[RESOLU]Imposible de suprimer TR/Vundo.Gen détecté par antivir
Dernière réponse : dans Sécurité
Bonjour à vous.
Voilà, j'ai mon Avira antivir qui detecte quand j'active antivir guard sans cesse le trojan TR/Vundo.Gen
J'ai essayé divers vundofix, fixvundo et Virtumundobegone sans succes. Avg antispyware n'a rien donné non plus et aucun de ces logiciels n'arrive à déloger ce trojan.
En fait pour utiliser le pc je suis obligé de désactiver antivir guard sinon j'ai à peine le temps de fermer une fenetre de detection qu'une autre aparait aussitot.
Peut etre également un probleme avec un malware détecté dans un fichier "__c00F5B27.dat" ???
Merci de m'aider à résoudre ce problème.
Matthieu
Voilà, j'ai mon Avira antivir qui detecte quand j'active antivir guard sans cesse le trojan TR/Vundo.Gen
J'ai essayé divers vundofix, fixvundo et Virtumundobegone sans succes. Avg antispyware n'a rien donné non plus et aucun de ces logiciels n'arrive à déloger ce trojan.
En fait pour utiliser le pc je suis obligé de désactiver antivir guard sinon j'ai à peine le temps de fermer une fenetre de detection qu'une autre aparait aussitot.
Peut etre également un probleme avec un malware détecté dans un fichier "__c00F5B27.dat" ???
Merci de m'aider à résoudre ce problème.
Matthieu
Autres pages sur : resolu imposible suprimer vundo gen detecte antivir
Lassé par la pub ? Créez un compte
Bonjour,
Télécharge puis installe Hijackthis (Trend Micro)
Poste ensuite un rapport dans ta prochaine réponse.
AIDE : Comment utiliser Hijackthis v2.0.2
&
Télécharge combofix.exe (par sUBs) sur ton Bureau.
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Télécharge puis installe Hijackthis (Trend Micro)
Poste ensuite un rapport dans ta prochaine réponse.
AIDE : Comment utiliser Hijackthis v2.0.2
&
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Tout d'abord, merci pour ton aide.
Voici les rapports.
Hijackthis :
Scan saved at 12:12:50, on 27/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\aniServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Smoky\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7425E671-2DA3-4030-93F0-77282D36A200} - C:\WINDOWS\system32\ddayx.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [342b807f] rundll32.exe "C:\WINDOWS\system32\kyrjkeuh.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00F5B27.dat
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5283 bytes
Combofix :
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1606 [GMT 2:00]
Running from: C:\Documents and Settings\Smoky\Bureau\ComboFix.exe
* Created a new restore point
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
C:\WINDOWS\system32\__c00F5B27.dat
C:\WINDOWS\system32\~.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
((((((((((((((((((((((((((((( Fichiers créés 2007-09-27 to 2007-10-27 ))))))))))))))))))))))))))))))))))))
.
2007-10-27 12:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-27 09:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-10-27 09:17 83,520 --a------ C:\WINDOWS\system32\kyrjkeuh.dll
2007-10-27 09:11 10,816 --a------ C:\WINDOWS\system32\cceeslxh.dll
2007-10-26 23:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-26 21:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-10-26 21:09 240,480 ---hs---- C:\WINDOWS\system32\xyadd.bak2
2007-10-26 19:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-26 19:00 <REP> d-------- C:\Program Files\Lavasoft
2007-10-26 19:00 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Lavasoft
2007-10-26 18:47 2,348 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-26 18:21 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-10-26 12:31 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\teamspeak2
2007-10-26 12:30 <REP> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-26 12:21 311,392 --a------ C:\WINDOWS\system32\ddayx.VIR
2007-10-26 12:16 145,929 --a------ C:\WINDOWS\system32\sysdl132.exe
2007-10-26 12:16 33,792 --a------ C:\WINDOWS\system32\nnnkhhf.dll
2007-10-17 00:01 <REP> d-------- C:\WINDOWS\system32\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\iTunes
2007-10-17 00:01 <REP> d-------- C:\Program Files\iPod
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Apple Computer
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-10-17 00:01 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2007-09-27 18:29 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Ahead
2007-09-27 18:28 <REP> d-------- C:\Program Files\Nero
2007-09-27 18:28 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2007-09-27 18:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-16 22:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-03 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-24 18:13 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Command & Conquer 3 Les guerres du Tiberium
2007-09-24 16:59 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-09-23 19:30 --------- d--h--r C:\Documents and Settings\Smoky\Application Data\SecuROM
2007-09-23 19:09 --------- d-----w C:\Program Files\Electronic Arts
2007-09-23 08:01 --------- d-----w C:\Documents and Settings\Smoky\Application Data\AdobeUM
