infecter par win 32 ; BHO - KD - Sécurité - Virus
TomsGuide.com : 700 000 inscrits répondent à toutes vos questions high-tech et informatique.
Pour obtenir de l'aide, inscrivez-vous gratuitement !
 

Ajouter une réponse



Mot :   Pseudo :  
 
Bas de page
Auteur
 Sujet : infecter par win 32 ; BHO - KD
 
jean-yves49
Profil : IDNaute
Plus d'informations
n°273486
16-01-2008 à 19:52:03

Bonsoir, je suis infecté par le cheval de troie win32:BHO-KD qui refuse de se faire traiter.
Comme je ne connais pas grand chose en informatique, j'aimerais avoir de l'aide. Merci
J'ai vu sur le forum que vous aimiez bien avoir un rapport Hijackthis.
Le voici

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:27:18, on 16/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\System32\alg.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Shareaza\Shareaza.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\AOL 7.0\aoltray.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINNT\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/disp [...] tbid=61005
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aliceadsl.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_ [...] TbId=61005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=61005
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_ [...] TbId=61005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {AD507CF6-72F8-4EA6-926F-4E52388E152B} - C:\WINNT\system32\dmoc.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Icône AOL.lnk = C:\Program Files\AOL 7.0\aoltray.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\system32\shdocvw.dll
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O16 - DPF: {EB6D7E70-AAA9-40D9-BA05-F214089F2275} (Vitalize Class) - http://download.clickteam.com/vitalize3/vitalize.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

--
End of file - 6883 bytes

Liens sponsorisés


Inscrivez-vous ou connectez-vous pour masquer ceci.

22 U2
Profil : IDNaute
Plus d'informations
n°273493
16-01-2008 à 19:59:56

bjr, je suis assi infecté par le virus win 32 : TratBHO,

quéqué j'peux faire , j'suis pas une bête en informatique, alors si quéqu'un peux me guider , je comprends vite mais il faut m'expliquer longtemps !!!
merci d'avance;

Eric_71
Profil : Helper
Plus d'informations
n°273532
16-01-2008 à 20:42:11


Bonsoir ,

22 U2 , merci de créer ton propre sujet et d'écrire correctement

jean-yves49 , en effet tu es infecté ,

Désactive tes protections résidentes ( Antivirus , ... ) tu les réactivera après le scan

Télécharge ComboFix [:eric_71] < ici

Enregistre le sur ton Bureau et pas ailleurs !
Double clique combofix.exe ( le .exe peut ne pas apparaitre )
Pour démarrer , tape [1] puis valide , attend la fin du scan
il peut y avoir un Redémarrage du PC !

Copie / Colle le rapport généré ( C:\Combofix.txt )

jean-yves49
Profil : IDNaute
Plus d'informations
n°273579
16-01-2008 à 21:44:16

Merci a toi de me venir en aide.
Il y a eu en effet un redémarrage du pc.
Voici le rapport combofix.
J'espere avoir bien suivi tes conseils jusqu'a maintenant.

ComboFix 08-01-16.4 - jean-yves 2008-01-16 21:27:58.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.226 [GMT 1:00]
Running from: C:\Documents and Settings\jean-yves\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\jean-yves\Bureau\sudoplanet.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\InternetGameBox
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\InternetGameBox\Conditions générales.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\InternetGameBox\Confidentialité.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\InternetGameBox\Website.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet\Conditions générales.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet\Confidentialité.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet\SudoPlanet.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet\Website.lnk
C:\Documents and Settings\jean-yves\ResErrors.log
C:\Program Files\sudoplanet
C:\Program Files\sudoplanet\Conditions générales.url
C:\Program Files\sudoplanet\Confidentialité.url
C:\Program Files\sudoplanet\SudoPlanet.dll
C:\Program Files\sudoplanet\SudoPlanet.exe
C:\Program Files\sudoplanet\Website.url
C:\WINNT\pack.epk
C:\WINNT\system32\fgejtomem.dat
C:\WINNT\system32\fgejtomem_nav.dat
C:\WINNT\system32\fgejtomem_navps.dat
C:\WINNT\system32\gmrkfli.dat
C:\WINNT\system32\gmrkfli_nav.dat
C:\WINNT\system32\gmrkfli_navps.dat
c:\WINNT\system32\qjannjlpy.dat
C:\WINNT\system32\qjannjlpy.exe
c:\WINNT\system32\qjannjlpy_nav.dat
c:\WINNT\system32\qjannjlpy_navps.dat
C:\WINNT\system32\tsvzzeb.dat
C:\WINNT\system32\tsvzzeb_nav.dat
C:\WINNT\system32\tsvzzeb_navps.dat
D:\mes docs jean-yves\internetgamebox.lnk

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FMTR


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-16 to 2008-01-16 ))))))))))))))))))))))))))))))))))))
.

