Salut,

Je pense être tombé sur un sacré bestiaux. J'ai laissé accès à mon pc à ma soeur et je sais pas ou elle a déniché ça mais :

- J'ai une message d'erreur au démarrage disant qu'on ne peut pas lire la disquette (lecteur A)
- Mon PC est très ralenti
- Des lignes floues balaye lentement mon fond d'écran
- Je ne peux plus ouvrir l'antivirus installé, ni d'antivirus online, spybot... je ne peux même pas installer hijack

Je ne sais plus par quel bout prendre le problème, un peu d'aide serait la bienvenue.

Merci

Salut,

Télécharge ELIBAGLA au bas de cette page. Il est préférable pour certains antivirus de les désactiver avant d’entâmer cette procédure !
Clique sur le Descargar Elibagla afin de télécharger le fichier, enregistre-le sur ton bureau.
Lance le en double cliquant dessus.
Vérifie que dans le menu déroulant Unidad, il y ait bien C:\
L'option Eliminar Ficheros Automaticamente doit également être cochée.
Clique sur Explorar pour lancer l'analyse.
Poste le rapport généré en fin fin d'analyse.


Télécharge Hijackthis

Dézippe le dans un dossier sur ton bureau.
Double clique sur celui-ci.
Puis "Do a system scan and save a logfile" et poste le rapport.
Tuto HiJackThis

Bonjour, merci de ta réponse.

Le BagleA n'a pas été trouvé (jai analyser C puis D, a noter que dans D, l'utilitaire compte 43000 fichiers mais n'en analyse que 2336)

J'ai installé Hijack (jeu de de rapidité pour accepter la license avant que le virus ne ferme la fenêtre...).
Puis même manège pour lancer l'analyse avec un rapport mais là, le virus ferme la fenêtre avant que l'analyse soit complète...

sacré bestiole, tu as une idée?

Tu es sûr que Bagle n'a rien trouvé.
Le mode sans échec fonctionne-t-il correctement ?

Redémarrer en mode sans échec.

Oui, fichiers infectados = 0 et eliminados = 0, sur chaque partition du DD.

Le mode sans échec fonctionne, d'ailleurs j'ai pu lancer hijack en mode sans échec (je sais pas si ça reste utile) mais je poste quand même le rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:23:23, on 06/10/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
D:\Mes Documents\Bureau\Tkt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.okskwehjpykrtvoacgkry.c [...] UVJKz4.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\9.tmp
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\system32\9.tmp
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\System32\ldpxfvcf.dll
O2 - BHO: (no name) - {9370EFDE-C0DA-42C9-B609-41C87B462011} - C:\WINDOWS\System32\iifcbyx.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {949EDA45-B247-4C36-8818-C65471D84900} - C:\WINDOWS\System32\mljge.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {EBC41EF6-189E-0211-F514-980CE1CCDDF8} - C:\DOCUME~1\ADMINI~1\APPLIC~1\SHIMKI~1\for skip.exe (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Network Service Monitor] C:\WINDOWS\system32\19.tmp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Microsoft (R) Windows Protocol Deployment Manager] C:\WINDOWS\system32\9.tmp
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\System32\qtuabyni.dll",sitypnow
O4 - HKUS\S-1-5-18\..\Run: [Windows File Verification Service] "C:\WINDOWS\System32\wfvs.exe" * (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Network Translation System Service] "C:\WINDOWS\system32\ntss.exe" * (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Network Translation Service] "C:\WINDOWS\nts.exe" * (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Windows File Verification Service] "C:\WINDOWS\System32\wfvs.exe" * (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSAG~1\Messager Wanadoo.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSAG~1\Messager Wanadoo.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr
O16 - DPF: Interface Chat Wanadoo - http://chat10.x-echo.com/version3/Applet/wchatsign.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 0925904187
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ [...] loader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/bina [...] b32846.cab
O16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} - http://kit.carpediem.fr/15239/xgratos.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D43316F4-7398-4572-9FF1-275F4B059CC6}: NameServer = 193.252.19.3,193.252.19.4
O20 - Winlogon Notify: iifcbyx - C:\WINDOWS\SYSTEM32\iifcbyx.dll
O23 - Service: AVP Control Centre Service (AVPCC) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: cKhLd3IuQgV39agc72 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: D880g0dS+Ss25oQQQ2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\uwnxkjnh.exe
O23 - Service: EJCKi3Hn0dt12kf2Q1 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IScL62iwp003hatHh0UTS+s2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
O23 - Service: LRqgC2IISz23uGK6h04GyBs2elBTQ2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: M1BSB1L01AM1ALMnG17Hjfx3mwWHp1hDsSR1DydWi2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
O23 - Service: Microsoft Windows VHP Control - Unknown owner - C:\WINDOWS\System32\dllcache\winvhp.exe
O23 - Service: Microsoft Windows Software Update Service (mswsus) - Unknown owner - C:\WINDOWS\System32\mswsus.exe (file missing)
O23 - Service: Windows Network Service Monitor (nsmss) - Unknown owner - C:\WINDOWS\system32\19.tmp
O23 - Service: Network Translation Service (NTS) - Unknown owner - C:\WINDOWS\nts.exe
O23 - Service: Network Translation System Service (NTSS) - Unknown owner - C:\WINDOWS\system32\ntss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Windows Protocol Deployment Manager (PDM) - Unknown owner - C:\WINDOWS\system32\9.tmp
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Q+Ilf1Oc65S1jX2d703r3j01Ka3lh2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Windows File Verification Service (wfvs) - Unknown owner - C:\WINDOWS\System32\wfvs.exe
O23 - Service: Windows Service Monitor (winsvcmon) - Unknown owner - C:\WINDOWS\System32\winsvcmon.exe
O23 - Service: Windows Management Service (wms) - Unknown owner - C:\WINDOWS\System32\wms.exe

