Virus sur Window Live Messenger YoItzVlad22222.TMP
Dernière réponse : dans Sécurité
bonjours,
Bon voila un énième post concernant un virus msn.
Voila mes simptomes
- blocage de la souris
- ouverture successive des fenetres de tout mes contacts
- envoi d'un message en portugais suivie d'un lien ( qui n'en ai pas un evidement ... )
- fermeture de toutes les pages
suite a ca je ne peux plus ouvrir de page sauf en redemarrant window live
bon classique vous me direz. le truc drole c'est que c'est un amis a moi qui m'a refiller son truc mais que je n'ai a aucun moment cliquer sur son "lien" ( je m'etais deja fais piéger par ce style de virus) donc du coup ca m'énerve légèrement ^^
j'ai fait quelques recherches et ce charmant virus se révèle indétecté par malwarebytes ainsi qu'une multitude d'autre anti virus que j'ai eu l'occasion de tester. j'ai egalement testé la réinstallation de window live qui s'est avéré inéfficasse.
autre fait marrant (mais je n'ai pas de preuve qu'il y ai correlation) j'ai un fichier corrompu qui viens se greffer a de multiple reprise dans mon dossier system32 sous le nom de YoItzVlad22222.TMP et si on l'ouvre en temps que fichier texte ya ecrit " Ah Ah ". Ce virus me nargue !!!
donc voila HELP ^^
d'avance merci
Bon voila un énième post concernant un virus msn.
Voila mes simptomes
- blocage de la souris
- ouverture successive des fenetres de tout mes contacts
- envoi d'un message en portugais suivie d'un lien ( qui n'en ai pas un evidement ... )
- fermeture de toutes les pages
suite a ca je ne peux plus ouvrir de page sauf en redemarrant window live
bon classique vous me direz. le truc drole c'est que c'est un amis a moi qui m'a refiller son truc mais que je n'ai a aucun moment cliquer sur son "lien" ( je m'etais deja fais piéger par ce style de virus) donc du coup ca m'énerve légèrement ^^
j'ai fait quelques recherches et ce charmant virus se révèle indétecté par malwarebytes ainsi qu'une multitude d'autre anti virus que j'ai eu l'occasion de tester. j'ai egalement testé la réinstallation de window live qui s'est avéré inéfficasse.
autre fait marrant (mais je n'ai pas de preuve qu'il y ai correlation) j'ai un fichier corrompu qui viens se greffer a de multiple reprise dans mon dossier system32 sous le nom de YoItzVlad22222.TMP et si on l'ouvre en temps que fichier texte ya ecrit " Ah Ah ". Ce virus me nargue !!!
donc voila HELP ^^
d'avance merci
Autres pages sur : virus window live messenger yoitzvlad22222 tmp
Lassé par la pub ? Créez un compte
'soir
Tu as utilisé quoi comme tools au juste? tu as conservé les rapports?![:o]( ":o")
Télécharge DDS et sauvegarde-le sur ton bureau.
Désactive tout script bloquant, tel q'un antivirus, un logiciel comme ad-block, noscript etc.
Double-clique sur dds.scr pour lancer l'outil.
Une fois le scan fini, un document texte, DDS.txt, va s'ouvrir .
Clique Oui à la prochaine invite Optional Scan.
Sauvegarde les deux rapports sur ton bureau et poste-moi uniquement le DDS.txt.
2
Télécharge Catchme ([#ff0000]Gmer[/#f]) sur ton Bureau.
Double clique sur catchme.exe (le .exe n'est pas forcément visible) afin de le lancer.
Lorsque la recherche sera terminée, poste le rapport catchme.log dans ta prochaine réponse. (Ce rapport est sur ton bureau.)
Tu as utilisé quoi comme tools au juste? tu as conservé les rapports?
Télécharge DDS et sauvegarde-le sur ton bureau.
2
merci de m'aider
non désolé j'ai penser a concerver les rapports
pour le moment j'ai essayé Malwarebytes, clean virus msn et spybots.
petit fait divers, le truc s'est mis en route pendant que je tappais ce message et a coller le message dans la barre de texte ...
DDS (Ver_10-03-17.01) - NTFSx86
Run by Sieg at 22:31:19,08 on 29/03/2010
Internet Explorer: 8.0.6001.18882
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3062.1255 [GMT 2:00]
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\Bandoo\Bandoo.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Megaupload\Mega Manager\MegaManager.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uTorrent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Users\Sieg\AppData\Roaming\Drivers.exe
C:\Users\Sieg\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.facebook.com/
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mWinlogon: Taskman=c:\recycler\s-1-5-21-9945056042-7988186532-075824978-1196\sysinfo.exe
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Programme d'aide de l'Assistant de connexion Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files\megaupload\mega manager\MegaIEMn.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [3obCwnwz6B3r4mEf4DM4] c:\users\sieg\appdata\roaming\IHInM.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Drivers] Drivers.exe
mRun: [OIFdA8HS0cTgsDMa] c:\users\sieg\appdata\roaming\IHInM.exe
StartupFolder: c:\users\sieg\appdata\roaming\microsoft\windows\start menu\programs\startup\uTorrent.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\megama~1.lnk - c:\program files\megaupload\mega manager\MegaManager.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\window~1.lnk - c:\program files\windows live\messenger\msnmsgr.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xporter vers Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\megaupload\mega manager\mm_file.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
AppInit_DLLs: c:\progra~1\bandoo\bndhook.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
mASetup: {FNE7T74f-VKfR-FAGU-lI5k-rvb9EV6GHSGx} - c:\users\sieg\appdata\roaming\IHInM.exe