2008-01-16 21:33 . 2008-01-16 21:33 <REP> d-------- C:\WINNT\system32\xircom
2008-01-16 21:33 . 2008-01-16 21:33 <REP> d-------- C:\Program Files\microsoft frontpage
2008-01-16 21:26 . 2000-08-31 08:00 51,200 --a------ C:\WINNT\NirCmd.exe
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-16 06:40 . 2007-09-22 14:06 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-16 06:40 . 2007-09-22 15:59 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-01-16 06:40 . 2007-09-22 14:10 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-16 06:40 . 2007-09-22 14:11 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AVG7
2008-01-11 16:58 . 1996-08-20 20:37 15,840 --a------ C:\WINNT\system32\Machnm1.exe
2008-01-11 16:58 . 2005-09-25 16:37 5,632 --a------ C:\WINNT\system32\Machnm64.sys
2008-01-11 16:58 . 2008-01-11 16:58 3,120 --a------ C:\WINNT\system32\118290.54
2008-01-11 16:58 . 2008-01-11 16:58 3,120 --a------ C:\WINNT\118294.78
2008-01-11 16:58 . 2003-08-13 00:27 2,304 --a------ C:\WINNT\system32\Machnm32.sys
2008-01-08 20:05 . 2008-01-08 20:05 244 --ah----- C:\sqmnoopt06.sqm
2008-01-08 19:59 . 2008-01-08 19:59 <REP> d-------- C:\Documents and Settings\jean-yves\Application Data\Talkback
2008-01-07 21:33 . 2008-01-12 23:21 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
2008-01-07 19:08 . 2008-01-07 19:08 <REP> d-------- C:\Program Files\Trend Micro
2008-01-04 15:58 . 2008-01-04 15:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-04 14:55 . 2007-12-04 14:04 837,496 --a------ C:\WINNT\system32\aswBoot.exe
2008-01-04 14:55 . 2004-01-09 10:13 380,928 --a------ C:\WINNT\system32\actskin4.ocx
2008-01-04 14:55 . 2007-12-04 13:54 95,608 --a------ C:\WINNT\system32\AvastSS.scr
2008-01-04 14:55 . 2007-12-04 15:55 94,544 --a------ C:\WINNT\system32\drivers\aswmon2.sys
2008-01-04 14:55 . 2007-12-04 15:56 93,264 --a------ C:\WINNT\system32\drivers\aswmon.sys
2008-01-04 14:55 . 2007-12-04 15:51 42,912 --a------ C:\WINNT\system32\drivers\aswTdi.sys
2008-01-04 14:55 . 2007-12-04 15:49 26,624 --a------ C:\WINNT\system32\drivers\aavmker4.sys
2008-01-04 14:55 . 2007-12-04 15:53 23,152 --a------ C:\WINNT\system32\drivers\aswRdr.sys
2008-01-04 12:56 . 2008-01-04 12:56 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-01-04 12:55 . 2008-01-04 12:55 <REP> d-------- C:\Documents and Settings\brigitte\Application Data\Ahead
2008-01-03 14:43 . 2008-01-03 14:43 0 --a------ C:\WINNT\nsreg.dat
2008-01-03 14:36 . 2008-01-11 15:00 <REP> d-------- C:\Program Files\Norton Security Scan
2008-01-02 13:29 . 2008-01-02 13:41 <REP> d-------- C:\Program Files\Fichiers communs\Vitalize
2007-12-31 12:35 . 2007-12-31 12:35 <REP> d-------- C:\Program Files\Disney Interactive
2007-12-31 12:35 . 2007-12-31 12:36 858 --a------ C:\WINNT\disney.ini
2007-12-30 13:21 . 2007-12-30 13:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-12-30 13:21 . 1999-12-17 10:13 86,016 --a------ C:\WINNT\unvise32.exe
2007-12-30 13:20 . 2007-12-30 13:20 <REP> d-------- C:\Program Files\coktel
2007-12-27 16:00 . 2007-12-27 16:00 <REP> d-------- C:\Documents and Settings\brigitte\Application Data\Samsung
2007-12-25 20:29 . 2007-12-25 20:29 <REP> d-------- C:\Program Files\Infogrames
2007-12-25 19:29 . 2007-12-25 19:29 <REP> d-------- C:\Program Files\Windows Media Connect 2
2007-12-25 19:29 . 2006-10-04 15:06 1,197,294 --------- C:\WINNT\system32\dllcache\sysmain.sdb
2007-12-25 19:29 . 2006-10-04 15:06 764,868 --------- C:\WINNT\system32\dllcache\apph_sp.sdb
2007-12-25 19:29 . 2006-10-04 15:06 217,118 --------- C:\WINNT\system32\dllcache\apphelp.sdb
2007-12-25 15:53 . 2007-12-25 15:53 <REP> d-------- C:\WINNT\Cache
2007-12-25 15:52 . 2007-12-25 15:52 <REP> d-------- C:\Program Files\Samsung
2007-12-25 15:52 . 2007-12-25 15:52 <REP> d-------- C:\Program Files\Fichiers communs\ST System Shared
2007-12-25 15:52 . 2007-12-25 15:52 <REP> d-------- C:\Documents and Settings\jean-yves\Application Data\Samsung
2007-12-25 15:52 . 2004-08-04 00:57 1,712,128 --a------ C:\WINNT\system32\GdiPlus.dll
2007-12-25 15:52 . 2006-11-01 15:26 77,824 --a------ C:\WINNT\system32\xvid.ax
2007-12-25 15:52 . 2004-03-09 09:39 8,704 --a------ C:\WINNT\system32\vidccleaner.exe
2007-12-25 12:22 . 2007-12-25 20:48 <REP> d-------- C:\Program Files\Empire Interactive
2007-12-25 12:14 . 2007-12-25 12:14 <REP> d-------- C:\Program Files\Sega
2007-12-25 12:11 . 2001-12-12 17:34 65,536 --a------ C:\WINNT\wanmpsvc.exe
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\Program Files\Viewpoint