2007-09-22 10:16 --------- d-----w C:\Program Files\VideoLAN
2007-09-22 10:16 --------- d-----w C:\Documents and Settings\Smoky\Application Data\vlc
2007-09-21 18:37 --------- d-----w C:\Program Files\BitComet
2007-09-20 15:29 --------- d-----w C:\Program Files\MSN Messenger
2007-09-19 21:41 --------- d-----w C:\Program Files\Real
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-09-19 21:40 --------- d-----w C:\Program Files\DivX
2007-09-19 21:39 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Media Player Classic
2007-09-19 21:36 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-09-19 21:20 --------- d-----w C:\Program Files\MSBuild
2007-09-19 21:20 --------- d-----w C:\Program Files\Microsoft Works
2007-09-19 21:08 --------- d-----w C:\Program Files\Alwil Software
2007-09-19 21:07 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-09-19 21:06 --------- d-----w C:\Program Files\DAEMON Tools
2007-09-19 21:04 611,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-19 21:03 --------- d-----w C:\Program Files\MUSK Codec Pack v5
2007-09-19 21:03 --------- d-----w C:\Program Files\LD-Anime
2007-09-19 21:01 --------- d-----w C:\Program Files\Media Player Classic
2007-09-19 18:23 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-09-19 18:13 --------- d-----w C:\Program Files\ASUS
2007-09-19 16:11 --------- d-----w C:\Program Files\Realtek AC97
2007-09-19 15:28 --------- d-----w C:\Program Files\Belkin
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 6.0
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 4.0
2007-09-19 00:03 --------- d-----w C:\Program Files\Services en ligne
2007-09-19 00:03 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-08-06 09:51 3,256,832 ----a-w C:\WINDOWS\explorer.exe
2007-08-02 21:28 2,780,160 ----a-w C:\WINDOWS\system32\winntbbu.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7425E671-2DA3-4030-93F0-77282D36A200}]
C:\WINDOWS\system32\ddayx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 22:09]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-19 23:41]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 16:04]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-17 00:01]
"342b807f"="C:\WINDOWS\system32\kyrjkeuh.dll" [2007-10-27 09:17]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 22:09]
"LClock"="lclock.exe" [2004-12-08 18:06 C:\WINDOWS\LClock.exe]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"LSD_III"=%systemroot%\LSD\end.cmd
"tscuninstall"=%systemroot%\system32\tscupgrd.exe
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)
"NoSMBalloonTip"=0 (0x0)
.
**************************************************************************
catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-27 12:16:43
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-27 12:17:13 - machine was rebooted
.
--- E O F ---
Voici les rapports.
Hijackthis :
Citation :
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:12:50, on 27/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\aniServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Smoky\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7425E671-2DA3-4030-93F0-77282D36A200} - C:\WINDOWS\system32\ddayx.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [342b807f] rundll32.exe "C:\WINDOWS\system32\kyrjkeuh.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00F5B27.dat
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5283 bytes
Combofix :
Citation :
ComboFix 07-10-26.4 - Smoky 2007-10-27 12:14:41.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1606 [GMT 2:00]
Running from: C:\Documents and Settings\Smoky\Bureau\ComboFix.exe
* Created a new restore point
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
C:\WINDOWS\system32\__c00F5B27.dat
C:\WINDOWS\system32\~.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
((((((((((((((((((((((((((((( Fichiers créés 2007-09-27 to 2007-10-27 ))))))))))))))))))))))))))))))))))))
.
2007-10-27 12:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-27 09:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-10-27 09:17 83,520 --a------ C:\WINDOWS\system32\kyrjkeuh.dll
2007-10-27 09:11 10,816 --a------ C:\WINDOWS\system32\cceeslxh.dll
2007-10-26 23:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-26 21:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-10-26 21:09 240,480 ---hs---- C:\WINDOWS\system32\xyadd.bak2
2007-10-26 19:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-26 19:00 <REP> d-------- C:\Program Files\Lavasoft
2007-10-26 19:00 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Lavasoft
2007-10-26 18:47 2,348 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-26 18:21 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-10-26 12:31 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\teamspeak2
2007-10-26 12:30 <REP> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-26 12:21 311,392 --a------ C:\WINDOWS\system32\ddayx.VIR
2007-10-26 12:16 145,929 --a------ C:\WINDOWS\system32\sysdl132.exe
2007-10-26 12:16 33,792 --a------ C:\WINDOWS\system32\nnnkhhf.dll
2007-10-17 00:01 <REP> d-------- C:\WINDOWS\system32\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\iTunes
