Virus de type dialer italien (encore !)

Salut à tous,

j'ai le fameux virus dialer italien qui apparemment touche pas de personnes. J'ai essayé de suivre les memes instruction que sur les autres sujets, meme probleme !
J'ai installé LookNStop ce matin pour essayer de le bloquer, mais rien n'y fait.
Voici le rapport Hijack :

Logfile of HijackThis v1.99.1
Scan saved at 10:46:24, on 14/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\TEMP\win76.tmp.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\AntiVirus\Scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://v4.windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.208.183.95:8081
O2 - BHO: (no name) - {BCE989F9-D627-414C-9C56-666C4945CCA3} - C:\WINDOWS\system32\byvur.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe"
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpeedswitchXP] "C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe"
O4 - HKCU\..\Run: [NVIEW] "rundll32.exe" nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Download using Download &Express - file://C:\WINDOWS\system32\MetaProducts\Add_Url.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - http://transfers.one.microsoft.com [...] erCtrl.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck [...] downls.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB22A1AD-5459-4F61-BCF0-2C6C6BB219D4}: NameServer = 212.27.54.252,212.27.53.252
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: byvur - C:\WINDOWS\system32\byvur.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winrbr32 - C:\WINDOWS\SYSTEM32\winrbr32.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Navigation étendue et définition (Connexion dictionnaire) - Unknown owner - C:\WINDOWS\system32\Weather.exe (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: SQL Server FullText Search (SQL_ALEXD) (msftesql$SQL_ALEXD) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe" -s:MSSQL.1 -f:SQL_ALEXD (file missing)
O23 - Service: SQL Server (SQL_ALEXD) (MSSQL$SQL_ALEXD) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQL_ALEXD (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQL Server Agent (SQL_ALEXD) (SQLAgent$SQL_ALEXD) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE" -i SQL_ALEXD (file missing)
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

------

On voit bien le virus dans la liste des process :
C:\WINDOWS\TEMP\win76.tmp.exe

Help !
Merci d'avance
Alex

Salut et merci pour ta réponse.

Bon j'ai suivi les étapes, je te poste tous les logs sauf SpySweep. au démarrage de celui-ci, je n'ai pas sélectionné le mode "Diagnostic" comme il me le proposait. Du coup apres le scan (très long !), j'avais pas l'option session log. Par contre, il m'a trouvé 4 malware dont 1 trojan. J'ai nettoyé ces derniers.

------------------------------
Le rapport Smit :
SmitFraudFix v2.79

Scan done at 11:41:05,18, 14/08/2006
Run from C:\AntiVirus\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End



-----------------
Rapport Clean


Script clean par Malekal_morte - http://www.malekal.com

Microsoft Windows XP [Version 5.1.2600]
Script execute en mode sans echec

*** Suppression de fichiers sur C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32


---------------
Rapport VUndoFix


VundoFix V5.1.11

Checking Java version...

Java version is 1.4.2.4

Scan started at 10:02:40 14/08/2006

Listing files found while scanning....

C:\windows\system32\byvur.dll
C:\windows\system32\ruvyb.ini
C:\windows\system32\ruvyb.bak2

VundoFix V5.1.11

Running as SYSTEM
from c:\windows\system32\VundoFix.exe

Checking Java version...

Java version is 1.4.2.4

Scan started at 13:05:13 14/08/2006

Listing files found while scanning....

No infected files were found.


Beginning removal...

The process smss.exe was successfully stopped

The process winlogon.exe was successfully stopped

The process explorer.exe was successfully stopped

The process iexplore.exe was successfully stopped

The process rundll32.exe was successfully stopped

Attempting to delete C:\WINDOWS\system32\ruvyb.bak2
C:\WINDOWS\system32\ruvyb.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ruvyb.ini
C:\WINDOWS\system32\ruvyb.ini Has been deleted!

Performing Repairs to the registry.
Done!


