Win32.TrojanDownloader.Agent

Question

Bonjour,

Je viens de perdre tout mon post (20min de rédaction), car j'ai de gros doigts, donc j'irai droit au but cette fois.
D'habitude je me débrouille seul, mais ici je patine un peu donc je viens faire appel à l'aide des experts qui rôdent par ici ;)

Symptômes : 

- Différents process plutôt louches : 

   * Avec des nom aléatoires composé de six chiffres (ex : 570293)
   * Plusieurs "cmd.exe" qui consomment bcp de ressources CPU
   * "iexplorer.exe" lancé sans qu'aucune fenêtre IE soit ouverte (je n'utilise jamais IE)

- Des Alt-Tab spontannés lorsque je joue par exemple. Le jeu bascule sous Windows sans que je lui demande.

- L'interface Windows qui ne répond plus correctement :

   * Le menu démarrer apparait mes les sous-menus et les boutons ne sont pas actifs
   * Les icônes quicklaunch ne fonctionnent pas malgré le fait qu'il s'animent quand je clique dessus.

- Un programme "Yiqilai Lyrics" apparemment chinois qui s'installe tout seul, se lance parfois en tant que process, et semble impossible à désinstaller par voie normale. 

Les diagnostiques des Antispyware : 

Spypot : Il me trouve différentes choses que je supprime à chaque fois mais celà ne règle pas les problèmes.
Le résident Spybot Teatimer, me détecte souvent (au boot le plus souvent) bcp de modifications de registre, des valeurs ajoutées, des valeurs supprimées, que je refuse systématiquement.

Ad-Aware : Il me trouve un Virus (TAI 10) Win32.TrojanDownloader.Agent et d'autres joyeuseté commd es Redirected Hostfile Entries impossibles à supprimer. J'ai beau tout supprimer, celà revient toujours...

Regcleaner : J'ai effectué des nettoyages auto avec ce soft en me disant que ça pouvait être utile, je l'ai aussi utilisé pour virer les éléments yiqilai.com impossibles à supprimer autrement, de la liste des programmes installés notemment. Sans succès ça revient sans cesse aussi.

En desespoir de cause j'ai essayé d'installer Avast (Free Version), mais une erreur critique a lieu au milieu de l'installation. Ca sent le foin tout ça ! :)

J'ai effectué un scan online avec l'outils Symantec qui m'a trouvé ceci : 

D:\Brikbrok\Bourdel de Grouik\Outils Utils Logs\Cleaning\CWShredder.exe is infected with Adware.Websearch  
C:\WINDOWS\system32\antiwpa.dll is infected with Hacktool  
C:\WINDOWS\system32\msporc.dll is infected with Backdoor.Graybird  
C:\WINDOWS\system32\xmlhlpdat.dll is infected with Downloader 

Comme un gros bourrin je me suis dit que les 2 premiers listés étaient "normaux" (hum) et j'ai donc virés les deux derniers listés à la mains sans passer par la corbeille....