2007-10-17 00:01 <REP> d-------- C:\Program Files\iPod
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Apple Computer
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-10-17 00:01 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2007-09-27 18:29 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Ahead
2007-09-27 18:28 <REP> d-------- C:\Program Files\Nero
2007-09-27 18:28 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2007-09-27 18:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-16 22:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-03 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-24 18:13 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Command & Conquer 3 Les guerres du Tiberium
2007-09-24 16:59 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-09-23 19:30 --------- d--h--r C:\Documents and Settings\Smoky\Application Data\SecuROM
2007-09-23 19:09 --------- d-----w C:\Program Files\Electronic Arts
2007-09-23 08:01 --------- d-----w C:\Documents and Settings\Smoky\Application Data\AdobeUM
2007-09-22 10:16 --------- d-----w C:\Program Files\VideoLAN
2007-09-22 10:16 --------- d-----w C:\Documents and Settings\Smoky\Application Data\vlc
2007-09-21 18:37 --------- d-----w C:\Program Files\BitComet
2007-09-20 15:29 --------- d-----w C:\Program Files\MSN Messenger
2007-09-19 21:41 --------- d-----w C:\Program Files\Real
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-09-19 21:40 --------- d-----w C:\Program Files\DivX
2007-09-19 21:39 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Media Player Classic
2007-09-19 21:36 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-09-19 21:20 --------- d-----w C:\Program Files\MSBuild
2007-09-19 21:20 --------- d-----w C:\Program Files\Microsoft Works
2007-09-19 21:08 --------- d-----w C:\Program Files\Alwil Software
2007-09-19 21:07 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-09-19 21:06 --------- d-----w C:\Program Files\DAEMON Tools
2007-09-19 21:04 611,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-19 21:03 --------- d-----w C:\Program Files\MUSK Codec Pack v5
2007-09-19 21:03 --------- d-----w C:\Program Files\LD-Anime
2007-09-19 21:01 --------- d-----w C:\Program Files\Media Player Classic
2007-09-19 18:23 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-09-19 18:13 --------- d-----w C:\Program Files\ASUS
2007-09-19 16:11 --------- d-----w C:\Program Files\Realtek AC97
2007-09-19 15:28 --------- d-----w C:\Program Files\Belkin
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 6.0
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 4.0
2007-09-19 00:03 --------- d-----w C:\Program Files\Services en ligne
2007-09-19 00:03 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-08-06 09:51 3,256,832 ----a-w C:\WINDOWS\explorer.exe
2007-08-02 21:28 2,780,160 ----a-w C:\WINDOWS\system32\winntbbu.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7425E671-2DA3-4030-93F0-77282D36A200}]
C:\WINDOWS\system32\ddayx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 22:09]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-19 23:41]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 16:04]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-17 00:01]
"342b807f"="C:\WINDOWS\system32\kyrjkeuh.dll" [2007-10-27 09:17]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 22:09]
"LClock"="lclock.exe" [2004-12-08 18:06 C:\WINDOWS\LClock.exe]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"LSD_III"=%systemroot%\LSD\end.cmd
"tscuninstall"=%systemroot%\system32\tscupgrd.exe
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)
"NoSMBalloonTip"=0 (0x0)
.
**************************************************************************
catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-27 12:16:43
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-27 12:17:13 - machine was rebooted
.
--- E O F ---
Nouveau rapport Hijackthis :
Scan saved at 12:27:42, on 27/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\aniServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Smoky\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7425E671-2DA3-4030-93F0-77282D36A200} - C:\WINDOWS\system32\ddayx.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [342b807f] rundll32.exe "C:\WINDOWS\system32\kyrjkeuh.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5109 bytes
Citation :
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:27:42, on 27/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\aniServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Smoky\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7425E671-2DA3-4030-93F0-77282D36A200} - C:\WINDOWS\system32\ddayx.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [342b807f] rundll32.exe "C:\WINDOWS\system32\kyrjkeuh.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5109 bytes
Et voici :
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1644 [GMT 2:00]
Running from: C:\Documents and Settings\Smoky\Bureau\ComboFix.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-27 to 2007-10-27 ))))))))))))))))))))))))))))))))))))
.
