[résolu]Virus bloquant logiciels antivirus, fichiers cachés invisibles
Forum Sécurité - Virus : [résolu]Virus bloquant logiciels antivirus, fichiers cachés invisibles
Bonjour a tout les Tom's
Je suis ici de nouveau pour une mauvaise nouvelle... je viens de me rechoper un virus 
Voici les principaux symptomes (découverts) :
- Plus de wifi (changement de la base de registre pour le réactiver (2 à la place de 4) mais se redésactive a chaque redémarrage).
Et également plus d'internet.
- Outils/Option de dossiers/Affichage/afficher les fichier cachés DISPARUS (j'ai fait réapparaitre l'option en éditant la base de registre, mais les fichiers et dossiers sont toujours invisible...)
- Norton Antivirus et Ad Aware inutilisable (nmain.exe invalide)
- Impossible de faire un Hijackthis (n'est pas une application Win32 valide)
J'ai déjà eu un virus de la sorte avant, mais en pire (c'était Bagle : http://www.infos-du-net.com/forum/ [...] et-lecteur. Je remercie encore XmichouX 
)
J'ai donc refait un Elibagla mais il ne me trouve rien.
De plus, je peux acceder au mode sans échec et a mes clés usb comparé a avant.
Je vous redemande encore un peu de votre temps pour esasyer de m'aider.
Merci d'avance.. @+
Message édité par romainrou le 24-04-2008 à 01:16:06
Up s'il vous plaît j'ai vraiment besoin d'aide... 
bonsoir
Télécharge ComboFix de sUBs :
ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
mais attention... vu tes soucis avec hijackthis,
renomme Combofix en Combo-Fix avant de lancer le téléchargement comme suit:
http://forum.pcastuces.com/sujet.asp?f=25&s=37315
Double-clic sur ComboFix, Il va te poser une question, réponds en appuyant sur la touche1 puis attends que combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé.Poste le rapport
\Combofix.txt
clique dessus pour l'ouvrir, puis édition "sélectionner tout", édition "copier"
viens sur le forum et édition "coller"
/!\Marre de la pub: Firefox sécurisé/!\
Répondre à Sham_Rock
Salut, voici le rapport de SystemScan :
SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)
Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\xxx\Bureau\sys19052.exe
Running in: User mode
Date: 19/04/2008
Time: 01:36:19
Output limited to:
-Recent files
-Hidden objects
-Include HIJACKTHIS.log
===================== RECENT FILES =====================
Showing files newer than 30 days
----- recent files in C:\
30/03/2008 03:19:07 216 byte 20 days old -- boot.ini
10/04/2008 03:07:34 (DIR) 0 byte 9 days old -- Config.Msi
17/04/2008 18:11:10 (DIR) 0 byte 2 days old -- QooBox
17/04/2008 18:11:10 16525 byte 2 days old -- ComboFix.txt
17/04/2008 18:11:11 (DIR) 0 byte 2 days old -- WINDOWS
19/04/2008 01:15:36 704643072 byte 0 days old -- pagefile.sys
19/04/2008 01:33:40 (DIR) 0 byte 0 days old -- Program Files
----- recent files in C:\WINDOWS\
21/03/2008 02:08:16 (DIR) 0 byte 29 days old -- Downloaded Program Files
21/03/2008 02:17:06 (DIR) 0 byte 29 days old -- Help
21/03/2008 02:17:42 (DIR) 0 byte 29 days old -- $NtUninstallKB909394$
21/03/2008 03:22:11 (DIR) 0 byte 29 days old -- SHELLNEW
27/03/2008 22:21:52 (DIR) 0 byte 23 days old -- Fonts
29/03/2008 16:18:36 (DIR) 0 byte 21 days old -- assembly
10/04/2008 03:01:19 (DIR) 0 byte 9 days old -- $NtUninstallKB945553$