-----------
et enfin dernier rapport Hijack

Logfile of HijackThis v1.99.1
Scan saved at 13:39:18, on 14/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\AntiVirus\Scanner.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\HPZinw12.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://v4.windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.208.183.95:8081
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe"
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpeedswitchXP] "C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe"
O4 - HKCU\..\Run: [NVIEW] "rundll32.exe" nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Download using Download &Express - file://C:\WINDOWS\system32\MetaProducts\Add_Url.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - http://transfers.one.microsoft.com [...] erCtrl.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck [...] downls.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB22A1AD-5459-4F61-BCF0-2C6C6BB219D4}: NameServer = 212.27.54.252,212.27.53.252
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winrbr32 - winrbr32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Navigation étendue et définition (Connexion dictionnaire) - Unknown owner - C:\WINDOWS\system32\Weather.exe (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: SQL Server FullText Search (SQL_ALEXD) (msftesql$SQL_ALEXD) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe" -s:MSSQL.1 -f:SQL_ALEXD (file missing)
O23 - Service: SQL Server (SQL_ALEXD) (MSSQL$SQL_ALEXD) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQL_ALEXD (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQL Server Agent (SQL_ALEXD) (SQLAgent$SQL_ALEXD) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE" -i SQL_ALEXD (file missing)
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


-----------------

Apparemment le dialer ne se lance plus.. par contre j'ai vu qu'il y avait encore une référence vers winrbr32.dll dans hijack.

Alex

Voici le log :

C:\WINDOWS\System32\wpa.dbl -->14/08/2006 14:12:39
C:\WINDOWS\System32\FNTCACHE.DAT -->14/08/2006 10:27:52
C:\WINDOWS\System32\fwapi.dll -->14/08/2006 10:25:35
C:\WINDOWS\System32\nnnkkhe.dll -->13/08/2006 17:52:06
C:\WINDOWS\System32\MRT.exe -->03/08/2006 03:22:50
C:\WINDOWS\System32\PerfStringBackup.INI -->30/07/2006 15:49:34
C:\WINDOWS\System32\perfh009.dat -->30/07/2006 15:49:34
C:\WINDOWS\System32\perfc009.dat -->30/07/2006 15:49:34
C:\WINDOWS\System32\inetcomm.dll -->27/07/2006 15:24:46
C:\WINDOWS\System32\hlink.dll -->21/07/2006 10:24:43
C:\WINDOWS\System32\netapi32.dll -->14/07/2006 17:31:39
C:\WINDOWS\System32\hhctrl.ocx -->14/07/2006 17:25:57
C:\WINDOWS\System32\shell32.dll -->13/07/2006 15:33:27
C:\WINDOWS\System32\kernel32.dll -->05/07/2006 12:55:01
C:\WINDOWS\System32\rapi.dll -->26/06/2006 21:44:54
C:\WINDOWS\System32\ceutil.dll -->26/06/2006 21:43:32
C:\WINDOWS\System32\rasadhlp.dll -->26/06/2006 19:37:10
C:\WINDOWS\System32\dnsapi.dll -->26/06/2006 19:37:10
C:\WINDOWS\System32\wininet.dll -->23/06/2006 09:28:56
C:\WINDOWS\System32\webcheck.dll -->23/06/2006 09:28:56
C:\WINDOWS\System32\vbscript.dll -->23/06/2006 09:28:56
C:\WINDOWS\System32\urlmon.dll -->23/06/2006 09:28:56
C:\WINDOWS\System32\mstime.dll -->23/06/2006 09:28:56
C:\WINDOWS\System32\msls31.dll -->23/06/2006 09:28:56
C:\WINDOWS\System32\mshtmled.dll -->23/06/2006 09:28:56

C:\WINDOWS\WindowsUpdate.log -->14/08/2006 14:14:06
C:\WINDOWS\win.ini -->14/08/2006 14:14:02
C:\WINDOWS\wiaservc.log -->14/08/2006 14:12:05
C:\WINDOWS\wiadebug.log -->14/08/2006 14:12:05
C:\WINDOWS\0.log -->14/08/2006 14:12:03
C:\WINDOWS\bootstat.dat -->14/08/2006 14:12:00
C:\WINDOWS\SchedLgU.Txt -->14/08/2006 14:10:51
C:\WINDOWS\ntbtlog.txt -->14/08/2006 13:33:42
C:\WINDOWS\Sti_Trace.log -->14/08/2006 13:00:12
C:\WINDOWS\ModemLog_TOSHIBA Software Modem.txt -->14/08/2006 01:18:51
C:\WINDOWS\winamp.ini -->05/08/2006 12:54:10
C:\WINDOWS\QTFont.qfn -->24/06/2006 23:24:42
C:\WINDOWS\QTFont.for -->13/06/2006 14:26:01
C:\WINDOWS\mozver.dat -->10/05/2006 07:31:24
C:\WINDOWS\hpoins06.dat -->21/02/2006 23:52:58