2007-10-27 12:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-27 09:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-10-27 09:17 83,520 --a------ C:\WINDOWS\system32\kyrjkeuh.dll
2007-10-27 09:11 10,816 --a------ C:\WINDOWS\system32\cceeslxh.dll
2007-10-26 23:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-26 21:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-10-26 21:09 240,480 ---hs---- C:\WINDOWS\system32\xyadd.bak2
2007-10-26 19:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-26 19:00 <REP> d-------- C:\Program Files\Lavasoft
2007-10-26 19:00 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Lavasoft
2007-10-26 18:47 2,348 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-26 18:21 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-10-26 12:31 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\teamspeak2
2007-10-26 12:30 <REP> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-26 12:21 311,392 --a------ C:\WINDOWS\system32\ddayx.VIR
2007-10-26 12:16 145,929 --a------ C:\WINDOWS\system32\sysdl132.exe
2007-10-26 12:16 33,792 --a------ C:\WINDOWS\system32\nnnkhhf.dll
2007-10-17 00:01 <REP> d-------- C:\WINDOWS\system32\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\iTunes
2007-10-17 00:01 <REP> d-------- C:\Program Files\iPod
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Apple Computer
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-10-17 00:01 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2007-09-27 18:29 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Ahead
2007-09-27 18:28 <REP> d-------- C:\Program Files\Nero
2007-09-27 18:28 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2007-09-27 18:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-16 22:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-03 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-24 18:13 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Command & Conquer 3 Les guerres du Tiberium
2007-09-24 16:59 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-09-23 19:30 --------- d--h--r C:\Documents and Settings\Smoky\Application Data\SecuROM
2007-09-23 19:09 --------- d-----w C:\Program Files\Electronic Arts
2007-09-23 08:01 --------- d-----w C:\Documents and Settings\Smoky\Application Data\AdobeUM
2007-09-22 10:16 --------- d-----w C:\Program Files\VideoLAN
2007-09-22 10:16 --------- d-----w C:\Documents and Settings\Smoky\Application Data\vlc
2007-09-21 18:37 --------- d-----w C:\Program Files\BitComet
2007-09-20 15:29 --------- d-----w C:\Program Files\MSN Messenger
2007-09-19 21:41 --------- d-----w C:\Program Files\Real
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-09-19 21:40 --------- d-----w C:\Program Files\DivX
2007-09-19 21:39 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Media Player Classic
2007-09-19 21:36 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-09-19 21:20 --------- d-----w C:\Program Files\MSBuild
2007-09-19 21:20 --------- d-----w C:\Program Files\Microsoft Works
2007-09-19 21:08 --------- d-----w C:\Program Files\Alwil Software
2007-09-19 21:07 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-09-19 21:06 --------- d-----w C:\Program Files\DAEMON Tools
2007-09-19 21:04 611,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-19 21:03 --------- d-----w C:\Program Files\MUSK Codec Pack v5
2007-09-19 21:03 --------- d-----w C:\Program Files\LD-Anime
2007-09-19 21:01 --------- d-----w C:\Program Files\Media Player Classic
2007-09-19 18:23 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-09-19 18:13 --------- d-----w C:\Program Files\ASUS
2007-09-19 16:11 --------- d-----w C:\Program Files\Realtek AC97
2007-09-19 15:28 --------- d-----w C:\Program Files\Belkin
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 6.0
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 4.0
2007-09-19 00:03 --------- d-----w C:\Program Files\Services en ligne
2007-09-19 00:03 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-08-06 09:51 3,256,832 ----a-w C:\WINDOWS\explorer.exe
2007-08-02 21:28 2,780,160 ----a-w C:\WINDOWS\system32\winntbbu.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7425E671-2DA3-4030-93F0-77282D36A200}]
C:\WINDOWS\system32\ddayx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 22:09]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-19 23:41]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 16:04]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-17 00:01]
"342b807f"="C:\WINDOWS\system32\kyrjkeuh.dll" [2007-10-27 09:17]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 22:09]
"LClock"="lclock.exe" [2004-12-08 18:06 C:\WINDOWS\LClock.exe]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"LSD_III"=%systemroot%\LSD\end.cmd
"tscuninstall"=%systemroot%\system32\tscupgrd.exe
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)
"NoSMBalloonTip"=0 (0x0)
R2 ANISERVICE;Airgo Networks NIC Service;C:\WINDOWS\System32\aniServ.exe
R3 Airgo;Belkin Wireless Pre-N Notebook Network Driver;C:\WINDOWS\system32\DRIVERS\wnihdd51.sys
R3 WNIPROT5;WNIPROT5 Protocol Driver;\??\C:\WINDOWS\System32\WNIPROT5.SYS
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
.
**************************************************************************
catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-27 12:38:17
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-27 12:38:33
C:\ComboFix2.txt ... 2007-10-27 12:17
.
--- E O F ---
Citation :
ComboFix 07-10-26.4 - Smoky 2007-10-27 12:37:40.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1644 [GMT 2:00]
Running from: C:\Documents and Settings\Smoky\Bureau\ComboFix.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-27 to 2007-10-27 ))))))))))))))))))))))))))))))))))))
.