--
End of file - 8651 bytes

Tu as plusieurs infections dont vundo.
Fais déjà ça, on verra vundo après :


Télécharge SDFix

Enregistre le sur ton le bureau.

Lances le.
Fais install afin qu’il puisse s’extraire.

Redémarre en mode sans échec

Lance SDFix.
Double clique sur RunThis.bat (Le .bat apparaît si tu fais ça : Aller dans poste de travail>outils>option des dossiers>affichage>décocher masquer les extensions dont le type est connu. - - > Appliquer - - > OK)
Appuie sur Y pour le lancer.

Il te sera demandé d'appuyer sur une touche pour redemarrer , fais le
Il est probable que le redémarrage soit un peu plus long que d’habitude.
Une fois l’apparition de ton Bureau, il affichera Finished

Appuie sur une touche.

Un rapport est généré , poste le dans ta réponse.
Il se trouve également. dans le dossier SDFix >Report.txt<
et un nouveau rapport Hijackthis

Ayé. ça sent le grand chantier, heureusement que j'ai trouvé Hercule ^^

Rapport SD FIX :


SDFix: Version 1.107

Run by Administrateur on 06/10/2007 at 14:21

Microsoft Windows XP [version 5.1.2600]

Running From: D:\MESDOC~1\Bureau\SDFIX\SDFix

Safe Mode:
Checking Services:

Name:
mswsus
PDM
wfvs
winsvcmon

ImagePath:
C:\WINDOWS\System32\mswsus.exe
C:\WINDOWS\system32\9.tmp
C:\WINDOWS\System32\wfvs.exe
C:\WINDOWS\System32\winsvcmon.exe

mswsus - Deleted
PDM - Deleted
wfvs - Deleted
winsvcmon - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File