Volume in drive C is System
Volume Serial Number is 84BF-1A6B

Directory of C:\WINDOWS\system32

04/08/2004 09:56 6 144 csrss.exe
1 File(s) 6 144 bytes
0 Dir(s) 4 770 746 368 bytes free

Contenu de Downloaded Program Files
Volume in drive C is System
Volume Serial Number is 84BF-1A6B

Directory of C:\WINDOWS\Downloaded Program Files

21/07/2006 09:18 <DIR> .
21/07/2006 09:18 <DIR> ..
31/10/2005 15:58 65 desktop.ini
14/02/2005 08:30 1 672 dlc.inf
23/09/2005 13:49 263 040 f5InspectionHost.dll
23/09/2005 13:49 1 181 f5InspectionHost.inf
02/05/2003 10:40 124 456 ftm_en-us.xml
06/06/2003 07:18 5 492 ftm_LanguageList.xml
07/02/2005 08:20 84 768 grTransferCtrl.dll
07/02/2005 08:20 371 600 grTransferMgr.dll
06/09/2004 13:57 1 257 gtdownls_95.inf
26/08/2003 03:12 1 096 iuctl.inf
15/05/2006 18:48 367 LegitCheckControl.inf
21/01/2000 01:25 1 162 Microsoft XML Parser for Java.osd
25/03/2003 13:09 1 558 msrdp.inf
25/03/2003 00:03 683 008 msrdp.ocx
17/07/2004 03:03 41 413 oemsetup.inf
09/10/2003 11:32 144 QTPlugin.inf
22/11/2004 18:47 22 304 set9x16.dll
16/02/2005 07:54 10 752 set9x32.dll
06/12/2004 13:30 6 144 setup2000.dll
22/11/2004 17:06 12 800 setupdrvdll.dll
26/02/2004 22:41 3 888 swflash.inf
07/02/2005 08:20 400 256 TransferMgr.exe
16/02/2005 07:54 16 896 ursetvpn.exe
16/12/2005 00:30 248 704 urSuperHost.dll
16/01/2006 17:03 803 200 urTermProxy.dll
16/01/2006 17:02 919 urTermProxy.inf
30/12/2005 14:27 253 808 urxdialer.dll
12/05/2005 13:00 13 184 urxdialerres.dll
24/11/2005 14:41 363 888 urxhost.dll
24/11/2005 14:41 367 urxhost.inf
03/08/2005 14:15 24 064 urxhostres.dll
16/12/2005 00:30 251 urxshost.inf
30/12/2005 14:27 1 517 urxvpn.inf
25/02/2005 12:06 14 urxvpnad.tag
05/06/2004 07:18 31 744 utunres.dll
35 File(s) 3 796 979 bytes

