Files\Common Files\BOONTY Shared
2008-05-03 11:22 --------- d-----w C:\Program Files\LimeWire
2008-05-02 13:38 --------- d-----w C:\Users\eilidh\AppData\Roaming\Yahoo!
2008-05-02 09:05 --------- d-----w C:\Users\jeff\AppData\Roaming\DivX
2008-05-02 07:43 --------- d-----w C:\Program Files\Microsoft Games
2008-04-30 15:27 --------- d-----w C:\ProgramData\Buildwarnlog
2008-04-30 15:24 --------- d-----w C:\ProgramData\third lies itch ford
2008-04-30 15:02 --------- d-----w C:\Program Files\MessengerPlus! 3
2008-04-29 16:36 --------- d-----w C:\ProgramData\Apple Computer
2008-04-29 16:36 --------- d-----w C:\Program Files\VistaCodecPack
2008-04-29 16:29 --------- d-----w C:\Program Files\illiminable
2008-04-29 11:07 --------- d-----w C:\Program Files\DivX
2008-04-29 11:06 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-04-29 11:03 --------- d-----w C:\Users\jeff\AppData\Roaming\Yahoo!
2008-04-28 08:42 --------- d-----w C:\Users\jeff\AppData\Roaming\EPSON
2008-04-28 07:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-28 07:33 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-28 07:23 --------- d-----w C:\ProgramData\UDL
2008-04-28 07:20 --------- d-----w C:\Program Files\epson
2008-04-28 07:13 --------- d-----w C:\Program Files\ABBYY FineReader 6.0 Sprint
2008-04-28 07:05 --------- d-----w C:\Users\jeff\AppData\Roaming\InstallShield
2008-04-28 07:03 --------- d-----w C:\ProgramData\EPSON
2008-04-26 13:26 --------- d-----w C:\Users\jeff\AppData\Roaming\Ahead
2008-04-25 22:33 --------- d-----w C:\Program Files\Java
2008-04-24 18:59 --------- d-----w C:\Program Files\Common Files\Java
2008-04-23 21:27 --------- d-----w C:\Program Files\Windows Live
2008-04-23 20:40 --------- d-----w C:\Program Files\Micro Application
2008-04-23 20:19 --------- d-----w C:\Program Files\Google
2008-04-23 10:05 --------- d-----w C:\Users\jeff\AppData\Roaming\vlc
2008-04-23 10:05 --------- d-----w C:\Program Files\VideoLAN
2008-04-23 08:04 --------- d-----w C:\Program Files\Dofus
2008-04-23 01:14 --------- d-----w C:\Program Files\Windows Mail
2008-04-23 01:14 --------- d-----w C:\Program Files\Windows Defender
2008-04-23 01:14 --------- d-----w C:\Program Files\Windows Calendar
2008-04-23 01:06 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-04-23 01:05 49,664 ----a-w C:\Windows\System32\csrsrv.dll
2008-04-23 01:05 376,320 ----a-w C:\Windows\System32\winsrv.dll
2008-04-23 01:05 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-04-23 01:05 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-04-23 01:04 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-04-23 01:04 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-04-23 01:03 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-04-23 01:03 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-04-23 01:03 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-04-23 01:03 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-04-22 21:05 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-04-22 21:00 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-04-22 21:00 --------- d-----w C:\Program Files\Windows Live Favorites
2008-04-22 20:37 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-22 15:45 174 --sha-w C:\Program Files\desktop.ini
2008-04-22 15:39 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-22 15:33 86,016 ----a-w C:\Windows\System32\icfupgd.dll
2008-04-22 15:33 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-04-22 15:33 61,952 ----a-w C:\Windows\System32\cmifw.dll
2008-04-22 15:33 396,800 ----a-w C:\Windows\System32\MPSSVC.dll
2008-04-22 15:33 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll
2008-04-22 15:33 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-04-22 15:33 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll
2008-04-22 15:33 16,896 ----a-w C:\Windows\System32\wfapigp.dll
2008-04-22 15:33 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-04-22 15:32 --------- d-----w C:\Program Files\Alwil Software
2008-04-22 15:30 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-04-22 15:30 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-04-22 15:30 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-04-22 15:30 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-04-22 15:30 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-04-22 15:30 20,024 ----a-w C:\Windows\system32\drivers\viaide.sys
2008-04-22 15:30 2,048 ----a-w C:\Windows\System32\msxml3r.dll
2008-04-22 15:30 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-04-22 15:30 110,136 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-04-22 15:30 1,191,936 ----a-w C:\Windows\System32\msxml3.dll
2008-04-22 15:29 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2008-04-22 15:29 8,704 ----a-w C:\Windows\System32\hccoin.dll
2008-04-22 15:29 73,216 ----a-w C:\Windows\system32\drivers\usbccgp.sys
2008-04-22 15:29 5,888 ----a-w C:\Windows\system32\drivers\usbd.sys