uASetup: {FNE7T74f-VKfR-FAGU-lI5k-rvb9EV6GHSGx} - c:\users\sieg\appdata\roaming\IHInM.exe
============= SERVICES / DRIVERS ===============
S3 FontCache;Service de cache de police Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-10-18 21504]
=============== Created Last 30 ================
2010-03-29 20:11:15 5 ----a-w- c:\windows\system32\qwdijiojdf.tmp
2010-03-29 20:11:15 126976 --sh--r- c:\users\sieg\appdata\roaming\Drivers.exe
2010-03-29 18:12:57 0 d-----w- c:\programdata\Spybot - Search & Destroy
2010-03-29 18:12:57 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-03-28 21:30:06 5 ----a-w- c:\windows\system32\YoItzVlad22222.tmp
2010-03-27 10:19:24 0 d-----w- c:\users\sieg\appdata\roaming\Malwarebytes
2010-03-27 10:19:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 10:19:19 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 10:19:19 0 d-----w- c:\programdata\Malwarebytes
2010-03-27 10:19:19 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 10:03:34 0 d-----w- c:\program files\trend micro
2010-03-27 09:18:00 0 d-----w- c:\program files\AxBx
2010-03-26 21:47:22 0 d-----w- c:\program files\Microsoft
2010-03-24 09:28:54 5 ----a-w- c:\windows\system32\qweweuu38.tmp
2010-03-24 09:28:53 200704 ----a-w- C:\lksdjf.exe
2010-03-24 08:47:58 200704 --sh--r- c:\windows\Drivers.exe
2010-03-17 09:38:28 0 d-----w- c:\program files\Heroes III
2010-03-14 16:46:28 0 d-----w- c:\program files\Left4Dead
2010-03-10 02:01:31 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-10 02:01:30 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-10 02:01:30 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-03-04 17:57:51 0 d-----w- c:\program files\Left 4 Dead 2
2010-03-02 15:38:05 0 d-----w- c:\program files\505games
==================== Find3M ====================
2010-03-29 06:35:29 669566 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-29 06:35:29 123556 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 06:32:11 125672 ----a-w- c:\programdata\nvModes.dat
2010-02-22 12:11:28 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-22 12:11:27 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-12 10:32:56 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-02-11 17:24:11 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-10 12:56:47 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-23 09:26:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-02 06:38:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32:33 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32:33 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57:00 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-17 02:17:55 86016 ----a-w- c:\windows\inf\infstrng.dat
2009-11-17 02:17:55 86016 ----a-w- c:\windows\inf\infstor.dat
2009-11-17 02:17:55 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-17 02:17:55 51200 ----a-w- c:\windows\inf\infpub.dat
2009-10-18 17:25:25 174 --sha-w- c:\program files\desktop.ini
2006-11-02 15:45:47 37390 ----a-w- c:\windows\inf\perflib\040c\perfd.dat
2006-11-02 15:45:47 37390 ----a-w- c:\windows\inf\perflib\040c\perfc.dat
2006-11-02 15:45:47 340236 ----a-w- c:\windows\inf\perflib\040c\perfi.dat
2006-11-02 15:45:47 340236 ----a-w- c:\windows\inf\perflib\040c\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-11-27 19:13:07 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
============= FINISH: 22:32:05,90 ===============
et pour le catchme
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-29 22:36:38
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000001
"hdf12"=hex:87,15,9f,31,eb,54,b8,62,ea,18,f8,47,d5,90,b2,41,f9,3b,68,76,af,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,e1,2a,75,ee,88,9e,da,03,09,52,a5,ad,ff,c8,c3,23,67,..
"hdf12"=hex:54,0c,bb,85,18,9c,43,bb,a1,01,3d,b1,9e,bf,e2,49,cc,55,7b,df,fe,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:ba,93,77,65,58,ae,2e,0c,6a,d6,12,77,57,8b,c2,58,ae,71,4c,f4,10,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:0b,c6,32,a8,4e,65,a9,b8,90,41,fc,cf,88,85,c5,41,33,04,d5,01,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1b,b1,14,29,ca,3a,52,ff,1f,39,1b,26,d3,86,6c,21,5c,0d,68,e9,60,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:65,7c,f5,29,83,8e,20,5a,41,de,f5,67,2d,56,ea,62,bb,6e,02,f0,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:5c,17,ca,cc,bb,78,4e,a2,8e,e4,fd,67,e7,67,52,69,25,33,8b,db,b4,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000001
"hdf12"=hex:87,15,9f,31,eb,54,b8,62,ea,18,f8,47,d5,90,b2,41,f9,3b,68,76,af,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,e1,2a,75,ee,88,9e,da,03,09,52,a5,ad,ff,c8,c3,23,67,..
"hdf12"=hex:54,0c,bb,85,18,9c,43,bb,a1,01,3d,b1,9e,bf,e2,49,cc,55,7b,df,fe,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:ba,93,77,65,58,ae,2e,0c,6a,d6,12,77,57,8b,c2,58,ae,71,4c,f4,10,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:0b,c6,32,a8,4e,65,a9,b8,90,41,fc,cf,88,85,c5,41,33,04,d5,01,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1b,b1,14,29,ca,3a,52,ff,1f,39,1b,26,d3,86,6c,21,5c,0d,68,e9,60,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:65,7c,f5,29,83,8e,20,5a,41,de,f5,67,2d,56,ea,62,bb,6e,02,f0,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:5c,17,ca,cc,bb,78,4e,a2,8e,e4,fd,67,e7,67,52,69,25,33,8b,db,b4,..
scanning hidden registry entries ...
scanning hidden files ...
non désolé j'ai penser a concerver les rapports
pour le moment j'ai essayé Malwarebytes, clean virus msn et spybots.
petit fait divers, le truc s'est mis en route pendant que je tappais ce message et a coller le message dans la barre de texte ...