10/04/2008 03:03:08 (DIR) 0 byte 9 days old -- $NtUninstallKB948590$
10/04/2008 03:03:46 (DIR) 0 byte 9 days old -- $NtUninstallKB941693$
10/04/2008 03:07:06 (DIR) 0 byte 9 days old -- $hf_mig$
10/04/2008 03:07:06 (DIR) 0 byte 9 days old -- $NtUninstallKB948881$
10/04/2008 03:07:33 (DIR) 0 byte 9 days old -- Installer
11/04/2008 22:14:11 (DIR) 0 byte 8 days old -- inf
12/04/2008 11:47:34 (DIR) 0 byte 7 days old -- Minidump
12/04/2008 11:47:35 (DIR) 0 byte 7 days old -- Debug
12/04/2008 11:54:37 63680 byte 7 days old -- ntbtlog.txt
17/04/2008 13:40:53 5868 byte 2 days old -- setupapi.log
17/04/2008 18:06:11 9415 byte 2 days old -- system.ini
19/04/2008 01:14:43 32462 byte 0 days old -- SchedLgU.Txt
19/04/2008 01:15:42 2048 byte 0 days old -- bootstat.dat
19/04/2008 01:15:50 159 byte 0 days old -- wiadebug.log
19/04/2008 01:15:51 257 byte 0 days old -- win.ini
19/04/2008 01:15:52 50 byte 0 days old -- wiaservc.log
19/04/2008 01:16:57 0 byte 0 days old -- 0.log
19/04/2008 01:17:18 43704 byte 0 days old -- WindowsUpdate.log
19/04/2008 01:33:45 (DIR) 0 byte 0 days old -- TEMP
19/04/2008 01:33:51 54156 byte 0 days old -- QTFont.qfn
19/04/2008 01:34:55 (DIR) 0 byte 0 days old -- system32
19/04/2008 01:35:37 (DIR) 0 byte 0 days old -- Prefetch
----- recent files in C:\WINDOWS\Downloaded Program Files\
----- recent files in C:\WINDOWS\system\
----- recent files in C:\WINDOWS\system32\
21/03/2008 02:31:10 (DIR) 0 byte 29 days old -- wbem
21/03/2008 05:48:21 (DIR) 0 byte 29 days old -- Macromed
28/03/2008 23:37:26 90112 byte 22 days old -- QuickTimeVR.qtx
28/03/2008 23:37:26 57344 byte 22 days old -- QuickTime.qts
06/04/2008 07:56:20 19836024 byte 13 days old -- MRT.exe
10/04/2008 03:03:48 (DIR) 0 byte 9 days old -- dllcache
10/04/2008 03:14:36 1732576 byte 9 days old -- FNTCACHE.DAT
17/04/2008 18:09:44 (DIR) 0 byte 2 days old -- CatRoot2
17/04/2008 18:11:11 (DIR) 0 byte 2 days old -- drivers
17/04/2008 21:12:46 4184 byte 2 days old -- KGyGaAvL.sys
19/04/2008 01:15:46 13646 byte 0 days old -- wpa.dbl
19/04/2008 01:34:55 139464 byte 0 days old -- PerfStringBackup.INI
19/04/2008 01:34:55 159468 byte 0 days old -- perfc00C.dat
19/04/2008 01:34:55 129236 byte 0 days old -- perfc009.dat
19/04/2008 01:34:55 646486 byte 0 days old -- perfh00C.dat
19/04/2008 01:34:55 535980 byte 0 days old -- perfh009.dat
----- recent files in C:\WINDOWS\system32\drivers\
17/04/2008 18:06:04 (DIR) 0 byte 2 days old -- etc
17/04/2008 18:06:15 (DIR) 0 byte 2 days old -- downld
----- recent files in C:\WINDOWS\temp\
----- recent files in C:\Program Files\
21/03/2008 01:56:33 (DIR) 0 byte 29 days old -- InstallShield Installation Information
21/03/2008 03:27:09 (DIR) 0 byte 29 days old -- Microsoft Visual Studio
21/03/2008 03:27:57 (DIR) 0 byte 29 days old -- Microsoft Works
21/03/2008 05:59:31 (DIR) 0 byte 29 days old -- Microsoft Office
22/03/2008 11:09:56 (DIR) 0 byte 28 days old -- Ateksoft
22/03/2008 13:19:19 (DIR) 0 byte 28 days old -- My Mobile
22/03/2008 19:51:22 147 byte 28 days old -- pid.txt
22/03/2008 19:51:22 (DIR) 0 byte 28 days old -- hearts
22/03/2008 19:51:31 2117 byte 28 days old -- DeIsL1.isu
29/03/2008 16:17:59 (DIR) 0 byte 21 days old -- Microsoft.NET
