Vundo trojan horse a laide svp
Dernière réponse : dans Sécurité
Bonjour je recrée un sujets parce qe maintenant mon pc me signale que j'ai un trojan horse qui s'appelle vundo pliz je vous en suplie aidez moi j'ai fait un rapport hijackthis pliz aider a laide
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:31:02, on 05/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {24C61C09-62C0-42ED-B640-53F7FEC9098A} - C:\WINDOWS\system32\ursspnn.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9D80F578-5953-43FE-B8B1-F8BF357EBE19} - C:\WINDOWS\system32\jkhfg.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\msagent" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6844A98-C957-455C-9F9E-2659797131C5}: NameServer = 212.217.1.17 212.217.0.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: ursspnn - ursspnn.dll (file missing)
O20 - Winlogon Notify: winskt32 - winskt32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
--
End of file - 6906 bytes
voila mon rapport hijackthis a laide svp
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:31:02, on 05/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {24C61C09-62C0-42ED-B640-53F7FEC9098A} - C:\WINDOWS\system32\ursspnn.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9D80F578-5953-43FE-B8B1-F8BF357EBE19} - C:\WINDOWS\system32\jkhfg.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\msagent" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6844A98-C957-455C-9F9E-2659797131C5}: NameServer = 212.217.1.17 212.217.0.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: ursspnn - ursspnn.dll (file missing)
O20 - Winlogon Notify: winskt32 - winskt32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
--
End of file - 6906 bytes
voila mon rapport hijackthis a laide svp
Autres pages sur : vundo trojan horse laide svp
Lassé par la pub ? Créez un compte
Salut,
Télécharge Combofix (de sUBs) sur ton Bureau.
Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.
Le rapport se trouve ici : C:\Combofix.txt
Télécharge Combofix (de sUBs) sur ton Bureau.
Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.
Le rapport se trouve ici : C:\Combofix.txt
ComboFix 08-02.05.3 - 4ym4n-4ever 2008-02-05 18:51:58.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.54 [GMT 0:00]
Endroit: C:\Documents and Settings\4ym4n-4ever\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\ktd32.atm
C:\WINDOWS\pack.epk
c:\WINDOWS\system32\cmffyw.dat
c:\windows\system32\cmffyw.exe
c:\WINDOWS\system32\cmffyw_nav.dat
C:\WINDOWS\system32\cmffyw_navps.dat
C:\WINDOWS\system32\fbqgbyrs.dll
C:\WINDOWS\system32\gfhkj.ini
C:\WINDOWS\system32\gfhkj.ini2
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\usfscwop.dll
----- BITS: Possible sites infect‚s -----
hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))))))))))))
.
2008-02-05 18:30 . 2008-02-05 18:30 <REP> d-------- C:\Program Files\Trend Micro
2008-02-05 16:39 . 2008-02-05 16:39 <REP> d-------- C:\Program Files\Avira
2008-02-05 16:39 . 2008-02-05 16:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-02-05 15:28 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-05 14:55 . 2008-02-05 14:55 <REP> d-------- C:\Program Files\Fichiers communs\eSellerate
2008-02-05 14:55 . 2008-02-05 14:56 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-05 14:55 . 2003-04-18 16:46 1,233,920 --a------ C:\WINDOWS\system32\msxml4.dll
2008-02-05 14:55 . 2003-04-18 16:29 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-02-05 14:55 . 2003-04-18 16:29 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-02-05 14:43 . 2008-02-05 16:47 <REP> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-02-04 20:36 . 2008-02-04 20:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-04 20:36 . 2008-02-04 20:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-04 15:55 . 2008-02-04 15:55 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2008-02-04 15:55 . 2008-02-04 15:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-02-04 14:50 . 2008-02-04 14:50 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Apple Computer
2008-02-04 12:39 . 2008-02-04 12:44 <REP> d-------- C:\Program Files\QuickTime
2008-02-04 12:37 . 2008-02-04 12:37 <REP> d-------- C:\Program Files\Apple Software Update
2008-02-04 12:37 . 2008-02-04 12:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-02-03 22:22 . 2008-02-05 11:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-02-03 22:08 . 2008-02-05 11:52 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-02-01 22:11 . 2008-02-01 22:11 326,656 --a------ C:\WINDOWS\system32\jkhfg.VIR
2008-02-01 22:06 . 2008-02-01 22:06 36,864 --a------ C:\WINDOWS\system32\ursspnn.dll.VIR
2008-02-01 18:08 . 2008-02-01 18:12 <REP> d-------- C:\Program Files\Tweak-XP Pro 4
2008-02-01 18:08 . 2008-02-01 18:08 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-02-01 17:39 . 2008-02-01 17:39 <REP> d--h----- C:\WINDOWS\PIF
2008-01-30 23:54 . 2008-01-30 23:54 <REP> d-------- C:\Program Files\Magrathea
2008-01-30 22:48 . 2008-01-30 22:48 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Nvu
2008-01-30 16:41 . 2008-02-03 21:21 <REP> d-------- C:\Program Files\Notepad++
2008-01-28 22:54 . 2004-08-19 16:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-01-28 13:11 . 2008-01-28 13:11 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-01-27 19:26 . 2008-01-27 19:26 <REP> d-------- C:\Program Files\PC Camera