DDS (Ver_10-03-17.01) - NTFSx86
Run by Sieg at 22:31:19,08 on 29/03/2010
Internet Explorer: 8.0.6001.18882
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3062.1255 [GMT 2:00]
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\Bandoo\Bandoo.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Megaupload\Mega Manager\MegaManager.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uTorrent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Users\Sieg\AppData\Roaming\Drivers.exe
C:\Users\Sieg\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.facebook.com/
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
mWinlogon: Taskman=c:\recycler\s-1-5-21-9945056042-7988186532-075824978-1196\sysinfo.exe
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Programme d'aide de l'Assistant de connexion Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files\megaupload\mega manager\MegaIEMn.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [3obCwnwz6B3r4mEf4DM4] c:\users\sieg\appdata\roaming\IHInM.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Drivers] Drivers.exe
mRun: [OIFdA8HS0cTgsDMa] c:\users\sieg\appdata\roaming\IHInM.exe
StartupFolder: c:\users\sieg\appdata\roaming\microsoft\windows\start menu\programs\startup\uTorrent.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\megama~1.lnk - c:\program files\megaupload\mega manager\MegaManager.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\window~1.lnk - c:\program files\windows live\messenger\msnmsgr.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xporter vers Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\megaupload\mega manager\mm_file.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
AppInit_DLLs: c:\progra~1\bandoo\bndhook.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
mASetup: {FNE7T74f-VKfR-FAGU-lI5k-rvb9EV6GHSGx} - c:\users\sieg\appdata\roaming\IHInM.exe
uASetup: {FNE7T74f-VKfR-FAGU-lI5k-rvb9EV6GHSGx} - c:\users\sieg\appdata\roaming\IHInM.exe
============= SERVICES / DRIVERS ===============
S3 FontCache;Service de cache de police Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-10-18 21504]
=============== Created Last 30 ================
2010-03-29 20:11:15 5 ----a-w- c:\windows\system32\qwdijiojdf.tmp
2010-03-29 20:11:15 126976 --sh--r- c:\users\sieg\appdata\roaming\Drivers.exe
2010-03-29 18:12:57 0 d-----w- c:\programdata\Spybot - Search & Destroy
2010-03-29 18:12:57 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-03-28 21:30:06 5 ----a-w- c:\windows\system32\YoItzVlad22222.tmp
2010-03-27 10:19:24 0 d-----w- c:\users\sieg\appdata\roaming\Malwarebytes
2010-03-27 10:19:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 10:19:19 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 10:19:19 0 d-----w- c:\programdata\Malwarebytes
2010-03-27 10:19:19 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 10:03:34 0 d-----w- c:\program files\trend micro
2010-03-27 09:18:00 0 d-----w- c:\program files\AxBx
2010-03-26 21:47:22 0 d-----w- c:\program files\Microsoft
2010-03-24 09:28:54 5 ----a-w- c:\windows\system32\qweweuu38.tmp
2010-03-24 09:28:53 200704 ----a-w- C:\lksdjf.exe
2010-03-24 08:47:58 200704 --sh--r- c:\windows\Drivers.exe
2010-03-17 09:38:28 0 d-----w- c:\program files\Heroes III
2010-03-14 16:46:28 0 d-----w- c:\program files\Left4Dead
2010-03-10 02:01:31 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-10 02:01:30 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-10 02:01:30 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-03-04 17:57:51 0 d-----w- c:\program files\Left 4 Dead 2
2010-03-02 15:38:05 0 d-----w- c:\program files\505games
==================== Find3M ====================
2010-03-29 06:35:29 669566 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-29 06:35:29 123556 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 06:32:11 125672 ----a-w- c:\programdata\nvModes.dat
2010-02-22 12:11:28 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-22 12:11:27 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-12 10:32:56 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-02-11 17:24:11 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-10 12:56:47 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-23 09:26:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-02 06:38:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32:33 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32:33 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57:00 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-17 02:17:55 86016 ----a-w- c:\windows\inf\infstrng.dat
2009-11-17 02:17:55 86016 ----a-w- c:\windows\inf\infstor.dat
2009-11-17 02:17:55 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-17 02:17:55 51200 ----a-w- c:\windows\inf\infpub.dat
2009-10-18 17:25:25 174 --sha-w- c:\program files\desktop.ini
2006-11-02 15:45:47 37390 ----a-w- c:\windows\inf\perflib\040c\perfd.dat
2006-11-02 15:45:47 37390 ----a-w- c:\windows\inf\perflib\040c\perfc.dat
2006-11-02 15:45:47 340236 ----a-w- c:\windows\inf\perflib\040c\perfi.dat
2006-11-02 15:45:47 340236 ----a-w- c:\windows\inf\perflib\040c\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-11-27 19:13:07 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
============= FINISH: 22:32:05,90 ===============
et pour le catchme
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-29 22:36:38
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000001
"hdf12"=hex:87,15,9f,31,eb,54,b8,62,ea,18,f8,47,d5,90,b2,41,f9,3b,68,76,af,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,e1,2a,75,ee,88,9e,da,03,09,52,a5,ad,ff,c8,c3,23,67,..
"hdf12"=hex:54,0c,bb,85,18,9c,43,bb,a1,01,3d,b1,9e,bf,e2,49,cc,55,7b,df,fe,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:ba,93,77,65,58,ae,2e,0c,6a,d6,12,77,57,8b,c2,58,ae,71,4c,f4,10,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:0b,c6,32,a8,4e,65,a9,b8,90,41,fc,cf,88,85,c5,41,33,04,d5,01,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1b,b1,14,29,ca,3a,52,ff,1f,39,1b,26,d3,86,6c,21,5c,0d,68,e9,60,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:65,7c,f5,29,83,8e,20,5a,41,de,f5,67,2d,56,ea,62,bb,6e,02,f0,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:5c,17,ca,cc,bb,78,4e,a2,8e,e4,fd,67,e7,67,52,69,25,33,8b,db,b4,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000001
"hdf12"=hex:87,15,9f,31,eb,54,b8,62,ea,18,f8,47,d5,90,b2,41,f9,3b,68,76,af,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,e1,2a,75,ee,88,9e,da,03,09,52,a5,ad,ff,c8,c3,23,67,..
"hdf12"=hex:54,0c,bb,85,18,9c,43,bb,a1,01,3d,b1,9e,bf,e2,49,cc,55,7b,df,fe,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:ba,93,77,65,58,ae,2e,0c,6a,d6,12,77,57,8b,c2,58,ae,71,4c,f4,10,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
"hdf12"=hex:0b,c6,32,a8,4e,65,a9,b8,90,41,fc,cf,88,85,c5,41,33,04,d5,01,ec,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1b,b1,14,29,ca,3a,52,ff,1f,39,1b,26,d3,86,6c,21,5c,0d,68,e9,60,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:65,7c,f5,29,83,8e,20,5a,41,de,f5,67,2d,56,ea,62,bb,6e,02,f0,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:5c,17,ca,cc,bb,78,4e,a2,8e,e4,fd,67,e7,67,52,69,25,33,8b,db,b4,..
scanning hidden registry entries ...
scanning hidden files ...
re
Désactive ton antivirus et tout autre type de protection.
Télécharge ComboFix de sUBs :
ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
Double-clic sur ComboFix, Il va te poser une question, suis les invites puis attends que combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé.Poste le rapport:C:\Combofix.txt
clique dessus pour l'ouvrir, puis édition "sélectionner tout", édition "copier"
viens sur le forum et édition "coller"
AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer
Désactive ton antivirus et tout autre type de protection.
Télécharge ComboFix de sUBs :
ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
Double-clic sur ComboFix, Il va te poser une question, suis les invites puis attends que combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé.Poste le rapport:C:\Combofix.txt
clique dessus pour l'ouvrir, puis édition "sélectionner tout", édition "copier"
viens sur le forum et édition "coller"
AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer
il me fait peur, il evolut, il mute !hier encore il ne parlait que portugais mais ce soir il a apris le francais et parle a mes amis de facebook ....