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\Program Files\Real
2007-12-25 12:10 . 2008-01-04 12:56 <REP> d-------- C:\Program Files\Fichiers communs\Real
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\My Music
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\Install AIM
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\aolextras
2007-12-25 12:10 . 2007-12-25 12:11 35,890,848 --a------ C:\WINNT\aolback.exe
2007-12-25 12:10 . 2006-09-23 11:12 1,497,088 --a------ C:\WINNT\system32\shdocvw.bak
2007-12-25 12:10 . 2007-12-25 12:10 8,552 --a------ C:\WINNT\system32\drivers\asctrm.sys
2007-12-25 12:09 . 2007-12-25 12:10 <REP> d-------- C:\Program Files\Fichiers communs\aolshare
2007-12-25 12:09 . 2007-12-31 16:42 <REP> d-------- C:\Program Files\AOL 7.0
2007-12-25 12:09 . 2001-09-25 09:39 1,044,480 --a------ C:\WINNT\system32\roboex32.dll
2007-12-25 12:09 . 2001-09-25 09:39 153,088 --a------ C:\WINNT\system32\jgdwmie.dll
2007-12-25 12:09 . 2001-09-25 09:39 54,784 --a------ C:\WINNT\system32\Inetwh32.dll
2007-12-25 12:09 . 2001-09-25 09:38 29,184 --a------ C:\WINNT\system32\popup.ocx
2007-12-25 12:09 . 2001-09-27 10:58 28,396 --a------ C:\WINNT\system32\drivers\wanatw4.sys
2007-12-25 12:09 . 2001-11-26 23:41 24,641 --a------ C:\WINNT\system32\aolddial.dll
2007-12-25 12:07 . 2007-12-25 12:11 358 --ah----- C:\IPH.PH
2007-12-22 09:37 . 2007-12-22 10:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-22 09:10 . 2007-12-22 09:19 <REP> d-------- C:\Program Files\Panda Security
2007-12-20 21:40 . 2008-01-04 09:13 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-20 21:02 . 2007-12-20 21:02 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2007-12-20 20:24 . 2005-09-23 08:29 626,688 --a------ C:\WINNT\system32\msvcr80.dll
2007-12-19 21:50 . 2007-12-19 21:50 300,544 --a------ C:\WINNT\system32\ajesin.exe
2007-12-19 14:15 . 2007-12-19 14:21 <REP> d-------- C:\de3f06edfd75e82d8e92e7d19188bc
2007-12-16 10:44 . 2007-12-16 10:44 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-16 10:43 . 2007-12-16 10:43 <REP> d-------- C:\Program Files\Windows Live
2007-12-16 10:43 . 2007-12-16 10:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 16:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-15 12:33 --------- d-----w C:\Program Files\microsoft money 2005
2008-01-15 12:29 964 ----a-w C:\Documents and Settings\brigitte\Application Data\wklnhst.dat
2008-01-15 12:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-15 12:02 5,554 ----a-w C:\Documents and Settings\jean-yves\Application Data\wklnhst.dat
2008-01-13 08:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-04 13:35 --------- d-----w C:\Program Files\Fichiers communs\MenacesProtection
2008-01-04 11:55 --------- d-----w C:\Program Files\Google
2007-12-25 14:51 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-12-20 20:39 --------- d-----w C:\Program Files\Spyware Terminator
2007-12-20 19:12 --------- d-----w C:\Documents and Settings\brigitte\Application Data\Spyware Terminator
2007-12-15 12:18 --------- d-----w C:\Program Files\Windows Live Safety Center
2007-12-14 21:41 --------- d-----w C:\Documents and Settings\camille\Application Data\Spyware Terminator
2007-12-06 19:54 19,456 ----a-w C:\WINNT\system32\drivers\indmmama.dat
2007-12-05 20:11 --------- d-----w C:\Documents and Settings\jean-yves\Application Data\MenacesProtection
2007-11-27 19:45 --------- d-----w C:\Program Files\Java
2007-11-27 16:18 --------- d-----w C:\Program Files\MSN Messenger
2007-11-24 12:06 --------- d-----w C:\Program Files\USBDisk
2007-11-16 21:53 --------- d-----w C:\Program Files\Shareaza
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD507CF6-72F8-4EA6-926F-4E52388E152B}]
2004-08-05 12:00 100096 --a------ C:\WINNT\system32\dmoc.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45 1052672]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2007-02-05 03:05 4354048]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-03 09:59 68856]
"ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-05 12:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-06-10 12:12 55296 C:\WINNT\SOUNDMAN.EXE]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 20:21 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-03 14:45 185632]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-10-11 00:49 124928 C:\WINNT\system32\advpack.dll]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)