29/03/2008 16:54:09 (DIR) 0 byte 21 days old -- Messenger Plus! Live
29/03/2008 23:43:50 (DIR) 0 byte 21 days old -- Microsoft ActiveSync
04/04/2008 02:07:29 (DIR) 0 byte 15 days old -- Norton Internet Security
05/04/2008 18:01:53 (DIR) 0 byte 14 days old -- QuickTime
05/04/2008 18:03:37 (DIR) 0 byte 14 days old -- iPod
05/04/2008 18:03:55 (DIR) 0 byte 14 days old -- iTunes
10/04/2008 03:03:35 (DIR) 0 byte 9 days old -- Internet Explorer
10/04/2008 22:52:29 (DIR) 0 byte 9 days old -- Soulseek
11/04/2008 21:57:13 (DIR) 0 byte 8 days old -- eMule
11/04/2008 22:00:52 (DIR) 0 byte 8 days old -- LClock
12/04/2008 11:47:10 (DIR) 0 byte 7 days old -- CCleaner
19/04/2008 01:33:40 (DIR) 0 byte 0 days old -- Fichiers communs
19/04/2008 01:34:14 (DIR) 0 byte 0 days old -- Mozilla Firefox
----- recent files in C:\Program Files\Fichiers communs\
21/03/2008 01:56:26 (DIR) 0 byte 29 days old -- InstallShield
21/03/2008 03:27:09 (DIR) 0 byte 29 days old -- Designer
21/03/2008 03:28:32 (DIR) 0 byte 29 days old -- Microsoft Shared
21/03/2008 05:59:31 (DIR) 0 byte 29 days old -- System
11/04/2008 19:30:15 (DIR) 0 byte 8 days old -- Symantec Shared
----- recent files in C:\Documents and Settings\ROUQUETTE\Application Data\
21/03/2008 02:19:05 2528 byte 29 days old -- $_hpcst$.hpc
21/03/2008 02:31:10 (DIR) 0 byte 29 days old -- Microsoft
21/03/2008 04:57:55 (DIR) 0 byte 29 days old -- Jeyo
21/03/2008 05:10:35 (DIR) 0 byte 29 days old -- Thunderbird
21/03/2008 05:10:45 (DIR) 0 byte 29 days old -- Mozilla
22/03/2008 13:41:06 (DIR) 0 byte 28 days old -- BirdieSync
05/04/2008 18:16:30 (DIR) 0 byte 14 days old -- Apple Computer
07/04/2008 23:05:39 (DIR) 0 byte 12 days old -- AdobeUM
----- recent files in C:\DOCUME~1\ROUQUE~1\LOCALS~1\Temp\
17/04/2008 21:12:46 0 byte 2 days old -- srv8.tmp
17/04/2008 21:14:12 2 byte 2 days old -- Twain001.Mtx
17/04/2008 21:14:12 0 byte 2 days old -- TWAIN.LOG
18/04/2008 00:05:00 (DIR) 0 byte 1 days old -- Fichiers temporaires
18/04/2008 00:05:00 1583 byte 1 days old -- PCULog0.txt
18/04/2008 19:00:12 2424 byte 1 days old -- alm.log
18/04/2008 19:12:02 7143 byte 1 days old -- amt.log
19/04/2008 01:33:43 (DIR) 0 byte 0 days old -- {E2428802-912E-4897-A0C3-BCDE70AF2B30}
19/04/2008 01:33:44 (DIR) 0 byte 0 days old -- WPDNSE
19/04/2008 01:33:45 1353 byte 0 days old -- WCESLog.log
19/04/2008 01:34:52 509 byte 0 days old -- WCESCOMM.LOG
19/04/2008 01:35:17 16384 byte 0 days old -- ~DFC00.tmp
19/04/2008 01:35:17 (DIR) 0 byte 0 days old -- nsm5.tmp
19/04/2008 01:35:17 55 byte 0 days old -- systemscan.ini
===================== HIDDEN OBJECTS =====================
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:16,34,aa,9c,08,e5,a7,8e,ac,c3,8c,95,3f,91,b7,7f,09,f2,d0,81,2b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,5a,d5,1d,b1,83,17,7e,10,2e,81,1f,cc,6a,c0,1c,e3,5c,..
"khjeh"=hex:ff,18,96,de,ea,67,30,7a,78,46,1e,be,97,a3,58,64,4e,9c,b8,d3,42,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex
3,e5,1d,42,ef,0e,95,ec,f1,d1,7c,6e,3d,e6,ed,36,5e,c2,80,a9,fb,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:16,34,aa,9c,08,e5,a7,8e,ac,c3,8c,95,3f,91,b7,7f,09,f2,d0,81,2b,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,5a,d5,1d,b1,83,17,7e,10,2e,81,1f,cc,6a,c0,1c,e3,5c,..