ComboFix 10-03-29.01 - Sieg 29/03/2010 23:06:15.1.2 - x86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3062.2402 [GMT 2:00]
Lancé depuis: c:\users\Sieg\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Windows Live Messenger .lnk
c:\recycler\S-1-5-21-5235621004-6946379131-066238837-2025
c:\recycler\S-1-5-21-9865411228-6756751902-853474308-2420
c:\recycler\S-1-5-21-9945056042-7988186532-075824978-1196
c:\windows\Drivers.exe
c:\windows\system32\YoItzVlad22222.tmp
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-28 au 2010-03-29 ))))))))))))))))))))))))))))))))))))
.
2010-03-29 20:11 . 2010-03-29 20:11 126976 --sh--r- c:\users\Sieg\AppData\Roaming\Drivers.exe
2010-03-29 18:12 . 2010-03-29 19:22 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-03-29 18:12 . 2010-03-29 18:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\users\Sieg\AppData\Roaming\Malwarebytes
2010-03-27 10:19 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\programdata\Malwarebytes
2010-03-27 10:19 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 10:03 . 2010-03-27 10:04 -------- d-----w- c:\program files\trend micro
2010-03-27 10:03 . 2010-03-27 10:04 -------- d-----w- C:\rsit
2010-03-27 09:18 . 2010-03-27 09:18 -------- d-----w- c:\program files\AxBx
2010-03-26 21:47 . 2010-03-26 21:47 -------- d-----w- c:\program files\Microsoft
2010-03-26 21:47 . 2010-03-26 21:47 -------- d-----w- c:\program files\Windows Live
2010-03-24 09:28 . 2010-03-28 21:30 200704 ----a-w- C:\lksdjf.exe
2010-03-21 23:36 . 2010-03-22 00:06 6743992 ----a-w- c:\users\Sieg\AppData\Roaming\uTorrent\Forest Gump (1994) DVD-Rip BivX (FR-ENG) Titanic Team\bsplayer223.953_clip.exe
2010-03-17 09:38 . 2010-03-17 09:38 -------- d-----w- c:\program files\Heroes III
2010-03-14 16:46 . 2010-03-14 17:09 -------- d-----w- c:\program files\Left4Dead
2010-03-10 02:01 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-10 02:01 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-03-10 02:01 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-04 17:57 . 2010-03-27 12:52 -------- d-----w- c:\program files\Left 4 Dead 2
2010-03-02 15:42 . 2010-03-02 15:42 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-02 15:38 . 2010-03-02 15:38 -------- d-----w- c:\program files\505games
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-29 21:07 . 2006-11-02 15:48 669566 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-29 21:07 . 2006-11-02 15:48 123556 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 21:01 . 2009-10-12 21:32 125672 ----a-w- c:\programdata\nvModes.dat
2010-03-29 21:00 . 2009-10-11 19:12 -------- d-----w- c:\users\Sieg\AppData\Roaming\uTorrent
2010-03-29 20:11 . 2010-03-29 20:11 5 ----a-w- c:\windows\system32\qwdijiojdf.tmp
2010-03-28 21:30 . 2010-01-08 12:54 -------- d-----w- c:\program files\Steam
2010-03-24 09:28 . 2010-03-24 09:28 5 ----a-w- c:\windows\system32\qweweuu38.tmp
2010-03-16 12:36 . 2010-01-08 12:54 -------- d-----w- c:\program files\Common Files\Steam
2010-03-10 02:05 . 2009-10-28 20:00 -------- d-----w- c:\programdata\Microsoft Help
2010-02-24 08:30 . 2009-10-11 19:13 319280 ----a-w- c:\users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uTorrent.exe
2010-02-23 17:59 . 2010-02-23 17:59 -------- d-----w- c:\users\Sieg\AppData\Roaming\The Creative Assembly
2010-02-23 17:59 . 2010-02-23 17:27 -------- d-----w- c:\program files\Empire Total War
2010-02-22 12:12 . 2010-02-22 12:12 -------- d-----w- c:\programdata\BC
2010-02-22 12:11 . 2009-10-12 21:28 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-22 12:11 . 2010-02-22 12:11 -------- d-----w- c:\program files\OpenAL
2010-02-22 12:11 . 2010-02-22 12:11 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-22 12:11 . 2010-02-22 12:11 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-22 12:01 . 2010-02-22 12:01 -------- d-----w- c:\program files\Capcom
2010-02-22 12:01 . 2009-10-12 17:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-19 11:11 . 2010-02-19 11:11 -------- d-----w- c:\program files\Anuman Interactive
2010-02-12 10:32 . 2010-02-26 02:00 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-02-11 17:33 . 2010-02-11 17:33 -------- d-----w- c:\users\Sieg\AppData\Roaming\XRay Engine
2010-02-11 17:24 . 2010-02-11 17:24 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-11 17:10 . 2010-02-11 17:10 -------- d-----w- c:\program files\bitComposer Games
2010-02-10 12:56 . 2010-02-10 12:56 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-23 09:26 . 2010-02-23 23:41 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-06 11:10 . 2009-10-11 16:37 99864 ----a-w- c:\users\Sieg\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-02 06:38 . 2010-01-22 05:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 05:58 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 05:58 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 05:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-11 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"Steam"="c:\program files\Steam\Steam.exe" [2010-02-24 1217872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13793824]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
c:\users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
uTorrent.exe [2010-2-24 319280]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Mega Manager.lnk - c:\program files\Megaupload\Mega Manager\MegaManager.exe [2009-11-5 1961984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):6b,ad,ed,f9,42,53,ca,01
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-10-21 721904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contenu du dossier 'Tâches planifiées'
2010-03-29 c:\windows\Tasks\User_Feed_Synchronization-{33EB9D8B-57E0-4D33-8102-0764AF33DF5F}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.facebook.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-3obCwnwz6B3r4mEf4DM4 - c:\users\Sieg\AppData\Roaming\IHInM.exe
HKLM-Run-Drivers - Drivers.exe
HKLM-Run-OIFdA8HS0cTgsDMa - c:\users\Sieg\AppData\Roaming\IHInM.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-29 23:14
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-520997026-2530013781-3910746367-1000\Software\SecuROM\License information*]
"datasecu"=hex:e3,68,ef,b4,06,02,0a,7d,1f,33,82,da,e6,d9,a3,87,ef,4d,7c,ac,9b,
ea,19,82,79,59,be,cc,21,c4,51,c9,fb,8c,e3,c2,fd,4a,26,be,82,da,39,ed,ef,da,\
"rkeysecu"=hex:a4,1d,97,a5,7a,b3,cd,5c,8b,1c,fb,d7,49,94,bc,57
.