Total Files Listed:
35 File(s) 3 796 979 bytes
2 Dir(s) 4 770 742 272 bytes free

Volume in drive C is System
Volume Serial Number is 84BF-1A6B

Directory of C:\Program Files

14/08/2006 14:07 <DIR> .
14/08/2006 14:07 <DIR> ..
07/01/2005 22:48 <DIR> @Last Software
22/06/2004 23:28 <DIR> Adobe
31/10/2005 02:53 <DIR> Alwil Software
09/11/2004 23:10 <DIR> Apoint2K
08/06/2004 21:47 <DIR> AT&T Global Network Client
29/05/2004 01:17 2 513 326 BackupWinZip9.0.zip
04/12/2005 22:20 <DIR> CE Remote Tools
21/08/2005 22:54 <DIR> CFS-Technologies
07/07/2005 16:22 <DIR> Codec Pack - All In 1
14/08/2006 10:21 <DIR> Common Files
12/05/2003 20:15 <DIR> ComPlus Applications
01/10/2003 21:26 <DIR> CONEXANT
09/11/2004 23:49 <DIR> D-Tools
31/10/2005 16:20 <DIR> ewido
08/12/2005 20:32 <DIR> Freeplayer
13/08/2006 21:00 <DIR> Google
21/02/2006 22:53 <DIR> Hewlett-Packard
21/02/2006 22:55 <DIR> HP
09/11/2004 23:27 <DIR> HTML Help Workshop
23/01/2005 18:13 <DIR> Intel
21/07/2006 09:38 <DIR> Internet Explorer
28/05/2004 23:30 <DIR> Java
13/08/2006 23:17 <DIR> Lavasoft
16/02/2006 09:11 <DIR> MCP Demonstration
10/02/2005 23:58 <DIR> Messenger
09/11/2004 23:14 <DIR> Microsoft ACT
14/08/2006 10:23 <DIR> Microsoft ActiveSync
04/12/2005 21:03 <DIR> Microsoft Analysis Services
08/05/2006 12:20 <DIR> Microsoft AntiSpyware
04/12/2005 22:31 <DIR> Microsoft Device Emulator
12/05/2003 20:22 <DIR> microsoft frontpage
09/11/2004 23:14 <DIR> Microsoft Office
01/10/2003 23:38 <DIR> Microsoft Reader
05/12/2005 01:52 <DIR> Microsoft SQL Server
04/12/2005 22:31 <DIR> Microsoft SQL Server 2005 Mobile Edition
01/11/2005 17:42 <DIR> Microsoft Virtual PC
29/05/2004 01:46 <DIR> Microsoft Visual Studio
09/11/2004 23:36 <DIR> Microsoft Visual Studio .NET 2003
04/12/2005 22:25 <DIR> Microsoft Visual Studio 8
30/10/2003 03:26 <DIR> Microsoft VM
16/10/2005 00:27 <DIR> Microsoft Works
08/08/2006 20:44 <DIR> Microsoft.NET
15/11/2004 00:31 <DIR> Movie Maker
14/08/2006 14:16 <DIR> Mozilla Firefox
04/12/2005 22:24 <DIR> MSBuild
04/12/2005 22:36 <DIR> MSDN
12/05/2003 20:15 <DIR> MSN Gaming Zone
21/04/2006 17:54 <DIR> MSN Messenger
15/11/2004 00:29 <DIR> NetMeeting
21/06/2004 21:05 <DIR> OfficeUpdate11
12/05/2003 20:18 <DIR> Online Services
02/10/2003 19:27 <DIR> ORKTOOLS
15/04/2006 12:42 <DIR> Outlook Express
14/08/2006 14:12 <DIR> PestPatrol
14/02/2005 22:13 <DIR> QuickTime
21/03/2005 01:35 <DIR> Real
06/08/2006 15:09 <DIR> SBSH
13/02/2005 18:13 <DIR> SharpReader
12/04/2005 21:01 <DIR> Skype
25/08/2005 21:48 <DIR> SmartFTP Client Setup Files
14/08/2006 10:25 <DIR> Soft4Ever
08/06/2004 21:38 <DIR> SpeedswitchXP
14/08/2006 14:06 <DIR> Spybot - Search & Destroy
04/12/2005 21:14 <DIR> SQLXML 4.0
31/10/2003 00:19 <DIR> Support Tools
30/09/2003 23:56 <DIR> Symantec
30/09/2003 23:55 <DIR> Symantec_Client_Security
07/05/2005 10:31 <DIR> ToniArts
04/01/2005 20:51 <DIR> TOSHIBA
31/10/2005 14:31 <DIR> Trend Micro
20/12/2004 21:22 <DIR> Winamp
08/05/2006 12:20 <DIR> Windows Defender
18/02/2006 14:07 <DIR> Windows Media Player
15/11/2004 00:29 <DIR> Windows NT
09/10/2003 03:11 <DIR> Windows Resource Kits
17/12/2004 15:53 <DIR> WinRAR
29/05/2004 01:16 <DIR> WinZip
12/05/2003 20:22 <DIR> xerox
16/06/2006 18:19 <DIR> XnView
27/11/2005 15:58 <DIR> Yahoo!
1 File(s) 2 513 326 bytes
90 Dir(s) 4 770 738 176 bytes free
Volume in drive C is System
Volume Serial Number is 84BF-1A6B