RAPPORT HJT :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:33:17, on 06/10/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Mes Documents\Bureau\Tkt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.okskwehjpykrtvoacgkry.c [...] UVJKz4.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\System32\ldpxfvcf.dll
O2 - BHO: (no name) - {9370EFDE-C0DA-42C9-B609-41C87B462011} - C:\WINDOWS\System32\iifcbyx.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {DE865916-6C58-4BC0-AA87-F20EE8A8A41E} - C:\WINDOWS\System32\mljge.dll
O2 - BHO: (no name) - {EBC41EF6-189E-0211-F514-980CE1CCDDF8} - C:\DOCUME~1\ADMINI~1\APPLIC~1\SHIMKI~1\for skip.exe (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Network Service Monitor] C:\WINDOWS\system32\19.tmp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\System32\qtuabyni.dll",sitypnow
O4 - HKUS\S-1-5-18\..\Run: [Windows File Verification Service] "C:\WINDOWS\System32\wfvs.exe" * (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Network Translation System Service] "C:\WINDOWS\system32\ntss.exe" * (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Network Translation Service] "C:\WINDOWS\nts.exe" * (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Windows File Verification Service] "C:\WINDOWS\System32\wfvs.exe" * (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSAG~1\Messager Wanadoo.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSAG~1\Messager Wanadoo.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr
O16 - DPF: Interface Chat Wanadoo - http://chat10.x-echo.com/version3/Applet/wchatsign.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 0925904187
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ [...] loader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/bina [...] b32846.cab
O16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} - http://kit.carpediem.fr/15239/xgratos.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D43316F4-7398-4572-9FF1-275F4B059CC6}: NameServer = 193.252.19.3,193.252.19.4
O20 - Winlogon Notify: iifcbyx - C:\WINDOWS\SYSTEM32\iifcbyx.dll
O23 - Service: AVP Control Centre Service (AVPCC) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: cKhLd3IuQgV39agc72 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: D880g0dS+Ss25oQQQ2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\uwnxkjnh.exe
O23 - Service: EJCKi3Hn0dt12kf2Q1 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IScL62iwp003hatHh0UTS+s2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
O23 - Service: LRqgC2IISz23uGK6h04GyBs2elBTQ2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: M1BSB1L01AM1ALMnG17Hjfx3mwWHp1hDsSR1DydWi2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
O23 - Service: Microsoft Windows VHP Control - Unknown owner - C:\WINDOWS\System32\dllcache\winvhp.exe
O23 - Service: Windows Network Service Monitor (nsmss) - Unknown owner - C:\WINDOWS\system32\19.tmp (file missing)
O23 - Service: Network Translation Service (NTS) - Unknown owner - C:\WINDOWS\nts.exe
O23 - Service: Network Translation System Service (NTSS) - Unknown owner - C:\WINDOWS\system32\ntss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Q+Ilf1Oc65S1jX2d703r3j01Ka3lh2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Windows Management Service (wms) - Unknown owner - C:\WINDOWS\System32\wms.exe

--
End of file - 7971 bytes

Je suis opé pour la suite

Re,

On va s'occuper du vundo et des finitions à la fin.
Fais les manips ci-dessous dans l'ordre.

1/ Télécharge VundoFix.exe :

Double-clique VundoFix.exe .
Clique sur Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Ensuite clique sur YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu auras un message comme quoi l’ordinateur va s’éteindre, fais ok

Poste le rapport qui se trouve dans C:\vundofix.txt

2/ Télécharge Combofix (par sUBs) sur ton Bureau. (Tuto)
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Le rapport se trouve ici : C:\Combofix.txt

3/ Poste un nouveau rapport hijackthis en ayant renommé hijackthis.exe en scanner.exe

Alors j'ai fixé tout ça.

A noter que pour certains fichiers, vundofix et combofix ont galéré, d'ailleurs après avoir fait la procédure dans l'ordre, j'ai redémarré en mode sans échec (pr pouvoir lancer hijack) et en relançant vundo, il trouve encore un fichier infecté : c:\windows\system32\gomkigf.dll.

Dois je recommencer en mode sans échec?

En tout cas voici les rapports :
VUNDO :


VundoFix V6.5.9

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 15:00:21 06/10/2007

Listing files found while scanning....

C:\windows\system32\byxvuvu.dll
C:\windows\system32\cbxvwxy.dll
C:\windows\system32\fccdabb.dll
C:\windows\system32\fccddda.dll
C:\windows\system32\fccddde.dll
C:\windows\system32\fccywts.dll
C:\windows\system32\iifcbyx.dll
C:\WINDOWS\System32\inybautq.ini
C:\WINDOWS\System32\ldpxfvcf.dll
C:\windows\system32\ljjiggd.dll
C:\windows\system32\ljjjjhi.dll
C:\windows\system32\nnnmmmk.dll
C:\windows\system32\opnmmjg.dll
C:\WINDOWS\System32\qtuabyni.dll
C:\windows\system32\rqrpmlj.dll
C:\windows\system32\tuvsrqq.dll
C:\windows\system32\vtuvusr.dll
C:\windows\system32\yaywwtu.dll

Beginning removal...