"khjeh"=hex:ff,18,96,de,ea,67,30,7a,78,46,1e,be,97,a3,58,64,4e,9c,b8,d3,42,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex3,e5,1d,42,ef,0e,95,ec,f1,d1,7c,6e,3d,e6,ed,36,5e,c2,80,a9,fb,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:16,34,aa,9c,08,e5,a7,8e,ac,c3,8c,95,3f,91,b7,7f,09,f2,d0,81,2b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,5a,d5,1d,b1,83,17,7e,10,2e,81,1f,cc,6a,c0,1c,e3,5c,..
"khjeh"=hex:ff,18,96,de,ea,67,30,7a,78,46,1e,be,97,a3,58,64,4e,9c,b8,d3,42,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex3,e5,1d,42,ef,0e,95,ec,f1,d1,7c,6e,3d,e6,ed,36,5e,c2,80,a9,fb,..
scanning hidden registry entries ...
scanning hidden files ...
C:\RECYCLER\S-1-5-21-484763869-823518204-725345543-1004\Dc1
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1
===================== RUSTOCK ROOTKIT DETECTION =====================
#### NOTHING FOUND ####
==========================================
Scan completed in 5,8 minutes
End of report
~~~~~~~~~~~~~~~~~~~~~-----CREDITS-----~~~~~~~~~~~~~~~~~~~~~
SystemScan uses some freeware tools that remain property of their authors:
* SteelWerX Registry Console Tool, Who Am I (Bobby Flekman: www.xs4all.nl/~fstaal01) --> "Registry scan", "PC accounts "
* dumphive (Markus Stephany)--> "Registry scan"
* Listdlls (M.Russinovich, B.Cogswell: www.sysinternals.com) --> "Loaded modules"
* Catchme & MBR Rootkit detector (gmer: www.gmer.net) --> "Hidden objects", "Alternate Data Streams" & "Master Boot Record"
---> NOTE: SystemScan integrates "The Avenger" from Swandog46 (http://swandog46.geekstogo.com) to allow you to remove malwares found in this log
Thanks to all of them for their hard work
Et celui de Combofix :
ComboFix 08-04-15.5 - xxx 2008-04-19 19:52:31.4 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.564 [GMT 2:00]
Endroit: C:\Documents and Settings\xxx\Bureau\Combo-Fix.exe
[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\drivers\downld
.
---- Previous Run -------
.
C:\WINDOWS\system32\drivers\downld
.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-19 to 2008-04-19 ))))))))))))))))))))))))))))))))))))
.
2008-04-12 11:47 . 2008-04-12 11:47 <REP> d-------- C:\Program Files\CCleaner
2008-04-05 18:03 . 2008-04-05 18:03 <REP> d-------- C:\Program Files\iTunes
2008-04-05 18:03 . 2008-04-05 18:03 <REP> d-------- C:\Program Files\iPod
2008-04-05 18:01 . 2008-04-05 18:01 <REP> d-------- C:\Program Files\QuickTime
2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-03-22 19:56 . 2000-12-08 23:59 122,880 --a------ C:\WINDOWS\UnGins.exe
2008-03-22 19:51 . 2008-03-22 19:51 <REP> d-------- C:\Program Files\hearts
2008-03-22 19:50 . 2008-03-22 19:50 <REP> d-------- C:\Documents and Settings\xxx\WINDOWS
2008-03-22 19:50 . 2000-02-29 20:13 283,648 --a------ C:\WINDOWS\uninst.exe
2008-03-22 13:19 . 2008-03-22 13:19 <REP> d-------- C:\Program Files\My Mobile
2008-03-22 11:09 . 2008-03-22 11:09 <REP> d-------- C:\Program Files\Ateksoft
2008-03-21 18:35 . 2001-08-06 22:58 163,599 --a------ C:\WINDOWS\psuninst2.exe
2008-03-21 05:10 . 2008-03-21 05:10 <REP> d-------- C:\Documents and Settings\xxx\Application Data\Thunderbird
2008-03-21 05:07 . 2008-03-22 13:41 <REP> d-------- C:\Documents and Settings\xxx\Application Data\BirdieSync
2008-03-21 04:57 . 2008-03-21 04:57 <REP> d-------- C:\Documents and Settings\xxx\Application Data\Jeyo
2008-03-21 02:17 . 2005-10-21 03:47 30,592 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
2008-03-21 02:17 . 2005-10-21 03:47 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
2008-03-21 01:56 . 2008-03-29 23:43 <REP> d-------- C:\Program Files\Microsoft ActiveSync
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 19:12 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-04-11 20:00 --------- d-----w C:\Program Files\LClock
2008-04-11 19:57 --------- d-----w C:\Program Files\eMule
2008-04-11 17:30 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-04-10 20:52 --------- d-----w C:\Program Files\Soulseek
2008-04-10 01:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-04-07 21:05 --------- d-----w C:\Documents and Settings\xxx\Application Data\AdobeUM
2008-04-05 16:16 --------- d-----w C:\Documents and Settings\xxx\Application Data\Apple Computer
2008-04-04 00:07 --------- d-----w C:\Program Files\Norton Internet Security