Heure de fin: 2010-03-29 23:16:05
ComboFix-quarantined-files.txt 2010-03-29 21:16
Avant-CF: 17 130 176 512 octets libres
Après-CF: 17 238 695 936 octets libres
- - End Of File - - 8BC942A2654FE84EDF596F3EEA630685
ComboFix 10-03-29.01 - Sieg 29/03/2010 23:06:15.1.2 - x86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3062.2402 [GMT 2:00]
Lancé depuis: c:\users\Sieg\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Windows Live Messenger .lnk
c:\recycler\S-1-5-21-5235621004-6946379131-066238837-2025
c:\recycler\S-1-5-21-9865411228-6756751902-853474308-2420
c:\recycler\S-1-5-21-9945056042-7988186532-075824978-1196
c:\windows\Drivers.exe
c:\windows\system32\YoItzVlad22222.tmp
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-28 au 2010-03-29 ))))))))))))))))))))))))))))))))))))
.
2010-03-29 20:11 . 2010-03-29 20:11 126976 --sh--r- c:\users\Sieg\AppData\Roaming\Drivers.exe
2010-03-29 18:12 . 2010-03-29 19:22 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-03-29 18:12 . 2010-03-29 18:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\users\Sieg\AppData\Roaming\Malwarebytes
2010-03-27 10:19 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\programdata\Malwarebytes
2010-03-27 10:19 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 10:03 . 2010-03-27 10:04 -------- d-----w- c:\program files\trend micro
2010-03-27 10:03 . 2010-03-27 10:04 -------- d-----w- C:\rsit
2010-03-27 09:18 . 2010-03-27 09:18 -------- d-----w- c:\program files\AxBx
2010-03-26 21:47 . 2010-03-26 21:47 -------- d-----w- c:\program files\Microsoft
2010-03-26 21:47 . 2010-03-26 21:47 -------- d-----w- c:\program files\Windows Live
2010-03-24 09:28 . 2010-03-28 21:30 200704 ----a-w- C:\lksdjf.exe
2010-03-21 23:36 . 2010-03-22 00:06 6743992 ----a-w- c:\users\Sieg\AppData\Roaming\uTorrent\Forest Gump (1994) DVD-Rip BivX (FR-ENG) Titanic Team\bsplayer223.953_clip.exe
2010-03-17 09:38 . 2010-03-17 09:38 -------- d-----w- c:\program files\Heroes III
2010-03-14 16:46 . 2010-03-14 17:09 -------- d-----w- c:\program files\Left4Dead
2010-03-10 02:01 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-10 02:01 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-03-10 02:01 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-04 17:57 . 2010-03-27 12:52 -------- d-----w- c:\program files\Left 4 Dead 2
2010-03-02 15:42 . 2010-03-02 15:42 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-02 15:38 . 2010-03-02 15:38 -------- d-----w- c:\program files\505games
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-29 21:07 . 2006-11-02 15:48 669566 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-29 21:07 . 2006-11-02 15:48 123556 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-29 21:01 . 2009-10-12 21:32 125672 ----a-w- c:\programdata\nvModes.dat
2010-03-29 21:00 . 2009-10-11 19:12 -------- d-----w- c:\users\Sieg\AppData\Roaming\uTorrent
2010-03-29 20:11 . 2010-03-29 20:11 5 ----a-w- c:\windows\system32\qwdijiojdf.tmp
2010-03-28 21:30 . 2010-01-08 12:54 -------- d-----w- c:\program files\Steam
2010-03-24 09:28 . 2010-03-24 09:28 5 ----a-w- c:\windows\system32\qweweuu38.tmp
2010-03-16 12:36 . 2010-01-08 12:54 -------- d-----w- c:\program files\Common Files\Steam
2010-03-10 02:05 . 2009-10-28 20:00 -------- d-----w- c:\programdata\Microsoft Help
2010-02-24 08:30 . 2009-10-11 19:13 319280 ----a-w- c:\users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uTorrent.exe
2010-02-23 17:59 . 2010-02-23 17:59 -------- d-----w- c:\users\Sieg\AppData\Roaming\The Creative Assembly
2010-02-23 17:59 . 2010-02-23 17:27 -------- d-----w- c:\program files\Empire Total War
2010-02-22 12:12 . 2010-02-22 12:12 -------- d-----w- c:\programdata\BC
2010-02-22 12:11 . 2009-10-12 21:28 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-22 12:11 . 2010-02-22 12:11 -------- d-----w- c:\program files\OpenAL
2010-02-22 12:11 . 2010-02-22 12:11 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-22 12:11 . 2010-02-22 12:11 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-22 12:01 . 2010-02-22 12:01 -------- d-----w- c:\program files\Capcom
2010-02-22 12:01 . 2009-10-12 17:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-19 11:11 . 2010-02-19 11:11 -------- d-----w- c:\program files\Anuman Interactive
2010-02-12 10:32 . 2010-02-26 02:00 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-02-11 17:33 . 2010-02-11 17:33 -------- d-----w- c:\users\Sieg\AppData\Roaming\XRay Engine
2010-02-11 17:24 . 2010-02-11 17:24 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-11 17:10 . 2010-02-11 17:10 -------- d-----w- c:\program files\bitComposer Games
2010-02-10 12:56 . 2010-02-10 12:56 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-23 09:26 . 2010-02-23 23:41 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-06 11:10 . 2009-10-11 16:37 99864 ----a-w- c:\users\Sieg\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-02 06:38 . 2010-01-22 05:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 05:58 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 05:58 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 05:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-11 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"Steam"="c:\program files\Steam\Steam.exe" [2010-02-24 1217872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13793824]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
c:\users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
uTorrent.exe [2010-2-24 319280]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Mega Manager.lnk - c:\program files\Megaupload\Mega Manager\MegaManager.exe [2009-11-5 1961984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):6b,ad,ed,f9,42,53,ca,01
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-10-21 721904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contenu du dossier 'Tâches planifiées'
2010-03-29 c:\windows\Tasks\User_Feed_Synchronization-{33EB9D8B-57E0-4D33-8102-0764AF33DF5F}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.facebook.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-3obCwnwz6B3r4mEf4DM4 - c:\users\Sieg\AppData\Roaming\IHInM.exe
HKLM-Run-Drivers - Drivers.exe
HKLM-Run-OIFdA8HS0cTgsDMa - c:\users\Sieg\AppData\Roaming\IHInM.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-29 23:14
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-520997026-2530013781-3910746367-1000\Software\SecuROM\License information*]
"datasecu"=hex:e3,68,ef,b4,06,02,0a,7d,1f,33,82,da,e6,d9,a3,87,ef,4d,7c,ac,9b,
ea,19,82,79,59,be,cc,21,c4,51,c9,fb,8c,e3,c2,fd,4a,26,be,82,da,39,ed,ef,da,\
"rkeysecu"=hex:a4,1d,97,a5,7a,b3,cd,5c,8b,1c,fb,d7,49,94,bc,57
.