2008-01-27 19:26 . 2008-01-27 19:26 <REP> d-------- C:\Program Files\Fichiers communs\PCCamera
2008-01-27 16:32 . 2008-01-27 16:59 <REP> d-------- C:\Program Files\GIMPshop
2008-01-26 21:47 . 2008-01-26 21:55 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-01-25 19:43 . 2008-01-25 19:47 114 --a------ C:\WINDOWS\Graphex3.ini
2008-01-25 19:41 . 2008-01-25 19:41 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\WINDOWS
2008-01-25 19:41 . 1999-03-23 09:12 304,128 --a------ C:\WINDOWS\unin040c.exe
2008-01-25 19:07 . 2008-01-26 21:31 <REP> d-------- C:\Program Files\Frets on Fire
2008-01-25 17:30 . 2008-01-27 19:26 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-01-25 17:03 . 2008-02-04 16:02 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-01-17 21:11 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-01-17 21:06 . 2006-03-10 20:48 169,472 -r-hs---- C:\WINDOWS\system32\MatroskaDX.ax
2008-01-17 21:06 . 2006-05-03 09:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
2008-01-17 21:06 . 2005-11-25 19:46 161,792 -r-hs---- C:\WINDOWS\system32\RealMediaDX.ax
2008-01-17 21:06 . 2006-01-12 22:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
2008-01-17 21:06 . 2003-11-20 22:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2008-01-17 21:06 . 2004-04-26 22:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2008-01-17 21:06 . 2007-02-21 10:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
2008-01-17 21:05 . 2008-01-17 21:05 <REP> d-------- C:\Program Files\eRightSoft
2008-01-17 21:05 . 2006-09-12 10:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2008-01-17 21:05 . 2005-02-22 15:55 81,920 -r-hs---- C:\WINDOWS\system32\aac_parser.ax
2008-01-17 21:05 . 2007-07-03 05:59 9,292 ---h----- C:\WINDOWS\super.chm
2008-01-16 17:12 . 2008-01-16 17:16 <REP> d-------- C:\Program Files\Jasc Software Inc
2008-01-11 00:44 . 2008-01-11 00:44 <REP> d-------- C:\WINDOWS\Sun
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-05 22:32 . 2008-01-20 20:41 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\skypePM
2008-01-05 22:32 . 2008-01-05 22:32 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-05 22:24 . 2008-01-20 20:49 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Program Files\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-04 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-03 21:22 --------- d-----w C:\Program Files\VideoLAN
2008-02-03 21:21 --------- d-----w C:\Program Files\Opera
2008-02-01 21:47 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-01-27 10:42 --------- d-----w C:\Documents and Settings\4ym4n-4ever\Application Data\BearShare
2008-01-26 21:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-26 13:13 --------- d-----w C:\Program Files\CCleaner
2008-01-17 21:30 --------- d-----w C:\Program Files\Visicom Media
2008-01-09 12:40 87,485 ----a-w C:\WINDOWS\Fonts\kaiserzeit_gotisch.zip
2008-01-06 16:24 --------- d-----w C:\Program Files\Sony Ericsson
2008-01-04 20:38 --------- d-----w C:\Program Files\Java
2008-01-04 20:31 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-12-30 13:53 --------- d-----w C:\Program Files\Google
2007-12-17 08:38 --------- d-----w C:\Program Files\Fichiers communs\Vbox
2007-05-13 13:56 14,381 ----a-w C:\WINDOWS\Fonts\gallaecia.zip
2006-06-20 18:22 9,070,256 ----a-r C:\Program Files\coccipack.ccp
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9D80F578-5953-43FE-B8B1-F8BF357EBE19}]
C:\WINDOWS\system32\jkhfg.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-05 16:45 249896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 15:52 44544]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ursspnn]
ursspnn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winskt32]
winskt32.dll
S2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ALIEHCI.sys []
S3 K320bus;Sony Ericsson K320 driver (WDM);C:\WINDOWS\system32\DRIVERS\K320bus.sys [2006-08-18 09:10]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\K320mdfl.sys [2006-08-18 09:10]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\K320mdm.sys [2006-08-18 09:10]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\K320mgmt.sys [2006-08-18 09:10]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\K320obex.sys [2006-08-18 09:10]
S3 PAC207;SoC PC-Camera Beta3;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-04 12:37:45 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 18:58:37
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-05 19:00:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-05 19:00:40
.
2008-02-05 11:55:09 --- E O F ---
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.54 [GMT 0:00]
Endroit: C:\Documents and Settings\4ym4n-4ever\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\ktd32.atm
C:\WINDOWS\pack.epk
c:\WINDOWS\system32\cmffyw.dat
c:\windows\system32\cmffyw.exe
c:\WINDOWS\system32\cmffyw_nav.dat
C:\WINDOWS\system32\cmffyw_navps.dat
C:\WINDOWS\system32\fbqgbyrs.dll
C:\WINDOWS\system32\gfhkj.ini
C:\WINDOWS\system32\gfhkj.ini2
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\usfscwop.dll
----- BITS: Possible sites infect‚s -----
hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))))))))))))
.