2007-10-27 12:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-27 09:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-10-27 09:17 83,520 --a------ C:\WINDOWS\system32\kyrjkeuh.dll
2007-10-27 09:11 10,816 --a------ C:\WINDOWS\system32\cceeslxh.dll
2007-10-26 23:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-26 21:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-10-26 21:09 240,480 ---hs---- C:\WINDOWS\system32\xyadd.bak2
2007-10-26 19:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-26 19:00 <REP> d-------- C:\Program Files\Lavasoft
2007-10-26 19:00 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Lavasoft
2007-10-26 18:47 2,348 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-26 18:21 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-10-26 12:31 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\teamspeak2
2007-10-26 12:30 <REP> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-26 12:21 311,392 --a------ C:\WINDOWS\system32\ddayx.VIR
2007-10-26 12:16 145,929 --a------ C:\WINDOWS\system32\sysdl132.exe
2007-10-26 12:16 33,792 --a------ C:\WINDOWS\system32\nnnkhhf.dll
2007-10-17 00:01 <REP> d-------- C:\WINDOWS\system32\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\iTunes
2007-10-17 00:01 <REP> d-------- C:\Program Files\iPod
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Apple Computer
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-10-17 00:01 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2007-09-27 18:29 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Ahead
2007-09-27 18:28 <REP> d-------- C:\Program Files\Nero
2007-09-27 18:28 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2007-09-27 18:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-16 22:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-03 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-24 18:13 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Command & Conquer 3 Les guerres du Tiberium
2007-09-24 16:59 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-09-23 19:30 --------- d--h--r C:\Documents and Settings\Smoky\Application Data\SecuROM
2007-09-23 19:09 --------- d-----w C:\Program Files\Electronic Arts
2007-09-23 08:01 --------- d-----w C:\Documents and Settings\Smoky\Application Data\AdobeUM
2007-09-22 10:16 --------- d-----w C:\Program Files\VideoLAN
2007-09-22 10:16 --------- d-----w C:\Documents and Settings\Smoky\Application Data\vlc
2007-09-21 18:37 --------- d-----w C:\Program Files\BitComet
2007-09-20 15:29 --------- d-----w C:\Program Files\MSN Messenger
2007-09-19 21:41 --------- d-----w C:\Program Files\Real
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-09-19 21:40 --------- d-----w C:\Program Files\DivX
2007-09-19 21:39 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Media Player Classic
2007-09-19 21:36 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-09-19 21:20 --------- d-----w C:\Program Files\MSBuild
2007-09-19 21:20 --------- d-----w C:\Program Files\Microsoft Works
2007-09-19 21:08 --------- d-----w C:\Program Files\Alwil Software
2007-09-19 21:07 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-09-19 21:06 --------- d-----w C:\Program Files\DAEMON Tools
2007-09-19 21:04 611,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-19 21:03 --------- d-----w C:\Program Files\MUSK Codec Pack v5
2007-09-19 21:03 --------- d-----w C:\Program Files\LD-Anime
2007-09-19 21:01 --------- d-----w C:\Program Files\Media Player Classic
2007-09-19 18:23 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-09-19 18:13 --------- d-----w C:\Program Files\ASUS
2007-09-19 16:11 --------- d-----w C:\Program Files\Realtek AC97
2007-09-19 15:28 --------- d-----w C:\Program Files\Belkin
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 6.0
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 4.0
2007-09-19 00:03 --------- d-----w C:\Program Files\Services en ligne
2007-09-19 00:03 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-08-06 09:51 3,256,832 ----a-w C:\WINDOWS\explorer.exe
2007-08-02 21:28 2,780,160 ----a-w C:\WINDOWS\system32\winntbbu.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7425E671-2DA3-4030-93F0-77282D36A200}]
C:\WINDOWS\system32\ddayx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 22:09]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-19 23:41]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-10-13 16:04]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-17 00:01]
"342b807f"="C:\WINDOWS\system32\kyrjkeuh.dll" [2007-10-27 09:17]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 22:09]
"LClock"="lclock.exe" [2004-12-08 18:06 C:\WINDOWS\LClock.exe]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"LSD_III"=%systemroot%\LSD\end.cmd
"tscuninstall"=%systemroot%\system32\tscupgrd.exe
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)
"NoSMBalloonTip"=0 (0x0)
R2 ANISERVICE;Airgo Networks NIC Service;C:\WINDOWS\System32\aniServ.exe
R3 Airgo;Belkin Wireless Pre-N Notebook Network Driver;C:\WINDOWS\system32\DRIVERS\wnihdd51.sys
R3 WNIPROT5;WNIPROT5 Protocol Driver;\??\C:\WINDOWS\System32\WNIPROT5.SYS
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
.
**************************************************************************
catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-27 12:38:17
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-27 12:38:33
C:\ComboFix2.txt ... 2007-10-27 12:17
.