Bref, avant de reformater l'ensemble, je viens donc poster ici mon log Hijackthis avec un dernier espoir de sauver ce système bien rempli, sans backup qui est le miens : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:15:47, on 16/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Razer\Copperheadazerhid.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\RivaTuner v2.06 test 6\RivaTuner.exe
C:\WINDOWS\system32	askmagr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Razer\Copperheadazertra.exe
C:\Program Files\Razer\Copperheadazerofa.exe
C:\WINDOWS\ALCFDRTM.EXE
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Brikbrok\Bourdel de Grouik\Outils Utils Logs\Hijackthis\HiJackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bradsoft.com/
O1 - Hosts: 60.173.10.243 www.sznews.com
O1 - Hosts: 60.173.10.243 www.baidu.com
O1 - Hosts: 60.173.10.243 www.idoer.org
O1 - Hosts: 60.173.10.243 baidu.com
O1 - Hosts: 60.173.10.243 www.lhgz.com.cn
O1 - Hosts: 60.173.10.243 qq123.d189.5kweb.cn
O1 - Hosts: 60.173.10.243 www.taxexpert.com.cn
O1 - Hosts: 60.173.10.243 web.szds.gov.cn
O1 - Hosts: 60.173.10.243 www.szgs.gov.cn
O1 - Hosts: 60.173.10.243 www.szds.gov.cn
O1 - Hosts: 60.173.10.243 www.qz315.cn
O1 - Hosts: 60.173.10.243 www.315safe.com
O1 - Hosts: 60.173.10.243 www.315.gov.cn
O1 - Hosts: 60.173.10.243 www.315wm.com
O1 - Hosts: 60.173.10.243 www.ca315.com.cn
O1 - Hosts: 60.173.10.243 www.315ts.net
O1 - Hosts: 60.173.10.243 szgz.gov.cn
O1 - Hosts: 60.173.10.243 www.szgz.gov.cn
O1 - Hosts: 60.173.10.243 wenwen.soso.com
O1 - Hosts: 60.173.10.243 qbar.qq.com
O1 - Hosts: 60.173.10.243 imsafe.qq.com
O1 - Hosts: 60.173.10.243 service.qq.com
O1 - Hosts: 127.0.0.2 ymsdasdw1.cn
O1 - Hosts: 127.0.0.3 h96b.info
O1 - Hosts: 127.0.0.0 www.bypk.com
O1 - Hosts: 127.0.0.2 bnasnd83nd.cn
O1 - Hosts: 127.0.0.0 www.gamehacker.com.cn
O1 - Hosts: 127.0.0.0 gamehacker.com.cn
O1 - Hosts: 127.0.0.3 adlaji.cn
O1 - Hosts: 127.1.1.1 bnasnd83nd.cn
O1 - Hosts: 127.1.1.1 555.hfdy2828.com
O1 - Hosts: 127.1.1.1 666.hfdy2828.com
O1 - Hosts: 127.0.1.1 59.34.216.143
O1 - Hosts: 127.0.0.0 user1.12-27.net
O1 - Hosts: 127.0.0.0 fengent.cn
O1 - Hosts: 127.0.0.0 www.sony888.cn
O1 - Hosts: 127.0.0.0 user1.asp-33.cn
O1 - Hosts: 127.0.0.0 www.netkwek.cn
O1 - Hosts: 127.0.0.0 ymsdkad6.cn
O1 - Hosts: 127.0.0.0 www.lkwueir.cn
O1 - Hosts: 127.0.1.1 user1.23-17.net
O1 - Hosts: 127.0.0.0 upa.luzhiai.net
O1 - Hosts: 127.0.0.0 www.guccia.net
O1 - Hosts: 127.0.0.0 4m9mnlmi.cn
O1 - Hosts: 127.0.0.0 mm119mkssd.cn
O1 - Hosts: 127.0.0.0 61.128.171.115:8080
O1 - Hosts: 127.0.0.0 www.1119111.com
O1 - Hosts: 127.0.0.0 win.nihao69.cn
O1 - Hosts: 127.0.0.0 puc.lianxiac.net