R0 eqcfranp;eqcfranp;C:\WINNT\system32\drivers\indmmama.dat []
R2 UxTuneUp;Extension de conception TuneUp;C:\WINNT\System32\svchost.exe [2004-08-05 12:00]
R3 CAM1210;SM0121 USB 2.0 Video Camera;C:\WINNT\system32\Drivers\cam1210.sys [2006-07-24 16:49]
S3 usbscan;Pilote de scanneur USB;C:\WINNT\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINNT\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-01-11 18:25:53 C:\WINNT\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-01-11 15:35:01 C:\WINNT\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 21:33:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-16 21:35:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-16 20:35:51
.
2008-01-09 06:31:31 --- E O F ---

Eric_71
Profil : Helper
Plus d'informations
n°273591
16-01-2008 à 22:02:27

Re ,

Séléctionne l'encadré ci dessous en entier , puis clique droit , choisis Copier


DirLook::
C:\de3f06edfd75e82d8e92e7d19188bc

Driver::
eqcfranp

File::
C:\WINNT\system32\ajesin.exe
C:\WINNT\system32\dmoc.dll
C:\WINNT\system32\drivers\indmmama.dat

Folder::
C:\Program Files\Viewpoint

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD507CF6-72F8-4EA6-926F-4E52388E152B}]


Colle le dans le Bloc-Notes
Enregistre le sur ton Bureau et nomme le CFScript ( type fichier texte )
Fait glisser le fichier CFScript sur le fichier ComboFix.exe comme ceci :

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Un menu va apparaitre , tape 1 puis valide
Laisse faire le scan et poste le rapport généré ( C:\ComboFix.txt )

jean-yves49
Profil : IDNaute
Plus d'informations
n°273600
16-01-2008 à 22:16:16

est ce ceci ?