Heure de fin: 2010-03-29 23:16:05
ComboFix-quarantined-files.txt 2010-03-29 21:16
Avant-CF: 17 130 176 512 octets libres
Après-CF: 17 238 695 936 octets libres
- - End Of File - - 8BC942A2654FE84EDF596F3EEA630685
Bonsoir
Copie (Ctrl+C) le texte ci-dessous :
Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte que tu viens de copier.
Sauvegarde ce fichier sous le nom de CFScript.txt
Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
![]()
Combofix se lance, laisse toi guider..
Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu, en précisant où en sont tes soucis
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer
Copie (Ctrl+C) le texte ci-dessous :
File::
c:\users\Sieg\AppData\Roaming\Drivers.exe
C:\lksdjf.exe
C:\users\Sieg\AppData\Roaming\uTorrent\Forest Gump (1994) DVD-Rip BivX (FR-ENG) Titanic Team\bsplayer223.953_clip.exe
c:\windows\system32\qwdijiojdf.tmp
c:\windows\system32\qweweuu38.tmp
c:\users\Sieg\AppData\Roaming\Drivers.exe
C:\lksdjf.exe
C:\users\Sieg\AppData\Roaming\uTorrent\Forest Gump (1994) DVD-Rip BivX (FR-ENG) Titanic Team\bsplayer223.953_clip.exe
c:\windows\system32\qwdijiojdf.tmp
c:\windows\system32\qweweuu38.tmp
Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte que tu viens de copier.
Sauvegarde ce fichier sous le nom de CFScript.txt
Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
Ne touche à rien tant que le scan n'est pas terminé.
AIDE : Un guide et un tutoriel sur l'utilisation de ComboFix
* le nom de la partition peut changer
bonsoir
voila le rapport. concernant mes soucis depuis que j'ai lancé comboFix hier je n'ai plus eu de probleme sur msn. je ne sais pas s'il est trop tot pour se rejouir mais j'ai l'impression que c'est gagné ^^ si demain je n'ai pas de retour je pense qu'on pourra dire que la menace a été écarté ^^. je te remerci d'ailleur une fois de plus pour avoir utilisé ton temps et ton savoir pour m'aider. d'ailleur mon amis qui m'a refilé le virus doit faire la meme manoeuvre que moi pour s'en debarrasser ?
ComboFix 10-03-29.01 - Sieg 30/03/2010 23:14:36.2.2 - x86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3062.1815 [GMT 2:00]
Lancé depuis: c:\users\Sieg\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Sieg\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FILE ::
"C:\lksdjf.exe"
"c:\users\Sieg\AppData\Roaming\Drivers.exe"
"c:\users\Sieg\AppData\Roaming\uTorrent\Forest Gump (1994) DVD-Rip BivX (FR-ENG) Titanic Team\bsplayer223.953_clip.exe"
"c:\windows\system32\qwdijiojdf.tmp"
"c:\windows\system32\qweweuu38.tmp"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\lksdjf.exe
c:\users\Sieg\AppData\Roaming\Drivers.exe
c:\users\Sieg\AppData\Roaming\uTorrent\Forest Gump (1994) DVD-Rip BivX (FR-ENG) Titanic Team\bsplayer223.953_clip.exe
c:\windows\system32\qwdijiojdf.tmp
c:\windows\system32\qweweuu38.tmp
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-28 au 2010-03-30 ))))))))))))))))))))))))))))))))))))
.
2010-03-30 21:19 . 2010-03-30 21:19 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-03-30 21:19 . 2010-03-30 21:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-30 20:46 . 2010-03-30 20:46 0 ----a-w- c:\windows\nsreg.dat
2010-03-30 20:46 . 2010-03-30 20:46 -------- d-----w- c:\users\Sieg\AppData\Local\Mozilla
2010-03-29 21:16 . 2010-03-30 21:19 -------- d-----w- c:\users\Sieg\AppData\Local\temp
2010-03-29 18:12 . 2010-03-29 19:22 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-03-29 18:12 . 2010-03-29 18:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\users\Sieg\AppData\Roaming\Malwarebytes
2010-03-27 10:19 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\programdata\Malwarebytes
2010-03-27 10:19 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 10:03 . 2010-03-27 10:04 -------- d-----w- c:\program files\trend micro
2010-03-27 10:03 . 2010-03-27 10:04 -------- d-----w- C:\rsit
2010-03-27 09:18 . 2010-03-27 09:18 -------- d-----w- c:\program files\AxBx
2010-03-26 21:47 . 2010-03-26 21:47 -------- d-----w- c:\program files\Microsoft
2010-03-26 21:47 . 2010-03-26 21:47 -------- d-----w- c:\program files\Windows Live
2010-03-17 09:38 . 2010-03-17 09:38 -------- d-----w- c:\program files\Heroes III
2010-03-14 16:46 . 2010-03-14 17:09 -------- d-----w- c:\program files\Left4Dead
2010-03-10 02:01 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-10 02:01 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-03-10 02:01 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-04 17:57 . 2010-03-27 12:52 -------- d-----w- c:\program files\Left 4 Dead 2
2010-03-02 15:42 . 2010-03-02 15:42 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-02 15:38 . 2010-03-02 15:38 -------- d-----w- c:\program files\505games
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-30 21:16 . 2009-10-11 19:12 -------- d-----w- c:\users\Sieg\AppData\Roaming\uTorrent
2010-03-30 11:30 . 2006-11-02 15:48 669566 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-30 11:30 . 2006-11-02 15:48 123556 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-30 09:11 . 2009-10-12 21:32 125672 ----a-w- c:\programdata\nvModes.dat
2010-03-28 21:30 . 2010-01-08 12:54 -------- d-----w- c:\program files\Steam
2010-03-16 12:36 . 2010-01-08 12:54 -------- d-----w- c:\program files\Common Files\Steam
2010-03-10 02:05 . 2009-10-28 20:00 -------- d-----w- c:\programdata\Microsoft Help
2010-02-24 08:30 . 2009-10-11 19:13 319280 ----a-w- c:\users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uTorrent.exe