O1 - Hosts: 127.0.0.0 pud.lianxiac.net
O1 - Hosts: 127.0.0.0 210.76.0.133
O1 - Hosts: 127.0.0.0 61.166.32.2
O1 - Hosts: 127.0.0.0 218.92.186.27
O1 - Hosts: 127.0.0.0 www.fsfsfag.cn
O1 - Hosts: 127.0.0.0 ovo.ovovov.cn
O1 - Hosts: 127.0.0.0 dw.com.com
O1 - Hosts: 127.0.0.0 t.myblank.cn
O1 - Hosts: 127.0.0.0 x.myblank.cn
O1 - Hosts: 127.0.0.0 qq-xing.com.cn
O1 - Hosts: 127.0.0.0 59.125.231.177:17777
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E5CEEDA-BC3A-4624-B932-F6025E979E74} - C:\Program Files\Internet Explorer\Rsentz.z91
O2 - BHO: Skype Control Class - {9018F6A8-2495-45DF-9F16-C738F8F3C8FF} - C:\WINDOWS\system32\SkypeComm.dll
O2 - BHO: (no name) - {A95083BE-3D1F-4C7E-ACCC-EC11EA9D498A} - C:\Program Files\Internet Explorer\UfzsKetNt.Ps3
O2 - BHO: JavaSunSurf Class - {AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8} - C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2263.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperheadazerhid.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.06 test 6\RivaTuner.exe" /S
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.06 test 6\RivaTuner.exe" /T
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [Alcmtr] anymie360.exe
O4 - HKLM\..\Policies\Explorer\Run: [qq] C:\DOCUME~1\Rob\LOCALS~1\Temp\585143
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-57989841-1547161642-839522115-500\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ghjmecno.dll,fghhmibe.dll,HBZHUXIAN.dll,HBWULIN2.dll,clafgnfi.dll,HBCHIBI.dll,HBTW2.dll,kfccmajk.dll,oephnmak.dll,mbhckeig.dll,bcjockjc.dll,lihlofaa.dll,baicmhnc.dll,nciimnic.dll,mocndgba.dll,aifkojnj.dll,pabcfphe.dll,enjlenil.dll,fcpikjee.dll,aeipdhak.dll,annghdlg.dll,phceafjl.dll,dobggkmb.dll,cpodliio.dll,ejjmdefk.dll,okodmlfk.dll,ogkmggdk.dll,bhdndaak.dll,enikimgp.dll,jakgkbni.dll,lakhhbfb.dll,mnpadelo.dll,dnhbcijo.dll,okniockd.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: 0136EC78 - {0136EC78-845D-4103-9AE7-D2F4A860E300} - C:\WINDOWS\system32\ghjmecno.dll
O21 - SSODL: C5AF07F2 - {C5AF07F2-0D18-4A52-B4F2-400B29ACC637} - C:\WINDOWS\system32\clafgnfi.dll
O21 - SSODL: F01162BE - {F01162BE-F75D-491D-B46F-0632164B9316} - C:\WINDOWS\system32\fghhmibe.dll
O21 - SSODL: 4FCC6A34 - {4FCC6A34-49C7-49CD-8457-8746ABBA4A2C} - C:\WINDOWS\system32\kfccmajk.dll
O21 - SSODL: 8E9176A4 - {8E9176A4-9C94-4A16-8843-6F42B0C78960} - C:\WINDOWS\system32\oephnmak.dll
O21 - SSODL: 6B1C4E20 - {6B1C4E20-030E-4757-BF0D-7E410C9AA51B} - C:\WINDOWS\system32\mbhckeig.dll
O21 - SSODL: BC38C43C - {BC38C43C-7319-4C56-BA61-F80F53C65E20} - C:\WINDOWS\system32\bcjockjc.dll
O21 - SSODL: 52158FAA - {52158FAA-7FCA-476C-BFA3-7C135676D905} - C:\WINDOWS\system32\lihlofaa.dll