Attempting to delete C:\windows\system32\byxvuvu.dll
C:\windows\system32\byxvuvu.dll Has been deleted!

Attempting to delete C:\windows\system32\cbxvwxy.dll
C:\windows\system32\cbxvwxy.dll Has been deleted!

Attempting to delete C:\windows\system32\fccdabb.dll
C:\windows\system32\fccdabb.dll Has been deleted!

Attempting to delete C:\windows\system32\fccddda.dll
C:\windows\system32\fccddda.dll Has been deleted!

Attempting to delete C:\windows\system32\fccddde.dll
C:\windows\system32\fccddde.dll Could not be deleted.

Attempting to delete C:\windows\system32\fccywts.dll
C:\windows\system32\fccywts.dll Has been deleted!

Attempting to delete C:\windows\system32\iifcbyx.dll
C:\windows\system32\iifcbyx.dll Could not be deleted.

Attempting to delete C:\WINDOWS\System32\inybautq.ini
C:\WINDOWS\System32\inybautq.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\ldpxfvcf.dll
C:\WINDOWS\System32\ldpxfvcf.dll Could not be deleted.

Attempting to delete C:\windows\system32\ljjiggd.dll
C:\windows\system32\ljjiggd.dll Has been deleted!

Attempting to delete C:\windows\system32\ljjjjhi.dll
C:\windows\system32\ljjjjhi.dll Has been deleted!

Attempting to delete C:\windows\system32\nnnmmmk.dll
C:\windows\system32\nnnmmmk.dll Has been deleted!

Attempting to delete C:\windows\system32\opnmmjg.dll
C:\windows\system32\opnmmjg.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\qtuabyni.dll
C:\WINDOWS\System32\qtuabyni.dll Has been deleted!

Attempting to delete C:\windows\system32\rqrpmlj.dll
C:\windows\system32\rqrpmlj.dll Has been deleted!

Attempting to delete C:\windows\system32\tuvsrqq.dll
C:\windows\system32\tuvsrqq.dll Has been deleted!

Attempting to delete C:\windows\system32\vtuvusr.dll
C:\windows\system32\vtuvusr.dll Has been deleted!

Attempting to delete C:\windows\system32\yaywwtu.dll
C:\windows\system32\yaywwtu.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\windows\system32\fccddde.dll
C:\windows\system32\fccddde.dll Has been deleted!

Attempting to delete C:\windows\system32\iifcbyx.dll
C:\windows\system32\iifcbyx.dll Could not be deleted.

Attempting to delete C:\WINDOWS\System32\ldpxfvcf.dll
C:\WINDOWS\System32\ldpxfvcf.dll Has been deleted!

Performing Repairs to the registry.
Done!

Combo :

ComboFix 07-10-06.3 - Administrateur 2007-10-06 15:12:37.1 - [color=red]FAT32[/color]x86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.291 [GMT 2:00]
Running from: D:\Mes Documents\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\WINDOWS\cookies.ini
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\system32\ashnvlya.ini
C:\WINDOWS\system32\aylvnhsa.dll
C:\WINDOWS\system32\byxvwuu.dll
C:\WINDOWS\system32\cbxussq.dll
C:\WINDOWS\system32\egjlm.bak1
C:\WINDOWS\system32\egjlm.bak2
C:\WINDOWS\system32\egjlm.ini
C:\WINDOWS\system32\fcmutyhe.dll
C:\WINDOWS\system32\gljudpns.dll
C:\WINDOWS\system32\iifcbyx.dll
C:\WINDOWS\system32\ivfsmxdm.exe
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\snpdujlg.ini
C:\WINDOWS\system32\uwnxkjnh.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((((((( Fichiers créés 203.-01-28 to 203.0.2.99 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-06 15:16 44054 --a------ C:\WINDOWS\system32\qomkjgf.dll
2007-10-06 15:03 24576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-10-06 14:27 1422 --a------ C:\Documents and Settings\Administrateur\clean.reg
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EBC41EF6-189E-0211-F514-980CE1CCDDF8}]
C:\DOCUME~1\ADMINI~1\APPLIC~1\SHIMKI~1\for skip.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"ezShieldProtector for Px"="C:\WINDOWS\System32\ezSP_Px.exe" [2002-08-20 10:29]
"Microsoft (R) Windows Network Service Monitor"="C:\WINDOWS\system32\19.tmp" []
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-12-10 03:06]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=
"Windows File Verification Service"="C:\WINDOWS\System32\wfvs.exe" *
"Network Translation System Service"="C:\WINDOWS\system32\ntss.exe" *
"Network Translation Service"="C:\WINDOWS\nts.exe" *