ComboFix 08-01-16.4 - jean-yves 2008-01-16 21:27:58.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.226 [GMT 1:00]
Running from: C:\Documents and Settings\jean-yves\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\jean-yves\Bureau\sudoplanet.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\InternetGameBox
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\InternetGameBox\Conditions générales.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\InternetGameBox\Confidentialité.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\InternetGameBox\Website.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet\Conditions générales.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet\Confidentialité.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet\SudoPlanet.lnk
C:\Documents and Settings\jean-yves\Menu Démarrer\Programmes\SudoPlanet\Website.lnk
C:\Documents and Settings\jean-yves\ResErrors.log
C:\Program Files\sudoplanet
C:\Program Files\sudoplanet\Conditions générales.url
C:\Program Files\sudoplanet\Confidentialité.url
C:\Program Files\sudoplanet\SudoPlanet.dll
C:\Program Files\sudoplanet\SudoPlanet.exe
C:\Program Files\sudoplanet\Website.url
C:\WINNT\pack.epk
C:\WINNT\system32\fgejtomem.dat
C:\WINNT\system32\fgejtomem_nav.dat
C:\WINNT\system32\fgejtomem_navps.dat
C:\WINNT\system32\gmrkfli.dat
C:\WINNT\system32\gmrkfli_nav.dat
C:\WINNT\system32\gmrkfli_navps.dat
c:\WINNT\system32\qjannjlpy.dat
C:\WINNT\system32\qjannjlpy.exe
c:\WINNT\system32\qjannjlpy_nav.dat
c:\WINNT\system32\qjannjlpy_navps.dat
C:\WINNT\system32\tsvzzeb.dat
C:\WINNT\system32\tsvzzeb_nav.dat
C:\WINNT\system32\tsvzzeb_navps.dat
D:\mes docs jean-yves\internetgamebox.lnk

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FMTR


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-16 to 2008-01-16 ))))))))))))))))))))))))))))))))))))
.