2008-04-22 15:29 38,400 ----a-w C:\Windows\system32\drivers\usbehci.sys
2008-04-22 15:29 23,040 ----a-w C:\Windows\system32\drivers\usbuhci.sys
2008-04-22 15:29 224,768 ----a-w C:\Windows\system32\drivers\usbport.sys
2008-04-22 15:29 193,536 ----a-w C:\Windows\system32\drivers\usbhub.sys
2008-04-22 15:27 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-04-22 15:27 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-04-22 15:27 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-04-22 15:27 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-04-22 15:27 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-04-22 15:26 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-04-22 15:24 1,585,664 ----a-w C:\Windows\System32\setupapi.dll
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((( snapshot@2008-05-12_18.42.38.72 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-12 16:18:49 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-05-12 16:49:14 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-05-12 16:34:17 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2008-05-12 19:06:39 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2008-05-12 16:20:20 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-05-12 16:50:43 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-05-12 16:50:43 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-05-12 16:36:24 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2008-05-12 16:55:13 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2008-05-12 16:21:00 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-05-12 16:50:49 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-05-12 16:50:49 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-05-12 16:19:14 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-05-12 16:51:14 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-12 16:19:14 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-12 16:51:14 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-12 16:19:14 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-12 16:51:14 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-05-12 16:21:38 5,274 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1707246080-3803742055-1724597463-1000_UserData.bin
+ 2008-05-12 16:52:04 5,274 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1707246080-3803742055-1724597463-1000_UserData.bin
- 2008-05-12 16:21:38 53,104 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-05-12 16:52:04 53,190 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-05-12 16:21:17 26,774 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-05-12 16:51:36 27,124 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-23 21:34 68856]
"EPSON Stylus DX7400 Series"="C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.exe" [2007-04-12 08:00 182272]
"Itch ford four knob"="C:\ProgramData\Thunk Else Show.l27vhj7" [ ]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2008-04-30 17:02 190024]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-04-23 03:04 1006264]
"S3Trayp"="S3trayp.exe" [2007-03-07 12:42 176128 C:\Windows\System32\s3trayp.exe]
"HDAudDeck"="C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe" [2007-02-16 12:28 1122304]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 21:43 729088]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-10 13:14 815104]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50 734872]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20 40048]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-04-23 21:34:27 124400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{CFB51250-B034-47F6-9ABE-18D2C486B079}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{6B2AEDFA-0AD0-4E9E-910D-2A5DD153BC0D}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{B8836229-FDDC-4B78-9DF5-58B57492AF70}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{F7E22B53-36A3-41F7-B314-E88DCE9185FF}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{F4EF4B8D-69B1-4570-9A8B-01B2AA647C19}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\Windows\system32\DRIVERS\fetnd5bv.sys [2006-12-20 16:00]
R3 S3GIGP;S3GIGP;C:\Windows\system32\DRIVERS\VTGKModeDX32.sys [2007-03-07 12:30]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\Windows\system32\DRIVERS\sis163u.sys [2007-01-25 14:16]
S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" [2008-05-03 15:39]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-22 21:00:27 C:\Windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 21:54:45
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe 1????????????????????????????????????????????????????????

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-05-12 22:06:09
ComboFix-quarantined-files.txt 2008-05-12 20:04:48
ComboFix2.txt 2008-05-12 16:43:05

Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.

215 --- E O F --- 2008-05-06 23:46:20

rapport hijackthis a suivre +lopSD...