2008-02-05 18:30 . 2008-02-05 18:30 <REP> d-------- C:\Program Files\Trend Micro
2008-02-05 16:39 . 2008-02-05 16:39 <REP> d-------- C:\Program Files\Avira
2008-02-05 16:39 . 2008-02-05 16:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-02-05 15:28 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-05 14:55 . 2008-02-05 14:55 <REP> d-------- C:\Program Files\Fichiers communs\eSellerate
2008-02-05 14:55 . 2008-02-05 14:56 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-05 14:55 . 2003-04-18 16:46 1,233,920 --a------ C:\WINDOWS\system32\msxml4.dll
2008-02-05 14:55 . 2003-04-18 16:29 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-02-05 14:55 . 2003-04-18 16:29 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-02-05 14:43 . 2008-02-05 16:47 <REP> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-02-04 20:36 . 2008-02-04 20:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-04 20:36 . 2008-02-04 20:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-04 15:55 . 2008-02-04 15:55 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2008-02-04 15:55 . 2008-02-04 15:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-02-04 14:50 . 2008-02-04 14:50 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Apple Computer
2008-02-04 12:39 . 2008-02-04 12:44 <REP> d-------- C:\Program Files\QuickTime
2008-02-04 12:37 . 2008-02-04 12:37 <REP> d-------- C:\Program Files\Apple Software Update
2008-02-04 12:37 . 2008-02-04 12:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-02-03 22:22 . 2008-02-05 11:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-02-03 22:08 . 2008-02-05 11:52 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-02-01 22:11 . 2008-02-01 22:11 326,656 --a------ C:\WINDOWS\system32\jkhfg.VIR
2008-02-01 22:06 . 2008-02-01 22:06 36,864 --a------ C:\WINDOWS\system32\ursspnn.dll.VIR
2008-02-01 18:08 . 2008-02-01 18:12 <REP> d-------- C:\Program Files\Tweak-XP Pro 4
2008-02-01 18:08 . 2008-02-01 18:08 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-02-01 17:39 . 2008-02-01 17:39 <REP> d--h----- C:\WINDOWS\PIF
2008-01-30 23:54 . 2008-01-30 23:54 <REP> d-------- C:\Program Files\Magrathea
2008-01-30 22:48 . 2008-01-30 22:48 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Nvu
2008-01-30 16:41 . 2008-02-03 21:21 <REP> d-------- C:\Program Files\Notepad++
2008-01-28 22:54 . 2004-08-19 16:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-01-28 13:11 . 2008-01-28 13:11 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-01-27 19:26 . 2008-01-27 19:26 <REP> d-------- C:\Program Files\PC Camera
2008-01-27 19:26 . 2008-01-27 19:26 <REP> d-------- C:\Program Files\Fichiers communs\PCCamera
2008-01-27 16:32 . 2008-01-27 16:59 <REP> d-------- C:\Program Files\GIMPshop
2008-01-26 21:47 . 2008-01-26 21:55 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-01-25 19:43 . 2008-01-25 19:47 114 --a------ C:\WINDOWS\Graphex3.ini
2008-01-25 19:41 . 2008-01-25 19:41 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\WINDOWS
2008-01-25 19:41 . 1999-03-23 09:12 304,128 --a------ C:\WINDOWS\unin040c.exe
2008-01-25 19:07 . 2008-01-26 21:31 <REP> d-------- C:\Program Files\Frets on Fire
2008-01-25 17:30 . 2008-01-27 19:26 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-01-25 17:03 . 2008-02-04 16:02 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-01-17 21:11 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-01-17 21:06 . 2006-03-10 20:48 169,472 -r-hs---- C:\WINDOWS\system32\MatroskaDX.ax
2008-01-17 21:06 . 2006-05-03 09:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
2008-01-17 21:06 . 2005-11-25 19:46 161,792 -r-hs---- C:\WINDOWS\system32\RealMediaDX.ax
2008-01-17 21:06 . 2006-01-12 22:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
2008-01-17 21:06 . 2003-11-20 22:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2008-01-17 21:06 . 2004-04-26 22:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2008-01-17 21:06 . 2007-02-21 10:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
2008-01-17 21:05 . 2008-01-17 21:05 <REP> d-------- C:\Program Files\eRightSoft
2008-01-17 21:05 . 2006-09-12 10:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2008-01-17 21:05 . 2005-02-22 15:55 81,920 -r-hs---- C:\WINDOWS\system32\aac_parser.ax
2008-01-17 21:05 . 2007-07-03 05:59 9,292 ---h----- C:\WINDOWS\super.chm
2008-01-16 17:12 . 2008-01-16 17:16 <REP> d-------- C:\Program Files\Jasc Software Inc
2008-01-11 00:44 . 2008-01-11 00:44 <REP> d-------- C:\WINDOWS\Sun
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-05 22:32 . 2008-01-20 20:41 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\skypePM
2008-01-05 22:32 . 2008-01-05 22:32 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-05 22:24 . 2008-01-20 20:49 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Program Files\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-04 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-03 21:22 --------- d-----w C:\Program Files\VideoLAN
2008-02-03 21:21 --------- d-----w C:\Program Files\Opera
2008-02-01 21:47 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-01-27 10:42 --------- d-----w C:\Documents and Settings\4ym4n-4ever\Application Data\BearShare
2008-01-26 21:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-26 13:13 --------- d-----w C:\Program Files\CCleaner
2008-01-17 21:30 --------- d-----w C:\Program Files\Visicom Media
2008-01-09 12:40 87,485 ----a-w C:\WINDOWS\Fonts\kaiserzeit_gotisch.zip