O21 - SSODL: 187E16CA - {187E16CA-29F2-4046-A428-206164E2A8C4} - (no file)
O21 - SSODL: 7A87C5DA - {7A87C5DA-D26B-44E6-8711-515321418E13} - (no file)
O21 - SSODL: 56CE52F4 - {56CE52F4-B5E3-436A-BA04-2B672A02CDDF} - (no file)
O21 - SSODL: B23266BE - {B23266BE-D020-4C59-B3DB-E6956B752606} - (no file)
O21 - SSODL: 467FB717 - {467FB717-837B-4DE7-9A5E-2B42A353CA4C} - (no file)
O21 - SSODL: 7995C461 - {7995C461-CCA7-46F8-9505-4D7EF0C8466A} - (no file)
O21 - SSODL: 3AFE8CF1 - {3AFE8CF1-9392-4665-8D5A-775B1ABA7F7E} - (no file)
O21 - SSODL: 0D792E9D - {0D792E9D-54A8-4F79-962D-36E51BDBED94} - (no file)
O21 - SSODL: C6FB199A - {C6FB199A-846C-46FA-8FDF-5CCFEE779021} - (no file)
O21 - SSODL: 16913F10 - {16913F10-8C46-49E5-BFD4-F9EC3206305D} - (no file)
O21 - SSODL: 99EB4268 - {99EB4268-07D0-48C3-B334-163EB5521716} - (no file)
O21 - SSODL: D6C1A116 - {D6C1A116-B833-4F4F-871C-FDBE2E0C173E} - (no file)
O21 - SSODL: BA2C617C - {BA2C617C-AA42-46DD-81A9-0210EB00B285} - C:\WINDOWS\system32\baicmhnc.dll
O21 - SSODL: 9ABCF91E - {9ABCF91E-55D2-4A3D-AAFE-4C8789383B60} - C:\WINDOWS\system32\pabcfphe.dll
O21 - SSODL: A2F48373 - {A2F48373-0D34-4321-96B8-0C101AB0A261} - C:\WINDOWS\system32\aifkojnj.dll
O21 - SSODL: A829F352 - {A829F352-4FEF-4331-859D-C4A70FEAD4EB} - (no file)
O21 - SSODL: 336A0EC4 - {336A0EC4-EB82-41D7-997D-C89A11AE5DE5} - (no file)
O21 - SSODL: EF6447A6 - {EF6447A6-3A93-47C8-B898-13B7E069CF0C} - (no file)
O21 - SSODL: 1B9B0C3C - {1B9B0C3C-A0B5-4434-97CB-6BB1E64F6264} - (no file)
O21 - SSODL: 96EB6C46 - {96EB6C46-DFD9-45CA-87C5-500F86EC5BE0} - (no file)
O21 - SSODL: 9160D308 - {9160D308-DD6D-4C86-ADB8-2C5D509AF220} - (no file)
O21 - SSODL: FC9243EE - {FC9243EE-227E-4D9A-BB29-117EAFA860E7} - C:\WINDOWS\system32\fcpikjee.dll
O21 - SSODL: E735E725 - {E735E725-8B86-4775-887F-8311D6097AC4} - C:\WINDOWS\system32\enjlenil.dll
O21 - SSODL: 91CEAF35 - {91CEAF35-F8D6-4BC7-AA59-5E614D52AC4F} - C:\WINDOWS\system32\phceafjl.dll
O21 - SSODL: A7701D50 - {A7701D50-1C46-45D1-8CDB-F4EDBF4912CF} - C:\WINDOWS\system32\annghdlg.dll
O21 - SSODL: AE29D1A4 - {AE29D1A4-67F7-48D8-96B0-2E614BEDB740} - C:\WINDOWS\system32\aeipdhak.dll
O21 - SSODL: 84728C4D - {84728C4D-298B-4FC5-A783-57DECD9C2AA6} - C:\WINDOWS\system32\okniockd.dll
O21 - SSODL: 68C7D0BA - {68C7D0BA-D10A-4B81-A366-3DBE3CD7D821} - C:\WINDOWS\system32\mocndgba.dll
O21 - SSODL: 7C22672C - {7C22672C-BE49-42FE-A0A5-05F88DDA8E0F} - C:\WINDOWS\system32
ciimnic.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2.2 - Apache Software Foundation - D:\xampplite\apache\bin\apache.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: mysql - Unknown owner - D:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