--- E O F ---
Re,
Copie (Ctrl+C) le texte se situant dans le cadre ci-dessous :
Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
![]()
Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
[#ff0000]NOTE : S'il n'y a pas de rédémarrage, poste quand même les rapports demandés.[/#f]
Copie (Ctrl+C) le texte se situant dans le cadre ci-dessous :
File::
C:\WINDOWS\system32\kyrjkeuh.dll
C:\WINDOWS\system32\cceeslxh.dll
C:\WINDOWS\system32\xyadd.bak2
C:\WINDOWS\system32\ddayx.VIR
C:\WINDOWS\system32\sysdl132.exe
C:\WINDOWS\system32\nnnkhhf.dll
C:\WINDOWS\unvise32qt.exe
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7425E671-2DA3-4030-93F0-77282D36A200}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"342b807f"=-
C:\WINDOWS\system32\kyrjkeuh.dll
C:\WINDOWS\system32\cceeslxh.dll
C:\WINDOWS\system32\xyadd.bak2
C:\WINDOWS\system32\ddayx.VIR
C:\WINDOWS\system32\sysdl132.exe
C:\WINDOWS\system32\nnnkhhf.dll
C:\WINDOWS\unvise32qt.exe
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7425E671-2DA3-4030-93F0-77282D36A200}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"342b807f"=-
Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
[#ff0000]NOTE : S'il n'y a pas de rédémarrage, poste quand même les rapports demandés.[/#f]
Rapports après redémarage.
Combofix :
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1655 [GMT 2:00]
Running from: C:\Documents and Settings\Smoky\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Smoky\Bureau\CFScript.txt
* Created a new restore point
FILE::
C:\WINDOWS\system32\cceeslxh.dll
C:\WINDOWS\system32\ddayx.VIR
C:\WINDOWS\system32\kyrjkeuh.dll
C:\WINDOWS\system32\nnnkhhf.dll
C:\WINDOWS\system32\sysdl132.exe
C:\WINDOWS\system32\xyadd.bak2
C:\WINDOWS\unvise32qt.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\cceeslxh.dll
C:\WINDOWS\system32\ddayx.VIR
C:\WINDOWS\system32\kyrjkeuh.dll
C:\WINDOWS\system32\nnnkhhf.dll
C:\WINDOWS\system32\sysdl132.exe
C:\WINDOWS\system32\xyadd.bak2
C:\WINDOWS\unvise32qt.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-27 to 2007-10-27 ))))))))))))))))))))))))))))))))))))
.
2007-10-27 12:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-27 09:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-10-26 23:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-26 21:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-10-26 19:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-26 19:00 <REP> d-------- C:\Program Files\Lavasoft
2007-10-26 19:00 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Lavasoft
2007-10-26 18:47 2,348 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-26 18:21 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-10-26 12:31 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\teamspeak2
2007-10-26 12:30 <REP> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-17 00:01 <REP> d-------- C:\WINDOWS\system32\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\iTunes
2007-10-17 00:01 <REP> d-------- C:\Program Files\iPod
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Apple Computer
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-09-27 18:29 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Ahead
2007-09-27 18:28 <REP> d-------- C:\Program Files\Nero
2007-09-27 18:28 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2007-09-27 18:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-16 22:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-03 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-24 18:13 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Command & Conquer 3 Les guerres du Tiberium
2007-09-24 16:59 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-09-23 19:30 --------- d--h--r C:\Documents and Settings\Smoky\Application Data\SecuROM
2007-09-23 19:09 --------- d-----w C:\Program Files\Electronic Arts
2007-09-23 08:01 --------- d-----w C:\Documents and Settings\Smoky\Application Data\AdobeUM
2007-09-22 10:16 --------- d-----w C:\Program Files\VideoLAN
2007-09-22 10:16 --------- d-----w C:\Documents and Settings\Smoky\Application Data\vlc
2007-09-21 18:37 --------- d-----w C:\Program Files\BitComet
2007-09-20 15:29 --------- d-----w C:\Program Files\MSN Messenger
2007-09-19 21:41 --------- d-----w C:\Program Files\Real
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-09-19 21:40 --------- d-----w C:\Program Files\DivX
2007-09-19 21:39 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Media Player Classic
2007-09-19 21:36 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-09-19 21:20 --------- d-----w C:\Program Files\MSBuild
2007-09-19 21:20 --------- d-----w C:\Program Files\Microsoft Works
2007-09-19 21:08 --------- d-----w C:\Program Files\Alwil Software
2007-09-19 21:07 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-09-19 21:06 --------- d-----w C:\Program Files\DAEMON Tools
2007-09-19 21:04 611,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-19 21:03 --------- d-----w C:\Program Files\MUSK Codec Pack v5
2007-09-19 21:03 --------- d-----w C:\Program Files\LD-Anime
2007-09-19 21:01 --------- d-----w C:\Program Files\Media Player Classic
2007-09-19 18:23 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-09-19 18:13 --------- d-----w C:\Program Files\ASUS
2007-09-19 16:11 --------- d-----w C:\Program Files\Realtek AC97
2007-09-19 15:28 --------- d-----w C:\Program Files\Belkin
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 6.0
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 4.0
2007-09-19 00:03 --------- d-----w C:\Program Files\Services en ligne
2007-09-19 00:03 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-08-06 09:51 3,256,832 ----a-w C:\WINDOWS\explorer.exe
2007-08-02 21:28 2,780,160 ----a-w C:\WINDOWS\system32\winntbbu.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 22:09]
"LClock"="lclock.exe" [2004-12-08 18:06 C:\WINDOWS\LClock.exe]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"LSD_III"=%systemroot%\LSD\end.cmd
"tscuninstall"=%systemroot%\system32\tscupgrd.exe
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)
"NoSMBalloonTip"=0 (0x0)
.