2008-01-06 16:24 --------- d-----w C:\Program Files\Sony Ericsson
2008-01-04 20:38 --------- d-----w C:\Program Files\Java
2008-01-04 20:31 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-12-30 13:53 --------- d-----w C:\Program Files\Google
2007-12-17 08:38 --------- d-----w C:\Program Files\Fichiers communs\Vbox
2007-05-13 13:56 14,381 ----a-w C:\WINDOWS\Fonts\gallaecia.zip
2006-06-20 18:22 9,070,256 ----a-r C:\Program Files\coccipack.ccp
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9D80F578-5953-43FE-B8B1-F8BF357EBE19}]
C:\WINDOWS\system32\jkhfg.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-05 16:45 249896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 15:52 44544]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ursspnn]
ursspnn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winskt32]
winskt32.dll
S2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ALIEHCI.sys []
S3 K320bus;Sony Ericsson K320 driver (WDM);C:\WINDOWS\system32\DRIVERS\K320bus.sys [2006-08-18 09:10]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\K320mdfl.sys [2006-08-18 09:10]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\K320mdm.sys [2006-08-18 09:10]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\K320mgmt.sys [2006-08-18 09:10]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\K320obex.sys [2006-08-18 09:10]
S3 PAC207;SoC PC-Camera Beta3;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-04 12:37:45 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 18:58:37
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-05 19:00:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-05 19:00:40
.
2008-02-05 11:55:09 --- E O F ---
Re,
Copie le texte se situant dans le cadre ci-dessous :
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
![]()
Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
Copie le texte se situant dans le cadre ci-dessous :
File::
C:\WINDOWS\unin040c.exe
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\jkhfg.VIR
C:\WINDOWS\system32\ursspnn.dll.VIR
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9D80F578-5953-43FE-B8B1-F8BF357EBE19}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ursspnn]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winskt32]
C:\WINDOWS\unin040c.exe
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\jkhfg.VIR
C:\WINDOWS\system32\ursspnn.dll.VIR
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9D80F578-5953-43FE-B8B1-F8BF357EBE19}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ursspnn]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winskt32]
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
dsl de m'etre retardé pour la réponse mai ma conexion beuguait voila le raport comboFix
ComboFix 08-02.05.3 - 4ym4n-4ever 2008-02-05 19:52:14.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.59 [GMT 0:00]
Endroit: C:\Documents and Settings\4ym4n-4ever\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\4ym4n-4ever\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
FILE
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\jkhfg.VIR
C:\WINDOWS\system32\ursspnn.dll.VIR
C:\WINDOWS\unin040c.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\jkhfg.VIR
C:\WINDOWS\system32\ursspnn.dll.VIR
C:\WINDOWS\unin040c.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))))))))))))
.
2008-02-05 18:30 . 2008-02-05 18:30 <REP> d-------- C:\Program Files\Trend Micro
2008-02-05 16:39 . 2008-02-05 16:39 <REP> d-------- C:\Program Files\Avira
2008-02-05 16:39 . 2008-02-05 16:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-02-05 15:28 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-05 14:55 . 2008-02-05 14:55 <REP> d-------- C:\Program Files\Fichiers communs\eSellerate
2008-02-05 14:55 . 2008-02-05 14:56 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-05 14:55 . 2003-04-18 16:46 1,233,920 --a------ C:\WINDOWS\system32\msxml4.dll
2008-02-05 14:55 . 2003-04-18 16:29 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-02-05 14:55 . 2003-04-18 16:29 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-02-05 14:43 . 2008-02-05 16:47 <REP> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-02-04 20:36 . 2008-02-04 20:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-04 20:36 . 2008-02-04 20:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-04 15:55 . 2008-02-04 15:55 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2008-02-04 15:55 . 2008-02-04 15:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-02-04 14:50 . 2008-02-04 14:50 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Apple Computer
2008-02-04 12:39 . 2008-02-04 12:44 <REP> d-------- C:\Program Files\QuickTime
2008-02-04 12:37 . 2008-02-04 12:37 <REP> d-------- C:\Program Files\Apple Software Update
2008-02-04 12:37 . 2008-02-04 12:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-02-03 22:22 . 2008-02-05 11:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-02-03 22:08 . 2008-02-05 11:52 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-02-01 18:08 . 2008-02-01 18:12 <REP> d-------- C:\Program Files\Tweak-XP Pro 4
2008-02-01 17:39 . 2008-02-01 17:39 <REP> d--h----- C:\WINDOWS\PIF
2008-01-30 23:54 . 2008-01-30 23:54 <REP> d-------- C:\Program Files\Magrathea
2008-01-30 22:48 . 2008-01-30 22:48 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Nvu
2008-01-30 16:41 . 2008-02-03 21:21 <REP> d-------- C:\Program Files\Notepad++