2008-01-16 21:33 . 2008-01-16 21:33 <REP> d-------- C:\WINNT\system32\xircom
2008-01-16 21:33 . 2008-01-16 21:33 <REP> d-------- C:\Program Files\microsoft frontpage
2008-01-16 21:26 . 2000-08-31 08:00 51,200 --a------ C:\WINNT\NirCmd.exe
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-16 06:40 . 2007-09-22 14:06 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-16 06:40 . 2007-09-22 15:59 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-01-16 06:40 . 2007-09-22 14:10 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-16 06:40 . 2007-09-22 14:11 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AVG7
2008-01-11 16:58 . 1996-08-20 20:37 15,840 --a------ C:\WINNT\system32\Machnm1.exe
2008-01-11 16:58 . 2005-09-25 16:37 5,632 --a------ C:\WINNT\system32\Machnm64.sys
2008-01-11 16:58 . 2008-01-11 16:58 3,120 --a------ C:\WINNT\system32\118290.54
2008-01-11 16:58 . 2008-01-11 16:58 3,120 --a------ C:\WINNT\118294.78
2008-01-11 16:58 . 2003-08-13 00:27 2,304 --a------ C:\WINNT\system32\Machnm32.sys
2008-01-08 20:05 . 2008-01-08 20:05 244 --ah----- C:\sqmnoopt06.sqm
2008-01-08 19:59 . 2008-01-08 19:59 <REP> d-------- C:\Documents and Settings\jean-yves\Application Data\Talkback
2008-01-07 21:33 . 2008-01-12 23:21 <REP> d-------- C:\Program Files\Fichiers communs\Symantec Shared
2008-01-07 19:08 . 2008-01-07 19:08 <REP> d-------- C:\Program Files\Trend Micro
2008-01-04 15:58 . 2008-01-04 15:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-04 14:55 . 2007-12-04 14:04 837,496 --a------ C:\WINNT\system32\aswBoot.exe
2008-01-04 14:55 . 2004-01-09 10:13 380,928 --a------ C:\WINNT\system32\actskin4.ocx
2008-01-04 14:55 . 2007-12-04 13:54 95,608 --a------ C:\WINNT\system32\AvastSS.scr
2008-01-04 14:55 . 2007-12-04 15:55 94,544 --a------ C:\WINNT\system32\drivers\aswmon2.sys
2008-01-04 14:55 . 2007-12-04 15:56 93,264 --a------ C:\WINNT\system32\drivers\aswmon.sys
2008-01-04 14:55 . 2007-12-04 15:51 42,912 --a------ C:\WINNT\system32\drivers\aswTdi.sys
2008-01-04 14:55 . 2007-12-04 15:49 26,624 --a------ C:\WINNT\system32\drivers\aavmker4.sys
2008-01-04 14:55 . 2007-12-04 15:53 23,152 --a------ C:\WINNT\system32\drivers\aswRdr.sys
2008-01-04 12:56 . 2008-01-04 12:56 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-01-04 12:55 . 2008-01-04 12:55 <REP> d-------- C:\Documents and Settings\brigitte\Application Data\Ahead
2008-01-03 14:43 . 2008-01-03 14:43 0 --a------ C:\WINNT\nsreg.dat
2008-01-03 14:36 . 2008-01-11 15:00 <REP> d-------- C:\Program Files\Norton Security Scan
2008-01-02 13:29 . 2008-01-02 13:41 <REP> d-------- C:\Program Files\Fichiers communs\Vitalize
2007-12-31 12:35 . 2007-12-31 12:35 <REP> d-------- C:\Program Files\Disney Interactive
2007-12-31 12:35 . 2007-12-31 12:36 858 --a------ C:\WINNT\disney.ini
2007-12-30 13:21 . 2007-12-30 13:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2007-12-30 13:21 . 1999-12-17 10:13 86,016 --a------ C:\WINNT\unvise32.exe
2007-12-30 13:20 . 2007-12-30 13:20 <REP> d-------- C:\Program Files\coktel
2007-12-27 16:00 . 2007-12-27 16:00 <REP> d-------- C:\Documents and Settings\brigitte\Application Data\Samsung
2007-12-25 20:29 . 2007-12-25 20:29 <REP> d-------- C:\Program Files\Infogrames
2007-12-25 19:29 . 2007-12-25 19:29 <REP> d-------- C:\Program Files\Windows Media Connect 2
2007-12-25 19:29 . 2006-10-04 15:06 1,197,294 --------- C:\WINNT\system32\dllcache\sysmain.sdb
2007-12-25 19:29 . 2006-10-04 15:06 764,868 --------- C:\WINNT\system32\dllcache\apph_sp.sdb
2007-12-25 19:29 . 2006-10-04 15:06 217,118 --------- C:\WINNT\system32\dllcache\apphelp.sdb
2007-12-25 15:53 . 2007-12-25 15:53 <REP> d-------- C:\WINNT\Cache
2007-12-25 15:52 . 2007-12-25 15:52 <REP> d-------- C:\Program Files\Samsung
2007-12-25 15:52 . 2007-12-25 15:52 <REP> d-------- C:\Program Files\Fichiers communs\ST System Shared
2007-12-25 15:52 . 2007-12-25 15:52 <REP> d-------- C:\Documents and Settings\jean-yves\Application Data\Samsung
2007-12-25 15:52 . 2004-08-04 00:57 1,712,128 --a------ C:\WINNT\system32\GdiPlus.dll
2007-12-25 15:52 . 2006-11-01 15:26 77,824 --a------ C:\WINNT\system32\xvid.ax
2007-12-25 15:52 . 2004-03-09 09:39 8,704 --a------ C:\WINNT\system32\vidccleaner.exe
2007-12-25 12:22 . 2007-12-25 20:48 <REP> d-------- C:\Program Files\Empire Interactive
2007-12-25 12:14 . 2007-12-25 12:14 <REP> d-------- C:\Program Files\Sega
2007-12-25 12:11 . 2001-12-12 17:34 65,536 --a------ C:\WINNT\wanmpsvc.exe