**************************************************************************
catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-27 12:54:23
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-27 12:54:48 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-27 12:38
C:\ComboFix3.txt ... 2007-10-27 12:17
.
--- E O F ---
Hijackthis :
Scan saved at 12:56:07, on 27/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\aniServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Smoky\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4002 bytes
Combofix :
Citation :
ComboFix 07-10-26.4 - Smoky 2007-10-27 12:52:40.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1655 [GMT 2:00]
Running from: C:\Documents and Settings\Smoky\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Smoky\Bureau\CFScript.txt
* Created a new restore point
FILE::
C:\WINDOWS\system32\cceeslxh.dll
C:\WINDOWS\system32\ddayx.VIR
C:\WINDOWS\system32\kyrjkeuh.dll
C:\WINDOWS\system32\nnnkhhf.dll
C:\WINDOWS\system32\sysdl132.exe
C:\WINDOWS\system32\xyadd.bak2
C:\WINDOWS\unvise32qt.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\cceeslxh.dll
C:\WINDOWS\system32\ddayx.VIR
C:\WINDOWS\system32\kyrjkeuh.dll
C:\WINDOWS\system32\nnnkhhf.dll
C:\WINDOWS\system32\sysdl132.exe
C:\WINDOWS\system32\xyadd.bak2
C:\WINDOWS\unvise32qt.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2007-09-27 to 2007-10-27 ))))))))))))))))))))))))))))))))))))
.
2007-10-27 12:14 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-27 09:41 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-10-26 23:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-26 21:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-10-26 19:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-26 19:00 <REP> d-------- C:\Program Files\Lavasoft
2007-10-26 19:00 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Lavasoft
2007-10-26 18:47 2,348 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-26 18:21 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-10-26 12:31 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\teamspeak2
2007-10-26 12:30 <REP> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-17 00:01 <REP> d-------- C:\WINDOWS\system32\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Program Files\iTunes
2007-10-17 00:01 <REP> d-------- C:\Program Files\iPod
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Apple Computer
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-10-17 00:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-09-27 18:29 <REP> d-------- C:\Documents and Settings\Smoky\Application Data\Ahead
2007-09-27 18:28 <REP> d-------- C:\Program Files\Nero
2007-09-27 18:28 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2007-09-27 18:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-16 22:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-03 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-24 18:13 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Command & Conquer 3 Les guerres du Tiberium
2007-09-24 16:59 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-09-23 19:30 --------- d--h--r C:\Documents and Settings\Smoky\Application Data\SecuROM
2007-09-23 19:09 --------- d-----w C:\Program Files\Electronic Arts
2007-09-23 08:01 --------- d-----w C:\Documents and Settings\Smoky\Application Data\AdobeUM
2007-09-22 10:16 --------- d-----w C:\Program Files\VideoLAN
2007-09-22 10:16 --------- d-----w C:\Documents and Settings\Smoky\Application Data\vlc
2007-09-21 18:37 --------- d-----w C:\Program Files\BitComet
2007-09-20 15:29 --------- d-----w C:\Program Files\MSN Messenger
2007-09-19 21:41 --------- d-----w C:\Program Files\Real
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-09-19 21:41 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-09-19 21:40 --------- d-----w C:\Program Files\DivX
2007-09-19 21:39 --------- d-----w C:\Documents and Settings\Smoky\Application Data\Media Player Classic
2007-09-19 21:36 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-09-19 21:20 --------- d-----w C:\Program Files\MSBuild
2007-09-19 21:20 --------- d-----w C:\Program Files\Microsoft Works
2007-09-19 21:08 --------- d-----w C:\Program Files\Alwil Software
2007-09-19 21:07 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-09-19 21:06 --------- d-----w C:\Program Files\DAEMON Tools
2007-09-19 21:04 611,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-19 21:03 --------- d-----w C:\Program Files\MUSK Codec Pack v5
2007-09-19 21:03 --------- d-----w C:\Program Files\LD-Anime
2007-09-19 21:01 --------- d-----w C:\Program Files\Media Player Classic
2007-09-19 18:23 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-09-19 18:13 --------- d-----w C:\Program Files\ASUS
2007-09-19 16:11 --------- d-----w C:\Program Files\Realtek AC97
2007-09-19 15:28 --------- d-----w C:\Program Files\Belkin
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\SpeechEngines
2007-09-19 01:59 --------- d-----w C:\Program Files\Fichiers communs\ODBC
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 6.0
2007-09-19 00:05 --------- d-----w C:\Program Files\MSXML 4.0
2007-09-19 00:03 --------- d-----w C:\Program Files\Services en ligne
2007-09-19 00:03 --------- d-----w C:\Program Files\Fichiers communs\MSSoap
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-08-06 09:51 3,256,832 ----a-w C:\WINDOWS\explorer.exe
2007-08-02 21:28 2,780,160 ----a-w C:\WINDOWS\system32\winntbbu.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 22:09]
"LClock"="lclock.exe" [2004-12-08 18:06 C:\WINDOWS\LClock.exe]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"LSD_III"=%systemroot%\LSD\end.cmd
"tscuninstall"=%systemroot%\system32\tscupgrd.exe
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)
"NoSMBalloonTip"=0 (0x0)
.