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{9370EFDE-C0DA-42C9-B609-41C87B462011}"= C:\WINDOWS\System32\qomkjgf.dll [2007-10-06 15:16 44054]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qomkjgf]
qomkjgf.dll 2007-10-06 15:16 44054 C:\WINDOWS\system32\qomkjgf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrateur^Menu Démarrer^Programmes^Démarrage^Démarrage d'Office.lnk]
path=C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\Démarrage d'Office.lnk
backup=C:\WINDOWS\pss\Démarrage d'Office.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrateur^Menu Démarrer^Programmes^Démarrage^Microsoft Recherche accélérée.lnk]
path=C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\Microsoft Recherche accélérée.lnk
backup=C:\WINDOWS\pss\Microsoft Recherche accélérée.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Album Fast Start.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Album Fast Start.lnk
backup=C:\WINDOWS\pss\Album Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk
backup=C:\WINDOWS\pss\Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVPCC]
"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avserve.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
C:\WINDOWS\System32\ezSP_Px.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McRegWiz]
C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe /autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessagerStarter Wanadoo]
C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
"D:\Program Files\MessengerPlus! 3\MsgPlus.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft (R) Windows Network Service Monitor]
C:\WINDOWS\system32\19.tmp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft (R) Windows Protocol Deployment Manager]
C:\WINDOWS\system32\9.tmp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Translation Service]
"C:\WINDOWS\nts.exe" *

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Translation System Service]
"C:\WINDOWS\system32\ntss.exe" *

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchIndexer]
rundll32.exe "C:\WINDOWS\System32\gljudpns.dll",sitypnow

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI]
RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebCam Go Plus Sti Service Application]
Wcgopsvc

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows File Verification Service]
"C:\WINDOWS\System32\wfvs.exe" *

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon]
C:\PROGRA~1\WANADOO\CnxMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
C:\PROGRA~1\WANADOO\TaskbarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
C:\PROGRA~1\WANADOO\Watch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client]
"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
c:\progra~1\mcafee\MCAFEE~1\masalert.exe

R1 sdcplh;sdcplh;C:\WINDOWS\System32\drivers\sdcplh.sys
R2 Dnscache;Client DNS;C:\WINDOWS\System32\svchost.exe -k NetworkService
R2 KAVMonitorService;KAV Monitor Service;"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service
R2 Microsoft Windows VHP Control;Microsoft Windows VHP Control;"C:\WINDOWS\System32\dllcache\winvhp.exe"
R2 NTS;Network Translation Service;C:\WINDOWS\nts.exe
R2 NTSS;Network Translation System Service;C:\WINDOWS\system32\ntss.exe
R2 wms;Windows Management Service;C:\WINDOWS\System32\wms.exe
S2 AVPCC;AVP Control Centre Service;"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service
S2 nsmss;Windows Network Service Monitor;C:\WINDOWS\system32\19.tmp
S3 060f2e7e-6d14-4f82-90d7-d7d94506d992;060f2e7e-6d14-4f82-90d7-d7d94506d992;\??\E:\Player\cds300.dll
S3 cKhLd3IuQgV39agc72;cKhLd3IuQgV39agc72;C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe /service
S3 D880g0dS+Ss25oQQQ2;D880g0dS+Ss25oQQQ2;C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe /service
S3 EJCKi3Hn0dt12kf2Q1;EJCKi3Hn0dt12kf2Q1;C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe /service
S3 Ip6FwHlp;Pare-feu de connexion Internet IPv6;C:\WINDOWS\System32\svchost.exe -k netsvcs
S3 IScL62iwp003hatHh0UTS+s2;IScL62iwp003hatHh0UTS+s2;C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe /service
S3 LRqgC2IISz23uGK6h04GyBs2elBTQ2;LRqgC2IISz23uGK6h04GyBs2elBTQ2;C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe /service
S3 M1BSB1L01AM1ALMnG17Hjfx3mwWHp1hDsSR1DydWi2;M1BSB1L01AM1ALMnG17Hjfx3mwWHp1hDsSR1DydWi2;C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe /service
S3 Q+Ilf1Oc65S1jX2d703r3j01Ka3lh2;Q+Ilf1Oc65S1jX2d703r3j01Ka3lh2;C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe /service
S3 WCGOPHAL;WCGOPHAL;C:\WINDOWS\System32\drivers\Wcgophal.sys
S3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\System32\DRIVERS\WlanUIG.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-10-06 13:16:04 C:\WINDOWS\Tasks\Symantec NetDetect.job"
"2007-10-06 13:00:02 C:\WINDOWS\Tasks\AD34AD5891832150.job"
- c:\docume~1\admini~1\applic~1\bindti~1\Software4Funk.exe
"2007-09-04 03:30:02 C:\WINDOWS\Tasks\McAfee AntiSpyware.job"
- c:\progra~1\mcafee\MCAFEE~1\MASCon.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-06 15:16:38
Windows 5.1.2600 Service Pack 1 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-06 15:17:21 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-06 15:17
.
--- E O F ---