2008-03-29 14:54 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-29 14:17 --------- d-----w C:\Program Files\Microsoft.NET
2008-03-22 17:51 2,117 ----a-w C:\Program Files\DeIsL1.isu
2008-03-22 17:51 147 ----a-w C:\Program Files\pid.txt
2008-03-21 01:27 --------- d-----w C:\Program Files\Microsoft Works
2008-03-20 23:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-20 23:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-17 21:05 --------- d-----w C:\Program Files\Spybot
2008-03-16 16:34 --------- d-----w C:\Program Files\Java
2008-03-11 21:09 --------- d-----w C:\Documents and Settings\xxx\Application Data\ConvertTemp
2008-03-04 23:35 --------- d-----w C:\Documents and Settings\xxx\Application Data\TransRender
2008-03-03 22:32 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-03-03 22:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-03 18:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-03 18:30 --------- d-----w C:\Program Files\Lavasoft
2008-03-03 18:29 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-03-02 20:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Corel
2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-01 12:00 --------- d-----w C:\Documents and Settings\xxx\Application Data\Corel
2008-03-01 11:57 --------- d-----w C:\Program Files\Corel
2008-02-27 23:19 2,212 ----a-w C:\WINDOWS\system32\tmp.reg
2008-02-27 19:34 --------- d-----w C:\Program Files\Free Notes & Office Ink
2008-02-27 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Tablet
2008-02-27 07:05 --------- d-----w C:\Program Files\Symantec
2008-02-27 07:04 --------- d-----w C:\Program Files\SymNetDrv
2008-02-26 23:14 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Symantec
2008-02-26 23:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-26 20:41 4,608 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2008-02-22 17:44 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-19 17:33 --------- d-----w C:\Program Files\Windows Live
2008-02-08 09:37 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-01-29 10:02 107,368 ----a-w C:\WINDOWS\system32\GEARAspi.dll
2007-12-02 23:32 88 --sh--r C:\WINDOWS\system32\3BC8D9A524.sys
.
------- Sigcheck -------
2007-06-13 15:22 1408512 0af023d93c7432a03f8fb91a38cff80e C:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2006-03-02 14:00 1036288 2a7bd330924252a2fd80344fc949bb72 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 15:22 1408512 0af023d93c7432a03f8fb91a38cff80e C:\WINDOWS\system32\dllcache\explorer.exe
2007-06-13 15:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\VIPv3\backup\explorer.exe
2007-06-13 15:22 1408512 0af023d93c7432a03f8fb91a38cff80e C:\WINDOWS\VIPv3\resources\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-04-17_18.09.52.01 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-17 14:22:55 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-19 17:49:59 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-04-17 14:27:10 127,886 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-19 17:54:50 130,136 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-17 14:27:10 157,710 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-04-19 17:54:50 160,640 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2008-04-17 14:27:10 534,054 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-19 17:54:50 537,264 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-04-17 14:27:10 643,384 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-04-19 17:54:50 648,554 ----a-w C:\WINDOWS\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 15:07 1289000]
"LClock"="C:\Program Files\LClock\lclock.exe" [2006-04-06 03:07 679936]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSPower"="SiSPower.dll" [2005-02-25 20:35 49152 C:\WINDOWS\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 19:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
"Vistadrv"="C:\WINDOWS\VIPv3\VIPhd\vsdrv.exe" [2006-07-30 03:37 121089]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 04:10 55824 C:\WINDOWS\KHALMNPR.Exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2008-04-17 13:46 58984]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-02-27 09:04 100056]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-08-11 17:30 249856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]
C:\Documents and Settings\ROUQUETTE\Menu D‚marrer\Programmes\D‚marrage\