V-X · Answer

Salut,

&#x25B6 Installe - Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31)

&#x25B6 Option:1 => Recherche:

&#x25B6  Double cliquer sur SmitfraudFix.exe
    
&#x25B6 Sélectionner 1 et pressez =>Entrée dans le menu pour créer 

&#x25B6 un rapport des fichiers responsables de l'infection. Le rapport se trouve à la racine du disque 

système 

&#x25B6 C:\rapport.txt et colle le rapport génèrer sur le forum.

&#x25B6 Ne pas faire l'option 2 sans un avis d'une personne compétente*<=


Tutoriel Smitfraudix

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

winow · Answer

Purée, t'es verni de virus
Poste ton MSG dans la bonne section : http://www.commentcamarche.net/forum/forum 7 virus securite

V-X · Answer

Re,

Continue ici et t'inquiète pas pour les autres.

A++

podrob · Answer

Voici le rapport Smitfraud :

SmitFraudFix v2.391

Scan done at 18:03:16,42, 16/01/2009
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Razer\Copperheadazerhid.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\RivaTuner v2.06 test 6\RivaTuner.exe
C:\WINDOWS\system32	askmagr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Razer\Copperheadazertra.exe
C:\Program Files\Razer\Copperheadazerofa.exe
C:\WINDOWS\ALCFDRTM.EXE
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Rob


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Rob\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Rob\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\config\SYSTEM~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="ghjmecno.dll,fghhmibe.dll,HBZHUXIAN.dll,HBWULIN2.dll,clafgnfi.dll,HBCHIBI.dll,HBTW2.dll,kfccmajk.dll,oephnmak.dll,mbhckeig.dll,bcjockjc.dll,lihlofaa.dll,baicmhnc.dll,nciimnic.dll,mocndgba.dll,aifkojnj.dll,pabcfphe.dll,enjlenil.dll,fcpikjee.dll,aeipdhak.dll,annghdlg.dll,phceafjl.dll,dobggkmb.dll,cpodliio.dll,ejjmdefk.dll,okodmlfk.dll,ogkmggdk.dll,bhdndaak.dll,enikimgp.dll,jakgkbni.dll,lakhhbfb.dll,mnpadelo.dll,dnhbcijo.dll,okniockd.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Linksys Wireless-G PCI Adapter - Packet Scheduler Miniport
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7A2BC9BE-81C1-4AF4-8C48-540B9F5260E0}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7A2BC9BE-81C1-4AF4-8C48-540B9F5260E0}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F6328742-4187-42BE-8E9A-846B2D57DF65}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS3\Services\Tcpip\..\{7A2BC9BE-81C1-4AF4-8C48-540B9F5260E0}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



Désolé si je suis dans la mauvaise section. Je suis les ordres de V X et je reste ici pour le moment. :)

V-X · Answer

Re,

OKI.

&#x25B6 Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

&#x25B6 Mets le à jour

&#x25B6 Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.

&#x25B6 Sélectionne Exécuter un examen complet si ce n'est pas déjà fait

&#x25B6 clique sur Rechercher

&#x25B6 Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

&#x25B6 Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

&#x25B6 Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

&#x25B6 Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune. 


Tutoriel pour MalwareByte's

podrob · Answer

10min écoulée dans le Scan Malware-Byte, déjà bon nombre d'infections détectées...

Je poste ici dès que c'est terminé, c'est juste pour dire que je ne pars pas :)

V-X · Answer

Re,

OKI.

il en trouveras pas mal croit moi.

Aussi c'est toi qui a modifier les hosts?