2008-01-28 22:54 . 2004-08-19 16:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-01-28 13:11 . 2008-01-28 13:11 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-01-27 19:26 . 2008-01-27 19:26 <REP> d-------- C:\Program Files\PC Camera
2008-01-27 19:26 . 2008-01-27 19:26 <REP> d-------- C:\Program Files\Fichiers communs\PCCamera
2008-01-27 16:32 . 2008-01-27 16:59 <REP> d-------- C:\Program Files\GIMPshop
2008-01-26 21:47 . 2008-01-26 21:55 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-01-25 19:43 . 2008-01-25 19:47 114 --a------ C:\WINDOWS\Graphex3.ini
2008-01-25 19:41 . 2008-01-25 19:41 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\WINDOWS
2008-01-25 19:07 . 2008-01-26 21:31 <REP> d-------- C:\Program Files\Frets on Fire
2008-01-25 17:30 . 2008-01-27 19:26 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-01-25 17:03 . 2008-02-04 16:02 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-01-17 21:11 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-01-17 21:06 . 2006-03-10 20:48 169,472 -r-hs---- C:\WINDOWS\system32\MatroskaDX.ax
2008-01-17 21:06 . 2006-05-03 09:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
2008-01-17 21:06 . 2005-11-25 19:46 161,792 -r-hs---- C:\WINDOWS\system32\RealMediaDX.ax
2008-01-17 21:06 . 2006-01-12 22:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
2008-01-17 21:06 . 2003-11-20 22:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2008-01-17 21:06 . 2004-04-26 22:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2008-01-17 21:06 . 2007-02-21 10:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
2008-01-17 21:05 . 2008-01-17 21:05 <REP> d-------- C:\Program Files\eRightSoft
2008-01-17 21:05 . 2006-09-12 10:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2008-01-17 21:05 . 2005-02-22 15:55 81,920 -r-hs---- C:\WINDOWS\system32\aac_parser.ax
2008-01-17 21:05 . 2007-07-03 05:59 9,292 ---h----- C:\WINDOWS\super.chm
2008-01-16 17:12 . 2008-01-16 17:16 <REP> d-------- C:\Program Files\Jasc Software Inc
2008-01-11 00:44 . 2008-01-11 00:44 <REP> d-------- C:\WINDOWS\Sun
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-05 22:32 . 2008-01-20 20:41 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\skypePM
2008-01-05 22:32 . 2008-01-05 22:32 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-05 22:24 . 2008-01-20 20:49 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Program Files\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-04 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-03 21:22 --------- d-----w C:\Program Files\VideoLAN
2008-02-03 21:21 --------- d-----w C:\Program Files\Opera
2008-02-01 21:47 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-01-27 10:42 --------- d-----w C:\Documents and Settings\4ym4n-4ever\Application Data\BearShare
2008-01-26 21:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-26 13:13 --------- d-----w C:\Program Files\CCleaner
2008-01-17 21:30 --------- d-----w C:\Program Files\Visicom Media
2008-01-09 12:40 87,485 ----a-w C:\WINDOWS\Fonts\kaiserzeit_gotisch.zip
2008-01-06 16:24 --------- d-----w C:\Program Files\Sony Ericsson
2008-01-04 20:38 --------- d-----w C:\Program Files\Java
2008-01-04 20:31 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-12-30 13:53 --------- d-----w C:\Program Files\Google
2007-12-17 08:38 --------- d-----w C:\Program Files\Fichiers communs\Vbox
2007-11-07 13:21 13,312 ----a-w C:\WINDOWS\system32\svrapi.dll
2007-11-07 09:50 733,696 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-05-13 13:56 14,381 ----a-w C:\WINDOWS\Fonts\gallaecia.zip
2006-06-20 18:22 9,070,256 ----a-r C:\Program Files\coccipack.ccp
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-05 16:45 249896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 15:52 44544]
S2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ALIEHCI.sys []
S3 K320bus;Sony Ericsson K320 driver (WDM);C:\WINDOWS\system32\DRIVERS\K320bus.sys [2006-08-18 09:10]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\K320mdfl.sys [2006-08-18 09:10]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\K320mdm.sys [2006-08-18 09:10]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\K320mgmt.sys [2006-08-18 09:10]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\K320obex.sys [2006-08-18 09:10]
S3 PAC207;SoC PC-Camera Beta3;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-04 12:37:45 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 19:54:58
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:24, on 05/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\msagent" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6844A98-C957-455C-9F9E-2659797131C5}: NameServer = 212.217.1.17 212.217.0.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
--
End of file - 6138 bytes
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-02-05 19:56:01
ComboFix-quarantined-files.txt 2008-02-05 19:55:51
ComboFix2.txt 2008-02-05 19:00:45
.
2008-02-05 11:55:09 --- E O F ---
ComboFix 08-02.05.3 - 4ym4n-4ever 2008-02-05 19:52:14.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.59 [GMT 0:00]
Endroit: C:\Documents and Settings\4ym4n-4ever\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\4ym4n-4ever\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
FILE
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\jkhfg.VIR
C:\WINDOWS\system32\ursspnn.dll.VIR
C:\WINDOWS\unin040c.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\jkhfg.VIR
C:\WINDOWS\system32\ursspnn.dll.VIR
C:\WINDOWS\unin040c.exe
.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))))))))))))
.