Directory of C:\Program Files\common files

14/08/2006 10:21 <DIR> .
14/08/2006 10:21 <DIR> ..
14/11/2004 23:32 <DIR> Adobe
29/04/1999 03:17 24 576 Artes32X.dll
09/02/2005 14:01 <DIR> Avanade
04/12/2005 22:21 <DIR> Business Objects
29/05/2004 01:46 <DIR> DESIGNER
21/02/2006 22:52 <DIR> Hewlett-Packard
21/02/2006 22:55 <DIR> HP
14/08/2006 14:05 <DIR> InstallShield
28/05/2004 23:29 <DIR> Java
29/05/2004 01:47 <DIR> L&H
04/12/2005 22:24 <DIR> Merge Modules
24/07/2006 22:45 <DIR> Microsoft Shared
12/05/2003 20:17 <DIR> MSSoap
12/05/2003 13:00 <DIR> ODBC
27/10/2000 15:15 40 960 Period.dll
21/03/2005 01:35 <DIR> Real
12/05/2003 20:17 <DIR> Services
12/05/2003 13:00 <DIR> SpeechEngines
30/09/2003 23:56 <DIR> Symantec Shared
15/04/2006 12:42 <DIR> System
21/03/2005 01:35 <DIR> xing shared
13/08/2006 22:07 <DIR> {84BF1A6B-0703-1033-0907-041212030021}
3 File(s) 94 208 bytes
22 Dir(s) 4 770 738 176 bytes free
c:\Documents and Settings\alexandred\Local Settings\Temp\7faldz8w.exe
c:\Documents and Settings\alexandred\Local Settings\Temp\td0976z1.exe
c:\Documents and Settings\alexandred\Local Settings\Temporary Internet Files\Content.IE5\4XUA2RPF\srvtti[1].exe
c:\Documents and Settings\alexandred\Local Settings\Temporary Internet Files\Content.IE5\4XUA2RPF\srvwoz[1].exe
c:\Documents and Settings\alexandred\Local Settings\Temporary Internet Files\Content.IE5\4XUA2RPF\WinAntiVirusPro2006FreeInstall[1].exe
c:\Documents and Settings\alexandred\Local Settings\Temporary Internet Files\Content.IE5\MZI4EH1W\srvlsj[1].exe
c:\Documents and Settings\alexandred\Local Settings\Temporary Internet Files\Content.IE5\WMYTTN16\srvnod[1].exe
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1L\QuarantineClient.exe
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1P\QuarantineClient.exe
c:\Documents and Settings\alexandred\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\alexandred\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll
c:\Documents and Settings\alexandred\Application Data\Microsoft\Virtual Server\VMRC Client\VMKeyboardHook.dll
c:\Documents and Settings\alexandred\Application Data\Mozilla\Firefox\Profiles\owknauia.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
c:\Documents and Settings\alexandred\VSWebCache\XP-ALEXD\WebApplication1\obj\Debug\WebApplication1.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1L\AxInterop.SHDocVw.DLL
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1L\ICSharpCode.SharpZipLib.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1L\Interop.MSScriptControl.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1L\Interop.SHDocVw.DLL
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1L\MsHtmHstInterop.DLL
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1L\Scripting.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1L\ServerCommon.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1P\AxInterop.SHDocVw.DLL
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1P\ICSharpCode.SharpZipLib.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1P\Interop.MSScriptControl.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1P\Interop.SHDocVw.DLL
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1P\MsHtmHstInterop.DLL
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1P\Scripting.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Cm\VPNQv1P\ServerCommon.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll
c:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{383F345E-5EF4-4575-B5C0-9CEF0BD9BF05}\mpengine.dll

Vérifications de quelques clefs
Recherche de clefs EGDACCESS

HKLM\SOFTWARE\Microsoft\Windows\explorer\SharedTaskScheduler