2010-02-23 17:59 . 2010-02-23 17:59 -------- d-----w- c:\users\Sieg\AppData\Roaming\The Creative Assembly
2010-02-23 17:59 . 2010-02-23 17:27 -------- d-----w- c:\program files\Empire Total War
2010-02-22 12:12 . 2010-02-22 12:12 -------- d-----w- c:\programdata\BC
2010-02-22 12:11 . 2009-10-12 21:28 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-22 12:11 . 2010-02-22 12:11 -------- d-----w- c:\program files\OpenAL
2010-02-22 12:11 . 2010-02-22 12:11 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-22 12:11 . 2010-02-22 12:11 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-22 12:01 . 2010-02-22 12:01 -------- d-----w- c:\program files\Capcom
2010-02-22 12:01 . 2009-10-12 17:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-19 11:11 . 2010-02-19 11:11 -------- d-----w- c:\program files\Anuman Interactive
2010-02-12 10:32 . 2010-02-26 02:00 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-02-11 17:33 . 2010-02-11 17:33 -------- d-----w- c:\users\Sieg\AppData\Roaming\XRay Engine
2010-02-11 17:24 . 2010-02-11 17:24 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-11 17:10 . 2010-02-11 17:10 -------- d-----w- c:\program files\bitComposer Games
2010-02-10 12:56 . 2010-02-10 12:56 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-23 09:26 . 2010-02-23 23:41 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-06 11:10 . 2009-10-11 16:37 99864 ----a-w- c:\users\Sieg\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-02 06:38 . 2010-01-22 05:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 05:58 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 05:58 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 05:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-03-29_21.14.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-11-27 19:13 . 2010-03-29 08:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-27 19:13 . 2010-03-30 11:25 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-11-27 19:13 . 2010-03-29 08:57 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-11-27 19:13 . 2010-03-30 11:25 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-11-27 19:13 . 2010-03-29 08:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-11-27 19:13 . 2010-03-30 11:25 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-10-18 08:40 . 2010-03-30 11:09 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-10-18 08:40 . 2010-03-27 03:16 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-11 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"Steam"="c:\program files\Steam\Steam.exe" [2010-02-24 1217872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13793824]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
c:\users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
uTorrent.exe [2010-2-24 319280]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Mega Manager.lnk - c:\program files\Megaupload\Mega Manager\MegaManager.exe [2009-11-5 1961984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):6b,ad,ed,f9,42,53,ca,01
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-10-21 721904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contenu du dossier 'Tâches planifiées'
2010-03-30 c:\windows\Tasks\User_Feed_Synchronization-{33EB9D8B-57E0-4D33-8102-0764AF33DF5F}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.facebook.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
FF - ProfilePath - c:\users\Sieg\AppData\Roaming\Mozilla\Firefox\Profiles\0cvue4jy.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-30 23:19
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-520997026-2530013781-3910746367-1000\Software\SecuROM\License information*]
"datasecu"=hex:e3,68,ef,b4,06,02,0a,7d,1f,33,82,da,e6,d9,a3,87,ef,4d,7c,ac,9b,
ea,19,82,79,59,be,cc,21,c4,51,c9,fb,8c,e3,c2,fd,4a,26,be,82,da,39,ed,ef,da,\
"rkeysecu"=hex:a4,1d,97,a5,7a,b3,cd,5c,8b,1c,fb,d7,49,94,bc,57
.
Heure de fin: 2010-03-30 23:21:39
ComboFix-quarantined-files.txt 2010-03-30 21:21
ComboFix2.txt 2010-03-29 21:16
Avant-CF: 37 058 985 984 octets libres
Après-CF: 37 045 223 424 octets libres
- - End Of File - - D851882BB8E96D9D7A138FF0E6FDAADC
voila le rapport. concernant mes soucis depuis que j'ai lancé comboFix hier je n'ai plus eu de probleme sur msn. je ne sais pas s'il est trop tot pour se rejouir mais j'ai l'impression que c'est gagné ^^ si demain je n'ai pas de retour je pense qu'on pourra dire que la menace a été écarté ^^. je te remerci d'ailleur une fois de plus pour avoir utilisé ton temps et ton savoir pour m'aider. d'ailleur mon amis qui m'a refilé le virus doit faire la meme manoeuvre que moi pour s'en debarrasser ?
ComboFix 10-03-29.01 - Sieg 30/03/2010 23:14:36.2.2 - x86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3062.1815 [GMT 2:00]
Lancé depuis: c:\users\Sieg\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Sieg\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FILE ::
"C:\lksdjf.exe"
"c:\users\Sieg\AppData\Roaming\Drivers.exe"
"c:\users\Sieg\AppData\Roaming\uTorrent\Forest Gump (1994) DVD-Rip BivX (FR-ENG) Titanic Team\bsplayer223.953_clip.exe"
"c:\windows\system32\qwdijiojdf.tmp"
"c:\windows\system32\qweweuu38.tmp"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\lksdjf.exe
c:\users\Sieg\AppData\Roaming\Drivers.exe
c:\users\Sieg\AppData\Roaming\uTorrent\Forest Gump (1994) DVD-Rip BivX (FR-ENG) Titanic Team\bsplayer223.953_clip.exe
c:\windows\system32\qwdijiojdf.tmp
c:\windows\system32\qweweuu38.tmp
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-28 au 2010-03-30 ))))))))))))))))))))))))))))))))))))
.