2008-02-05 18:30 . 2008-02-05 18:30 <REP> d-------- C:\Program Files\Trend Micro
2008-02-05 16:39 . 2008-02-05 16:39 <REP> d-------- C:\Program Files\Avira
2008-02-05 16:39 . 2008-02-05 16:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-02-05 15:28 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-05 14:55 . 2008-02-05 14:55 <REP> d-------- C:\Program Files\Fichiers communs\eSellerate
2008-02-05 14:55 . 2008-02-05 14:56 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-05 14:55 . 2003-04-18 16:46 1,233,920 --a------ C:\WINDOWS\system32\msxml4.dll
2008-02-05 14:55 . 2003-04-18 16:29 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-02-05 14:55 . 2003-04-18 16:29 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-02-05 14:43 . 2008-02-05 16:47 <REP> d-------- C:\Program Files\Mozilla Firefox 3 Beta 2
2008-02-04 20:36 . 2008-02-04 20:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-04 20:36 . 2008-02-04 20:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-04 15:55 . 2008-02-04 15:55 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2008-02-04 15:55 . 2008-02-04 15:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-02-04 14:50 . 2008-02-04 14:50 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Apple Computer
2008-02-04 12:39 . 2008-02-04 12:44 <REP> d-------- C:\Program Files\QuickTime
2008-02-04 12:37 . 2008-02-04 12:37 <REP> d-------- C:\Program Files\Apple Software Update
2008-02-04 12:37 . 2008-02-04 12:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-02-03 22:22 . 2008-02-05 11:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-02-03 22:08 . 2008-02-05 11:52 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-02-01 18:08 . 2008-02-01 18:12 <REP> d-------- C:\Program Files\Tweak-XP Pro 4
2008-02-01 17:39 . 2008-02-01 17:39 <REP> d--h----- C:\WINDOWS\PIF
2008-01-30 23:54 . 2008-01-30 23:54 <REP> d-------- C:\Program Files\Magrathea
2008-01-30 22:48 . 2008-01-30 22:48 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Nvu
2008-01-30 16:41 . 2008-02-03 21:21 <REP> d-------- C:\Program Files\Notepad++
2008-01-28 22:54 . 2004-08-19 16:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-01-28 13:11 . 2008-01-28 13:11 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-01-27 19:26 . 2008-01-27 19:26 <REP> d-------- C:\Program Files\PC Camera
2008-01-27 19:26 . 2008-01-27 19:26 <REP> d-------- C:\Program Files\Fichiers communs\PCCamera
2008-01-27 16:32 . 2008-01-27 16:59 <REP> d-------- C:\Program Files\GIMPshop
2008-01-26 21:47 . 2008-01-26 21:55 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-01-25 19:43 . 2008-01-25 19:47 114 --a------ C:\WINDOWS\Graphex3.ini
2008-01-25 19:41 . 2008-01-25 19:41 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\WINDOWS
2008-01-25 19:07 . 2008-01-26 21:31 <REP> d-------- C:\Program Files\Frets on Fire
2008-01-25 17:30 . 2008-01-27 19:26 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-01-25 17:03 . 2008-02-04 16:02 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-01-17 21:11 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-01-17 21:06 . 2006-03-10 20:48 169,472 -r-hs---- C:\WINDOWS\system32\MatroskaDX.ax
2008-01-17 21:06 . 2006-05-03 09:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
2008-01-17 21:06 . 2005-11-25 19:46 161,792 -r-hs---- C:\WINDOWS\system32\RealMediaDX.ax
2008-01-17 21:06 . 2006-01-12 22:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
2008-01-17 21:06 . 2003-11-20 22:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2008-01-17 21:06 . 2004-04-26 22:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2008-01-17 21:06 . 2007-02-21 10:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
2008-01-17 21:05 . 2008-01-17 21:05 <REP> d-------- C:\Program Files\eRightSoft
2008-01-17 21:05 . 2006-09-12 10:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2008-01-17 21:05 . 2005-02-22 15:55 81,920 -r-hs---- C:\WINDOWS\system32\aac_parser.ax
2008-01-17 21:05 . 2007-07-03 05:59 9,292 ---h----- C:\WINDOWS\super.chm
2008-01-16 17:12 . 2008-01-16 17:16 <REP> d-------- C:\Program Files\Jasc Software Inc
2008-01-11 00:44 . 2008-01-11 00:44 <REP> d-------- C:\WINDOWS\Sun
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-05 22:32 . 2008-01-20 20:41 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\skypePM
2008-01-05 22:32 . 2008-01-05 22:32 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-05 22:24 . 2008-01-20 20:49 <REP> d-------- C:\Documents and Settings\4ym4n-4ever\Application Data\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Program Files\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2008-01-05 22:23 . 2008-01-05 22:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-04 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-03 21:22 --------- d-----w C:\Program Files\VideoLAN
2008-02-03 21:21 --------- d-----w C:\Program Files\Opera
2008-02-01 21:47 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-01-27 10:42 --------- d-----w C:\Documents and Settings\4ym4n-4ever\Application Data\BearShare