**************************************************************************
catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-27 12:54:23
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-27 12:54:48 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-27 12:38
C:\ComboFix3.txt ... 2007-10-27 12:17
.
--- E O F ---
Hijackthis :
Citation :
Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:56:07, on 27/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\aniServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Smoky\Bureau\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4002 bytes
Sa a l'air sur les premieres minutes ![:wahoo:]( ":wahoo:")
mais je vais laisser tourner un peu antivir guard pour voir, j'avais completement désinstaller l'anti virus car n'arrivant pas à ne pas lancer le "guard" au démarage de windows je ne pouvais plus rien faire sur le pc vu le spam de fenetres détection qu'il provoquait.
Le temps d'écrire ceq qqes lignes en tout cas tout à l'air ok.
Je lance un update des definitions de virus puis un scan complet, je redémarre et si tout est ok j'édite avec "résolu".
Merci à toi en tout cas
mais je vais laisser tourner un peu antivir guard pour voir, j'avais completement désinstaller l'anti virus car n'arrivant pas à ne pas lancer le "guard" au démarage de windows je ne pouvais plus rien faire sur le pc vu le spam de fenetres détection qu'il provoquait.Le temps d'écrire ceq qqes lignes en tout cas tout à l'air ok.
Je lance un update des definitions de virus puis un scan complet, je redémarre et si tout est ok j'édite avec "résolu".
Merci à toi en tout cas
1ere analyse avec antivir à 13:52 :
Action(s) taken:
The file was moved to "47532393.qua"!
The file contains a virus or unwanted program 'TR/Vundo.Gen' [trojan]
Action(s) taken:
The file was moved to "47532384.qua"!
The file contains a virus or unwanted program 'HEUR/Malware' [heuristic]
Action(s) taken:
The file was moved to "47532377.qua"!
2eme analyse à 14:09 :
Pourvu que sa dure.
J'édite en rentrant si tout est ok.
Merci pour tout
Citation :
'2' viruses or unwanted program found!Citation :
The file contains a virus or unwanted program 'TR/Dldr.BHO.AL.4' [trojan]Action(s) taken:
The file was moved to "47532393.qua"!
The file contains a virus or unwanted program 'TR/Vundo.Gen' [trojan]
Action(s) taken:
The file was moved to "47532384.qua"!
The file contains a virus or unwanted program 'HEUR/Malware' [heuristic]
Action(s) taken:
The file was moved to "47532377.qua"!
2eme analyse à 14:09 :
Citation :
No viruses or unwanted program found!Pourvu que sa dure.
J'édite en rentrant si tout est ok.
Merci pour tout
voici mon rapport!!! est ce que quelqu'un pourrait m'aider?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:07:53, on 10/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [GridinSoft Trojan Killer] "C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe" 0
O4 - HKUS\S-1-5-19\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'Default user')
O4 - S-1-5-18 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Envoyer via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
O8 - Extra context menu item: Envoyer via message(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe
--
End of file - 8054 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:07:53, on 10/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [GridinSoft Trojan Killer] "C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe" 0
O4 - HKUS\S-1-5-19\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [XPPro4.0] %systemroot%\REG\run.cmd (User 'Default user')
O4 - S-1-5-18 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Envoyer via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
O8 - Extra context menu item: Envoyer via message(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe
--
End of file - 8054 bytes
Lassé par la pub ? Créez un compte
- Contenus similaires :
- ForumComment supprimer TR/Vundo.Gen détecté par antivir
- Forum[Résolu] Antivir me détecte des virus
- Forum[Résolu]Virus TR Rootkit Gen detecté par Antivir
- Forum[Résolu] Virus "RKIT/Agent.34816" détécté par antivir
- ForumResolu Antivir me detecte des virus
- Forum[Résolu] Trojan détecté par Antivir
- Forum[Résolu] Antivir detecte un trojan horse: TR/Rootkit.gen
- ForumAntivir detecte un virus (?) sous le nom de "RKIT/Agent.agw" [Résolu]
- Forum[Resolu] Detection par Antivir Java/Agent .BH
- Forum[Résolu] Virus détectés par antivir (TR/Crypt.XPACK.Gen,JAVA/Agent.BH)
- Voir plus