2010-03-30 21:19 . 2010-03-30 21:19 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-03-30 21:19 . 2010-03-30 21:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-03-30 20:46 . 2010-03-30 20:46 0 ----a-w- c:\windows\nsreg.dat
2010-03-30 20:46 . 2010-03-30 20:46 -------- d-----w- c:\users\Sieg\AppData\Local\Mozilla
2010-03-29 21:16 . 2010-03-30 21:19 -------- d-----w- c:\users\Sieg\AppData\Local\temp
2010-03-29 18:12 . 2010-03-29 19:22 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-03-29 18:12 . 2010-03-29 18:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\users\Sieg\AppData\Roaming\Malwarebytes
2010-03-27 10:19 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 10:19 . 2010-03-27 10:19 -------- d-----w- c:\programdata\Malwarebytes
2010-03-27 10:19 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-27 10:03 . 2010-03-27 10:04 -------- d-----w- c:\program files\trend micro
2010-03-27 10:03 . 2010-03-27 10:04 -------- d-----w- C:\rsit
2010-03-27 09:18 . 2010-03-27 09:18 -------- d-----w- c:\program files\AxBx
2010-03-26 21:47 . 2010-03-26 21:47 -------- d-----w- c:\program files\Microsoft
2010-03-26 21:47 . 2010-03-26 21:47 -------- d-----w- c:\program files\Windows Live
2010-03-17 09:38 . 2010-03-17 09:38 -------- d-----w- c:\program files\Heroes III
2010-03-14 16:46 . 2010-03-14 17:09 -------- d-----w- c:\program files\Left4Dead
2010-03-10 02:01 . 2010-02-20 23:06 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-03-10 02:01 . 2010-02-20 23:05 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-03-10 02:01 . 2010-02-20 20:53 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-03-04 17:57 . 2010-03-27 12:52 -------- d-----w- c:\program files\Left 4 Dead 2
2010-03-02 15:42 . 2010-03-02 15:42 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-02 15:38 . 2010-03-02 15:38 -------- d-----w- c:\program files\505games
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-30 21:16 . 2009-10-11 19:12 -------- d-----w- c:\users\Sieg\AppData\Roaming\uTorrent
2010-03-30 11:30 . 2006-11-02 15:48 669566 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-30 11:30 . 2006-11-02 15:48 123556 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-30 09:11 . 2009-10-12 21:32 125672 ----a-w- c:\programdata\nvModes.dat
2010-03-28 21:30 . 2010-01-08 12:54 -------- d-----w- c:\program files\Steam
2010-03-16 12:36 . 2010-01-08 12:54 -------- d-----w- c:\program files\Common Files\Steam
2010-03-10 02:05 . 2009-10-28 20:00 -------- d-----w- c:\programdata\Microsoft Help
2010-02-24 08:30 . 2009-10-11 19:13 319280 ----a-w- c:\users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uTorrent.exe
2010-02-23 17:59 . 2010-02-23 17:59 -------- d-----w- c:\users\Sieg\AppData\Roaming\The Creative Assembly
2010-02-23 17:59 . 2010-02-23 17:27 -------- d-----w- c:\program files\Empire Total War
2010-02-22 12:12 . 2010-02-22 12:12 -------- d-----w- c:\programdata\BC
2010-02-22 12:11 . 2009-10-12 21:28 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-22 12:11 . 2010-02-22 12:11 -------- d-----w- c:\program files\OpenAL
2010-02-22 12:11 . 2010-02-22 12:11 418480 ----a-w- c:\windows\system32\wrap_oal.dll
2010-02-22 12:11 . 2010-02-22 12:11 115432 ----a-w- c:\windows\system32\OpenAL32.dll
2010-02-22 12:01 . 2010-02-22 12:01 -------- d-----w- c:\program files\Capcom
2010-02-22 12:01 . 2009-10-12 17:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-19 11:11 . 2010-02-19 11:11 -------- d-----w- c:\program files\Anuman Interactive
2010-02-12 10:32 . 2010-02-26 02:00 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-02-11 17:33 . 2010-02-11 17:33 -------- d-----w- c:\users\Sieg\AppData\Roaming\XRay Engine
2010-02-11 17:24 . 2010-02-11 17:24 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-11 17:10 . 2010-02-11 17:10 -------- d-----w- c:\program files\bitComposer Games
2010-02-10 12:56 . 2010-02-10 12:56 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-23 09:26 . 2010-02-23 23:41 2048 ----a-w- c:\windows\system32\tzres.dll
2010-01-06 11:10 . 2009-10-11 16:37 99864 ----a-w- c:\users\Sieg\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-02 06:38 . 2010-01-22 05:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 05:58 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 05:58 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 05:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-03-29_21.14.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-11-27 19:13 . 2010-03-29 08:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-27 19:13 . 2010-03-30 11:25 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-11-27 19:13 . 2010-03-29 08:57 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-11-27 19:13 . 2010-03-30 11:25 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-11-27 19:13 . 2010-03-29 08:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-11-27 19:13 . 2010-03-30 11:25 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-10-18 08:40 . 2010-03-30 11:09 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-10-18 08:40 . 2010-03-27 03:16 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-11 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"Steam"="c:\program files\Steam\Steam.exe" [2010-02-24 1217872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13793824]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
c:\users\Sieg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
uTorrent.exe [2010-2-24 319280]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Mega Manager.lnk - c:\program files\Megaupload\Mega Manager\MegaManager.exe [2009-11-5 1961984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):6b,ad,ed,f9,42,53,ca,01
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-10-21 721904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contenu du dossier 'Tâches planifiées'
2010-03-30 c:\windows\Tasks\User_Feed_Synchronization-{33EB9D8B-57E0-4D33-8102-0764AF33DF5F}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.facebook.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Liens de téléchargement avec Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
FF - ProfilePath - c:\users\Sieg\AppData\Roaming\Mozilla\Firefox\Profiles\0cvue4jy.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-30 23:19
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-520997026-2530013781-3910746367-1000\Software\SecuROM\License information*]
"datasecu"=hex:e3,68,ef,b4,06,02,0a,7d,1f,33,82,da,e6,d9,a3,87,ef,4d,7c,ac,9b,
ea,19,82,79,59,be,cc,21,c4,51,c9,fb,8c,e3,c2,fd,4a,26,be,82,da,39,ed,ef,da,\
"rkeysecu"=hex:a4,1d,97,a5,7a,b3,cd,5c,8b,1c,fb,d7,49,94,bc,57
.
Heure de fin: 2010-03-30 23:21:39
ComboFix-quarantined-files.txt 2010-03-30 21:21
ComboFix2.txt 2010-03-29 21:16
Avant-CF: 37 058 985 984 octets libres
Après-CF: 37 045 223 424 octets libres
- - End Of File - - D851882BB8E96D9D7A138FF0E6FDAADC
Bonjour
non, une infection ne fait pas l'autre, le script a été rédigé pour toi....
désinstalle Spybot - Search & Destroy , ce logiciel est obsolète...
suis ce tuto et poste le rapport généré stp:
http://www.bibou0007.com/scans-en-ligne-f75/tutorial-es...
Citation :
d'ailleur mon amis qui m'a refilé le virus doit faire la meme manoeuvre que moi pour s'en debarrasser ? non, une infection ne fait pas l'autre, le script a été rédigé pour toi....
désinstalle Spybot - Search & Destroy , ce logiciel est obsolète...
suis ce tuto et poste le rapport généré stp:
http://www.bibou0007.com/scans-en-ligne-f75/tutorial-es...
Lassé par la pub ? Créez un compte
- Contenus similaires :
- ForumTelecharger windows live messenger sans virus
- ForumSupprimer virus windows live messenger
- ForumVirus sur windows live messenger 2
- ForumVirus dans windows live messenger
- solutionsVirus trojan par windows live messenger
- ForumWindows live messenger. virus
- ForumVirus windows live messenger 2011
- ForumVirus windows live messenger hotmail
- downloadVirus avec windows live messenger
- ForumVirus windows live messenger
- Voir plus