2008-01-26 21:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-26 13:13 --------- d-----w C:\Program Files\CCleaner
2008-01-17 21:30 --------- d-----w C:\Program Files\Visicom Media
2008-01-09 12:40 87,485 ----a-w C:\WINDOWS\Fonts\kaiserzeit_gotisch.zip
2008-01-06 16:24 --------- d-----w C:\Program Files\Sony Ericsson
2008-01-04 20:38 --------- d-----w C:\Program Files\Java
2008-01-04 20:31 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-12-30 13:53 --------- d-----w C:\Program Files\Google
2007-12-17 08:38 --------- d-----w C:\Program Files\Fichiers communs\Vbox
2007-11-07 13:21 13,312 ----a-w C:\WINDOWS\system32\svrapi.dll
2007-11-07 09:50 733,696 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-05-13 13:56 14,381 ----a-w C:\WINDOWS\Fonts\gallaecia.zip
2006-06-20 18:22 9,070,256 ----a-r C:\Program Files\coccipack.ccp
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-05 16:45 249896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 15:52 44544]
S2 ALIEHCD;ULi PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ALIEHCI.sys []
S3 K320bus;Sony Ericsson K320 driver (WDM);C:\WINDOWS\system32\DRIVERS\K320bus.sys [2006-08-18 09:10]
S3 K320mdfl;Sony Ericsson K320 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\K320mdfl.sys [2006-08-18 09:10]
S3 K320mdm;Sony Ericsson K320 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\K320mdm.sys [2006-08-18 09:10]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\K320mgmt.sys [2006-08-18 09:10]
S3 K320obex;Sony Ericsson K320 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\K320obex.sys [2006-08-18 09:10]
S3 PAC207;SoC PC-Camera Beta3;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-04 12:37:45 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 19:54:58
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:24, on 05/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\msagent" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6844A98-C957-455C-9F9E-2659797131C5}: NameServer = 212.217.1.17 212.217.0.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
--
End of file - 6138 bytes
Les fichiers cachés: 0
**************************************************************************
.
Temps d'accomplissement: 2008-02-05 19:56:01
ComboFix-quarantined-files.txt 2008-02-05 19:55:51
ComboFix2.txt 2008-02-05 19:00:45
.
2008-02-05 11:55:09 --- E O F ---
Y a pas de soucis ![:)]( ":)")
Télécharge sur ton bureau : Clean (de Malekal) >Tuto<
Dézippe le sur ton bureau. Double-clic sur ce dossier clean.
Double-clic sur clean.cmd. (L’extension cmd peut ne pas apparaître) Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé et poste le rapport ici.
Le rapport se trouve ici : C:\rapport_clean.txt
Si tu obtiens un fichier C:\upload_moi.zip, merci de faire ceci.
Télécharge sur ton bureau : Clean (de Malekal) >Tuto<
Dézippe le sur ton bureau. Double-clic sur ce dossier clean.
Double-clic sur clean.cmd. (L’extension cmd peut ne pas apparaître) Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé et poste le rapport ici.
Le rapport se trouve ici : C:\rapport_clean.txt
Si tu obtiens un fichier C:\upload_moi.zip, merci de faire ceci.
euh quand j'ouvre clean bhe il me disent la recherche debute merci de patienter puis apres un petit moment la fenetre se ferme voila le rapport pour dire la recherche ne dire pas + d'une minute !
05/02/2008 a 20:21:13,29
*** Recherche des fichiers dans C:
C:\kmd.exe FOUND
*** Recherche des fichiers dans C:\WINDOWS\
C:\WINDOWS\UnGins.exe FOUND
*** Recherche des fichiers dans C:\WINDOWS\system32
05/02/2008 a 20:21:13,29
*** Recherche des fichiers dans C:
C:\kmd.exe FOUND
*** Recherche des fichiers dans C:\WINDOWS\
C:\WINDOWS\UnGins.exe FOUND
*** Recherche des fichiers dans C:\WINDOWS\system32
Re,
Télécharge AVG Anti-Spyware Installes-le.
Si le lien ne fonctionne pas : >Clique ici<
Lance AVG et fais une mise à jour.
Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglet comment réagir, clique sur Actions recommandées. Choisis Quarantaine.
Ne fais pas d’analyse pour le moment.
Redémarre en mode sans échec
/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\
Relance Avg.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas.
Clique sur "Enregistrer le rapport". Ceci génère un rapport qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.
Poste le ici.
&
Toujours en mode sans échec, relance clean et fais l'option 2, poste le rapport.
Télécharge AVG Anti-Spyware Installes-le.
Si le lien ne fonctionne pas : >Clique ici<
Lance AVG et fais une mise à jour.
Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglet comment réagir, clique sur Actions recommandées. Choisis Quarantaine.
Ne fais pas d’analyse pour le moment.
Redémarre en mode sans échec
/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\
Relance Avg.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas.
Clique sur "Enregistrer le rapport". Ceci génère un rapport qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.
Poste le ici.
&
Toujours en mode sans échec, relance clean et fais l'option 2, poste le rapport.