Blaero Start Orb (Normal taskbar).lnk - D:\Logiciels\Logiciels vista\Blaero Start Orb - Normal Taskbar.exe [2007-12-01 14:30:07 573952]
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-12-01 15:03:16 2860792]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-09 01:32:33 784912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll 2007-11-15 11:10 72208 c:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
C:\PROGRA~1\FICHIE~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 C:\PROGRA~1\FICHIE~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
--a------ 2006-01-12 21:52 483328 C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-08-03 13:51 202024 C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel File Shell Monitor]
--a------ 2007-10-30 20:52 16200 C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-11-13 15:07 1289000 C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-08-11 17:30 249856 C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-08-11 17:30 81920 C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
--a------ 2007-10-25 17:37 2178832 C:\Program Files\Logitech\QuickCam\Quickcam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MacrokeyManager]
--a------ 2007-05-29 09:55 1969824 C:\WINDOWS\system32\WTMKM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2007-08-08 10:25 1828136 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 16:57 153136 C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
--a------ 2005-10-24 17:53 307200 C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VIPv3_Auto_Update]
--a------ 2006-09-08 16:54 23723 C:\WINDOWS\VIPv3\CheckForUpdates.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Nero BackItUp Scheduler 3"=2 (0x2)
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"NMIndexingService"=3 (0x3)
"MA_CMIDI_InstallerService"=2 (0x2)
"idsvc"=3 (0x3)
"aawservice"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 PzWDM;PzWDM;C:\WINDOWS\system32\Drivers\PzWDM.sys [2005-06-29 02:38]
R2 WTService;WTService;C:\WINDOWS\system32\atwtusb.exe [2007-05-29 17:40]
R3 HSFHWSIS;HSFHWSIS;C:\WINDOWS\system32\DRIVERS\HSFHWSIS.sys [2004-12-15 16:18]
S3 MA_CMIDI;%EVOL_USB.SvcDesc%;C:\WINDOWS\system32\drivers\ma_cmidi.sys [2005-06-14 14:44]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2156426-0801-11dd-8f87-8000600fe800}]
\Shell\AutoRun\command - G:\nideiect.com
\Shell\explore\Command - G:\nideiect.com
\Shell\open\Command - G:\nideiect.com
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-19 15:35:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-18 15:15:00 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-04-18 18:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Analyser mon ordinateur - ROUQUETTE.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/task:
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-19 19:55:36
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
.
Temps d'accomplissement: 2008-04-20 0:52:16
ComboFix-quarantined-files.txt 2008-04-19 22:13:46
Pre-Run: 9,398,222,848 octets libres
Post-Run: 9,386,266,624 octets libres
.
2008-04-10 01:07:34 --- E O F ---
bonjour
tu as télécharger une autre version de hijackthis?
pour antivir, oui, tu as raison:
Antivir.
-->Tuto<--
14 antivirus au banc d'essai
| Citation : Antivir : le plus efficace des gratuits |
ne scan pas ton pc avec pour le moment, installe le mais ne fais rien. 
+++++++++++++
~Fais une analyse antivirus en ligne sur le site de Kaspersky
http://webscanner.kaspersky.fr/
~ Clique sur Online Scanner.
~Accepte l'installation du contrôle ActiveX en cliquant sur le bouton Install.
~Sélectionne le poste de travail comme analyse.
~Enregistre le rapport en cliquant sur le bouton "Enregistrer rapport sous". Nomme-le, tu feras un copier/coller dans ta prochaine réponse.
Tuto du scan en ligne
/!\Marre de la pub: Firefox sécurisé/!\
Répondre à Sham_Rock
ok
Supprime tous les programmes installés pour la désinfection.
Merci de consulter ce dossier (en pdf) pour en connaître davantage sur les risques du Net.
Si tu trouves ce document intéressant, n'hésite pas à le transmettre à tes contacts.
~Edite ton premier message (en cliquant sur la gomme) et marque [résolu] dans le titre.
/!\Marre de la pub: Firefox sécurisé/!\
Répondre à Sham_Rock
de rien
bon surf
/!\Marre de la pub: Firefox sécurisé/!\
Répondre à Sham_Rock