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\Program Files\Viewpoint
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\Program Files\Real
2007-12-25 12:10 . 2008-01-04 12:56 <REP> d-------- C:\Program Files\Fichiers communs\Real
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\My Music
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\Install AIM
2007-12-25 12:10 . 2007-12-25 12:10 <REP> d-------- C:\aolextras
2007-12-25 12:10 . 2007-12-25 12:11 35,890,848 --a------ C:\WINNT\aolback.exe
2007-12-25 12:10 . 2006-09-23 11:12 1,497,088 --a------ C:\WINNT\system32\shdocvw.bak
2007-12-25 12:10 . 2007-12-25 12:10 8,552 --a------ C:\WINNT\system32\drivers\asctrm.sys
2007-12-25 12:09 . 2007-12-25 12:10 <REP> d-------- C:\Program Files\Fichiers communs\aolshare
2007-12-25 12:09 . 2007-12-31 16:42 <REP> d-------- C:\Program Files\AOL 7.0
2007-12-25 12:09 . 2001-09-25 09:39 1,044,480 --a------ C:\WINNT\system32\roboex32.dll
2007-12-25 12:09 . 2001-09-25 09:39 153,088 --a------ C:\WINNT\system32\jgdwmie.dll
2007-12-25 12:09 . 2001-09-25 09:39 54,784 --a------ C:\WINNT\system32\Inetwh32.dll
2007-12-25 12:09 . 2001-09-25 09:38 29,184 --a------ C:\WINNT\system32\popup.ocx
2007-12-25 12:09 . 2001-09-27 10:58 28,396 --a------ C:\WINNT\system32\drivers\wanatw4.sys
2007-12-25 12:09 . 2001-11-26 23:41 24,641 --a------ C:\WINNT\system32\aolddial.dll
2007-12-25 12:07 . 2007-12-25 12:11 358 --ah----- C:\IPH.PH
2007-12-22 09:37 . 2007-12-22 10:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-22 09:10 . 2007-12-22 09:19 <REP> d-------- C:\Program Files\Panda Security
2007-12-20 21:40 . 2008-01-04 09:13 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-20 21:02 . 2007-12-20 21:02 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
2007-12-20 20:24 . 2005-09-23 08:29 626,688 --a------ C:\WINNT\system32\msvcr80.dll
2007-12-19 21:50 . 2007-12-19 21:50 300,544 --a------ C:\WINNT\system32\ajesin.exe
2007-12-19 14:15 . 2007-12-19 14:21 <REP> d-------- C:\de3f06edfd75e82d8e92e7d19188bc
2007-12-16 10:44 . 2007-12-16 10:44 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-16 10:43 . 2007-12-16 10:43 <REP> d-------- C:\Program Files\Windows Live
2007-12-16 10:43 . 2007-12-16 10:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 16:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-15 12:33 --------- d-----w C:\Program Files\microsoft money 2005
2008-01-15 12:29 964 ----a-w C:\Documents and Settings\brigitte\Application Data\wklnhst.dat
2008-01-15 12:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-15 12:02 5,554 ----a-w C:\Documents and Settings\jean-yves\Application Data\wklnhst.dat
2008-01-13 08:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-04 13:35 --------- d-----w C:\Program Files\Fichiers communs\MenacesProtection
2008-01-04 11:55 --------- d-----w C:\Program Files\Google
2007-12-25 14:51 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-12-20 20:39 --------- d-----w C:\Program Files\Spyware Terminator
2007-12-20 19:12 --------- d-----w C:\Documents and Settings\brigitte\Application Data\Spyware Terminator
2007-12-15 12:18 --------- d-----w C:\Program Files\Windows Live Safety Center
2007-12-14 21:41 --------- d-----w C:\Documents and Settings\camille\Application Data\Spyware Terminator
2007-12-06 19:54 19,456 ----a-w C:\WINNT\system32\drivers\indmmama.dat
2007-12-05 20:11 --------- d-----w C:\Documents and Settings\jean-yves\Application Data\MenacesProtection
2007-11-27 19:45 --------- d-----w C:\Program Files\Java
2007-11-27 16:18 --------- d-----w C:\Program Files\MSN Messenger
2007-11-24 12:06 --------- d-----w C:\Program Files\USBDisk
2007-11-16 21:53 --------- d-----w C:\Program Files\Shareaza
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD507CF6-72F8-4EA6-926F-4E52388E152B}]
2004-08-05 12:00 100096 --a------ C:\WINNT\system32\dmoc.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45 1052672]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2007-02-05 03:05 4354048]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-03 09:59 68856]
"ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-05 12:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-06-10 12:12 55296 C:\WINNT\SOUNDMAN.EXE]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 20:21 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-01-03 14:45 185632]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-10-11 00:49 124928 C:\WINNT\system32\advpack.dll]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)