Clean toujours la meme chose
06/02/2008 a 13:55:07,59
*** Recherche des fichiers dans C:
C:\kmd.exe FOUND
*** Recherche des fichiers dans C:\WINDOWS\
C:\WINDOWS\UnGins.exe FOUND
*** Recherche des fichiers dans C:\WINDOWS\system32
et voila avg sinon j'ai plus de pop-ups imperspectives qui s'ouvrent et antivir ne me siganle plus le tronjan!
+ Créé à: 13:53:56 06/02/2008
+ Résultat de l'analyse:
C:\System Volume Information\_restore{D352F06B-E479-4589-A34F-40BE9B153E49}\RP165\A0216923.exe -> Backdoor.Agent.duj : Nettoyé.
:mozilla.54:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.25:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.26:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.27:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.28:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.29:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.30:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.81:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.41:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.82:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adviva : Nettoyé.
:mozilla.21:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.24:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.43:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Burstnet : Nettoyé.
:mozilla.23:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.48:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.49:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.42:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.45:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.46:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.47:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.18:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.19:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.20:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.22:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.44:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyé.
:mozilla.61:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.51:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Nettoyé.
:mozilla.38:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.39:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.40:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.62:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.64:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
Fin du rapport
06/02/2008 a 13:55:07,59
*** Recherche des fichiers dans C:
C:\kmd.exe FOUND
*** Recherche des fichiers dans C:\WINDOWS\
C:\WINDOWS\UnGins.exe FOUND
*** Recherche des fichiers dans C:\WINDOWS\system32
et voila avg sinon j'ai plus de pop-ups imperspectives qui s'ouvrent et antivir ne me siganle plus le tronjan!
+ Créé à: 13:53:56 06/02/2008
+ Résultat de l'analyse:
C:\System Volume Information\_restore{D352F06B-E479-4589-A34F-40BE9B153E49}\RP165\A0216923.exe -> Backdoor.Agent.duj : Nettoyé.
:mozilla.54:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.25:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.26:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.27:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.28:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.29:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.30:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.81:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.41:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.82:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Adviva : Nettoyé.
:mozilla.21:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.24:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.43:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Burstnet : Nettoyé.
:mozilla.23:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.48:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.49:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.42:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.45:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.46:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.47:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.18:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.19:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.20:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.22:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.44:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyé.
:mozilla.61:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.51:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\4ym4n-4ever\Cookies\4ym4n-4ever@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Nettoyé.
:mozilla.38:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.39:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.40:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.62:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.64:C:\Documents and Settings\4ym4n-4ever\Application Data\Mozilla\Firefox\Profiles\ukmdstku.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
Fin du rapport
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 06/02/2008 a 17:42:53,81
Microsoft Windows XP [version 5.1.2600]
*** Suppression des fichiers dans C:
tentative de suppression de C:\kmd.exe
*** Suppression des fichiers dans C:\WINDOWS\
tentative de suppression de C:\WINDOWS\UnGins.exe
*** Suppression des fichiers dans C:\WINDOWS\system32
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 06/02/2008 a 17:42:53,81
Microsoft Windows XP [version 5.1.2600]
*** Suppression des fichiers dans C:
tentative de suppression de C:\kmd.exe
*** Suppression des fichiers dans C:\WINDOWS\
tentative de suppression de C:\WINDOWS\UnGins.exe
*** Suppression des fichiers dans C:\WINDOWS\system32
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:01:12, on 06/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\msagent" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6844A98-C957-455C-9F9E-2659797131C5}: NameServer = 212.217.1.17 212.217.0.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
--
End of file - 6386 bytes
Scan saved at 20:01:12, on 06/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\msagent" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6844A98-C957-455C-9F9E-2659797131C5}: NameServer = 212.217.1.17 212.217.0.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
--
End of file - 6386 bytes
Bien, toujours des problèmes ?
Relance HiJackThis, do a system scan only, coche ces lignes :
Puis Fix Checked !
Désinstalle, supprime tous les logiciels utilisés pour la désinfection ainsi que les dossiers créés correspondants.. Garde ccleaner, avg et antivir si nous les avons installé..
Rapporte ton infection sur Malware Complaints >Tuto<
Ton(tes) infection(s) : Vundo
Puis regarde ce dossier :
Sécurité/Prévention
Relance HiJackThis, do a system scan only, coche ces lignes :
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
Puis Fix Checked !
Désinstalle, supprime tous les logiciels utilisés pour la désinfection ainsi que les dossiers créés correspondants.. Garde ccleaner, avg et antivir si nous les avons installé..
Rapporte ton infection sur Malware Complaints >Tuto<
Ton(tes) infection(s) : Vundo
Puis regarde ce dossier :
Sécurité/Prévention
Lassé par la pub ? Créez un compte
- Contenus similaires :
- ForumSe debarrasser de trojan horse
- ForumTrojan trojan horse proxy.nlw
- ForumProbleme de trojan trojan horse proxy .
- ForumTrojan vundo trojan metajuan downloader
- ForumTrojan trojan horse irc backdoor.sdbot3.xvg
- ForumTrojan horse backdoor.generic4.tbi
- ForumTrojan horse backdoor.generic9.syc
- ForumTrojan horse backdoor
- ForumTrojan horse navipromo.af trojan horse navip
- ForumInfection trojan horse navipromo
- Voir plus