O1 - Hosts: 60.173.10.243 www.sznews.com
O1 - Hosts: 60.173.10.243 www.baidu.com
O1 - Hosts: 60.173.10.243 www.idoer.org
O1 - Hosts: 60.173.10.243 baidu.com
O1 - Hosts: 60.173.10.243 www.lhgz.com.cn
O1 - Hosts: 60.173.10.243 qq123.d189.5kweb.cn
O1 - Hosts: 60.173.10.243 www.taxexpert.com.cn
O1 - Hosts: 60.173.10.243 web.szds.gov.cn
O1 - Hosts: 60.173.10.243 www.szgs.gov.cn
O1 - Hosts: 60.173.10.243 www.szds.gov.cn
O1 - Hosts: 60.173.10.243 www.qz315.cn
O1 - Hosts: 60.173.10.243 www.315safe.com
O1 - Hosts: 60.173.10.243 www.315.gov.cn
O1 - Hosts: 60.173.10.243 www.315wm.com
O1 - Hosts: 60.173.10.243 www.ca315.com.cn
O1 - Hosts: 60.173.10.243 www.315ts.net
O1 - Hosts: 60.173.10.243 szgz.gov.cn
O1 - Hosts: 60.173.10.243 www.szgz.gov.cn
O1 - Hosts: 60.173.10.243 wenwen.soso.com
O1 - Hosts: 60.173.10.243 qbar.qq.com
O1 - Hosts: 60.173.10.243 imsafe.qq.com
O1 - Hosts: 60.173.10.243 service.qq.com
O1 - Hosts: 127.0.0.2 ymsdasdw1.cn
O1 - Hosts: 127.0.0.3 h96b.info
O1 - Hosts: 127.0.0.0 www.bypk.com
O1 - Hosts: 127.0.0.2 bnasnd83nd.cn
O1 - Hosts: 127.0.0.0 www.gamehacker.com.cn
O1 - Hosts: 127.0.0.0 gamehacker.com.cn
O1 - Hosts: 127.0.0.3 adlaji.cn
O1 - Hosts: 127.1.1.1 bnasnd83nd.cn
O1 - Hosts: 127.1.1.1 555.hfdy2828.com
O1 - Hosts: 127.1.1.1 666.hfdy2828.com
O1 - Hosts: 127.0.1.1 59.34.216.143
O1 - Hosts: 127.0.0.0 user1.12-27.net
O1 - Hosts: 127.0.0.0 fengent.cn
O1 - Hosts: 127.0.0.0 www.sony888.cn
O1 - Hosts: 127.0.0.0 user1.asp-33.cn
O1 - Hosts: 127.0.0.0 www.netkwek.cn
O1 - Hosts: 127.0.0.0 ymsdkad6.cn
O1 - Hosts: 127.0.0.0 www.lkwueir.cn
O1 - Hosts: 127.0.1.1 user1.23-17.net
O1 - Hosts: 127.0.0.0 upa.luzhiai.net
O1 - Hosts: 127.0.0.0 www.guccia.net
O1 - Hosts: 127.0.0.0 4m9mnlmi.cn
O1 - Hosts: 127.0.0.0 mm119mkssd.cn
O1 - Hosts: 127.0.0.0 61.128.171.115:8080
O1 - Hosts: 127.0.0.0 www.1119111.com
O1 - Hosts: 127.0.0.0 win.nihao69.cn
O1 - Hosts: 127.0.0.0 puc.lianxiac.net
O1 - Hosts: 127.0.0.0 pud.lianxiac.net
O1 - Hosts: 127.0.0.0 210.76.0.133
O1 - Hosts: 127.0.0.0 61.166.32.2
O1 - Hosts: 127.0.0.0 218.92.186.27
O1 - Hosts: 127.0.0.0 www.fsfsfag.cn
O1 - Hosts: 127.0.0.0 ovo.ovovov.cn
O1 - Hosts: 127.0.0.0 dw.com.com
O1 - Hosts: 127.0.0.0 t.myblank.cn
O1 - Hosts: 127.0.0.0 x.myblank.cn
O1 - Hosts: 127.0.0.0 qq-xing.com.cn
O1 - Hosts: 127.0.0.0 59.125.231.177:17777

podrob · Answer

Euh non pas du tout... Je suppose que ça fait partie du lot des symptômes dont je n'ai pas conscience et que Hijackthis révèle...
Y'a juste Ad-Aware qui me signalait des "Redirected Hostfiles Entries" avec un TAI 4 et surtout impossible à corriger via Ad-aware...

Au niveau de mon accès web, je suis dans un immeuble ou il y a une connection Wifi communautaire. Elle est distribuée via des accès-point D-Link à chaque étage, et moi je la relaye via un répéteur D-Link (non je n'affectionne pas cette marque, j'ai choisi le répéteur car l'AP était certifiée compatible avec ce dernier...).

Je suppose, depuis deux ans maintenant, qu'il y a un routeur à la source de cette connection qui joue le rôle de Firewall. Si ce n'est pas le cas, je comprends mieux pourquoi je suis victime de tous ces parasites, puisque je n'ai ni AV, ni FW...

V-X · Answer

Re,

Oui sa j'ai vue mais bon......

Ensuite je te donnerais un antivirus gratuit et assez efficace.

Et tu pourras supprimer AD-AWARE et je te conseil de garder malwarebyte et ensuite tu passeras sa et tu redémarras ton pc.

&#x25B6 Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
CCLEANER

&#x25B6 Lance-le. Va dans "Options" puis "Avancé",
 
&#x25B6 Tu décoches la case "Effacer uniquement les fichiers etc...". 

&#x25B6 Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage.

&#x25B6 Tu vas dans "Registre", tu fais "Chercher des erreurs". 

Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

&#x25B6 Un tuto ( aide )

podrob · Answer

Oki, 

Le scan Malware Byte est toujours en cours (3 disques plutôt gros et remplis...). 

J'ai installé CCleaner hier, lancé l'analyse mais sans décocher quoique ce soit. Je suivrai tes instructions dès que le scan sera terminé.
Je post ici dès que c'est fait.