R0 eqcfranp;eqcfranp;C:\WINNT\system32\drivers\indmmama.dat []
R2 UxTuneUp;Extension de conception TuneUp;C:\WINNT\System32\svchost.exe [2004-08-05 12:00]
R3 CAM1210;SM0121 USB 2.0 Video Camera;C:\WINNT\system32\Drivers\cam1210.sys [2006-07-24 16:49]
S3 usbscan;Pilote de scanneur USB;C:\WINNT\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINNT\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-01-11 18:25:53 C:\WINNT\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-01-11 15:35:01 C:\WINNT\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 21:33:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-16 21:35:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-16 20:35:51
.
2008-01-09 06:31:31 --- E O F ---

Eric_71
Profil : Helper
Plus d'informations
n°273627
16-01-2008 à 22:36:40

Tu as reposté le premier

jean-yves49
Profil : IDNaute
Plus d'informations
n°273646
16-01-2008 à 22:59:58

ComboFix 08-01-16.4 - jean-yves 2008-01-16 22:49:26.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.208 [GMT 1:00]
Running from: C:\Documents and Settings\jean-yves\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\jean-yves\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\WINNT\system32\ajesin.exe
C:\WINNT\system32\dmoc.dll
C:\WINNT\system32\drivers\indmmama.dat
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\BlueStreak.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts2Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPAudio.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetastreamID.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MTSDownloadSites.txt
C:\Program Files\Viewpoint\Viewpoint Experience Technology\NewClassID.ini
C:\WINNT\system32\ajesin.exe
C:\WINNT\system32\dmoc.dll
C:\WINNT\system32\drivers\indmmama.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_EQCFRANP
-------\eqcfranp


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-16 to 2008-01-16 ))))))))))))))))))))))))))))))))))))
.

2008-01-16 21:35 . <REP> C:\Documents and Settings\lÚa\Local Settings
2008-01-16 21:35 . <REP> C:\Documents and Settings\lÚa\Local Settings
2008-01-16 21:33 . 2008-01-16 21:33 <REP> d-------- C:\WINNT\system32\xircom
2008-01-16 21:33 . 2008-01-16 21:33 <REP> d-------- C:\Program Files\microsoft frontpage
2008-01-16 21:26 . 2000-08-31 08:00 51,200 --a------ C:\WINNT\NirCmd.exe
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-16 06:40 . 2007-09-22 14:06 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-16 06:40 . 2007-09-22 15:59 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-01-16 06:40 . 2007-09-22 15:59 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-01-16 06:40 . 2007-09-22 14:10 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-16 06:40 . 2007-09-22 14:11 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AVG7
2008-01-11 16:58 . 1996-08-20 20:37 15,840 --a------ C:\WINNT\system32\Machnm1.exe
2008-01-11 16:58 . 2005-09-25 16:37 5,632 --a------ C:\WINNT\system32\Machnm64.sys
2008-01-11 16:58 . 2008-01-11 16:58 3,120 --a------ C:\WINNT\system32\118290.54
2008-01-11 16:58 . 2008-01-11 16:58 3,120 --a------ C:\WINNT\118294.78
2008-01-11 16:58 . 2003-08-13 00:27 2,304 --a------ C:\WINNT\system32\Machnm32.sys
2008-01-08 20:05 . 2008-01-08 20:05 244 --ah----- C:\sqmnoopt06.sqm
2008-01-08 19:59 . 2008-01-08 19:59 <REP> d-------- C:\Documents and Settings\jean-yves\Application Data\Talkback
2008-01-