HIJACK :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:29:00, on 06/10/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Mes Documents\Bureau\VundoFix.exe
D:\Mes Documents\Bureau\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9370EFDE-C0DA-42C9-B609-41C87B462011} - C:\WINDOWS\System32\qomkjgf.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {EBC41EF6-189E-0211-F514-980CE1CCDDF8} - C:\DOCUME~1\ADMINI~1\APPLIC~1\SHIMKI~1\for skip.exe (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Network Service Monitor] C:\WINDOWS\system32\19.tmp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKUS\S-1-5-18\..\Run: [Windows File Verification Service] "C:\WINDOWS\System32\wfvs.exe" * (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Network Translation System Service] "C:\WINDOWS\system32\ntss.exe" * (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Network Translation Service] "C:\WINDOWS\nts.exe" * (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Windows File Verification Service] "C:\WINDOWS\System32\wfvs.exe" * (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSAG~1\Messager Wanadoo.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSAG~1\Messager Wanadoo.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr
O16 - DPF: Interface Chat Wanadoo - http://chat10.x-echo.com/version3/Applet/wchatsign.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 0925904187
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ [...] loader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/bina [...] b32846.cab
O16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} - http://kit.carpediem.fr/15239/xgratos.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D43316F4-7398-4572-9FF1-275F4B059CC6}: NameServer = 193.252.19.3,193.252.19.4
O20 - Winlogon Notify: qomkjgf - C:\WINDOWS\SYSTEM32\qomkjgf.dll
O23 - Service: AVP Control Centre Service (AVPCC) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: cKhLd3IuQgV39agc72 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: D880g0dS+Ss25oQQQ2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: EJCKi3Hn0dt12kf2Q1 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IScL62iwp003hatHh0UTS+s2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
O23 - Service: LRqgC2IISz23uGK6h04GyBs2elBTQ2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: M1BSB1L01AM1ALMnG17Hjfx3mwWHp1hDsSR1DydWi2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
O23 - Service: Microsoft Windows VHP Control - Unknown owner - C:\WINDOWS\System32\dllcache\winvhp.exe
O23 - Service: Windows Network Service Monitor (nsmss) - Unknown owner - C:\WINDOWS\system32\19.tmp (file missing)
O23 - Service: Network Translation Service (NTS) - Unknown owner - C:\WINDOWS\nts.exe
O23 - Service: Network Translation System Service (NTSS) - Unknown owner - C:\WINDOWS\system32\ntss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Q+Ilf1Oc65S1jX2d703r3j01Ka3lh2 - Kaspersky Labs. - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Windows Management Service (wms) - Unknown owner - C:\WINDOWS\System32\wms.exe

--
End of file - 7374 bytes


Prêt pour la suite