Merci pour ton aide en tout cas.

podrob · Answer

Re ! 
Malware Byte a terminé le scan, je te copie le rapport ci-après. Cependant il a planté lors de la correction des problèmes... 
Il est toujours freezed en ce moment même, je laisse mijoter au cas ou mais ça semble mal embarqué.

Le rapport : 

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1654
Windows 5.1.2600 Service Pack 2

16/01/2009 19:30:12
mbam-log-2009-01-16 (19-30-07).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 181886
Temps écoulé: 1 hour(s), 12 minute(s), 2 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 7
Clé(s) du Registre infectée(s): 16
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 11
Fichier(s) infecté(s): 52

Processus mémoire infecté(s):
C:\WINDOWS\system32	askmagr.exe (Trojan.Agent) -> No action taken.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\csrss.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\antiwpa.dll (Trojan.I.Stole.Windows) -> No action taken.
C:\WINDOWS\system32\HBWULIN2.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\HBZHUXIAN.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\HBCHIBI.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\HBTW2.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2263.dll (Adware.CPush) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\mewbodomediapop.popbodo (Trojan.Clicker) -> No action taken.
HKEY_CLASSES_ROOT\mewbodomediapop.popbodo.1 (Trojan.Clicker) -> No action taken.
HKEY_CLASSES_ROOT\mewvadpopup.btlogc (Trojan.Clicker) -> No action taken.
HKEY_CLASSES_ROOT\mewvadpopup.btlogc.1 (Trojan.Clicker) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{f9ba1aa9-cad4-4c14-bde6-922dff5f6f38} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7dbc6adb-5788-4fb9-aec3-b40a58ac11df} (Adware.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\yiqilailyrics (Trojan.Agent) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{e2a9e2a8-5471-43f8-ab1b-b7a400db606a} (Trojan.Agent) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e44ff3e0-1d20-4dc3-9048-350f8095d49f} (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msiffei (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\antiwpa (Trojan.I.Stole.Windows) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\apcdli (Adware.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\Effects\YiqilaiLyrics (Adware.Agent) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{aab6c1a0-f3a4-4dac-a922-f82e601e73a8} (Adware.CPush) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{aab6c1a0-f3a4-4dac-a922-f82e601e73a8} (Adware.CPush) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{aab6c1a0-f3a4-4dac-a922-f82e601e73a8} (Adware.CPush) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Alcmtr (Trojan.Agent) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Common Files\PushWare (Adware.CPush) -> No action taken.
C:\Program Files\Yiqilai (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\foobar (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\html (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\iTunes (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\lib (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilaiealplayer (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\Temp (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai	ools (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\winamp (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\wmp (Trojan.Agent) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\system32\anymie360.exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Rob\Temporary Internet Files\Content.IE5\1N3C0V26
ewads21[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Rob\Temporary Internet Files\Content.IE5\1N3C0V26
ewads26[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Rob\Temporary Internet Files\Content.IE5\V2RXCIKJ
ewads28[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Rob\Temporary Internet Files\Content.IE5\V2RXCIKJ
ewads33[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Program Files\Yiqilai\foobar\foo_ui_columns.dll (Adware.Agent) -> No action taken.
C:\Program Files\Yiqilai\Temp\foo_ui_columns.dll (Adware.Agent) -> No action taken.
C:\System Volume Information\_restore{13AE0E2F-3AF2-451D-BE80-32EA3D26F860}\RP384\A0104837.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{13AE0E2F-3AF2-451D-BE80-32EA3D26F860}\RP384\A0104884.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{13AE0E2F-3AF2-451D-BE80-32EA3D26F860}\RP384\A0104889.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{13AE0E2F-3AF2-451D-BE80-32EA3D26F860}\RP384\A0104930.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{13AE0E2F-3AF2-451D-BE80-32EA3D26F860}\RP386\A0105197.dll (Adware.Agent) -> No action taken.
C:\System Volume Information\_restore{13AE0E2F-3AF2-451D-BE80-32EA3D26F860}\RP386\A0105203.dll (Adware.Agent) -> No action taken.
C:\System Volume Information\_restore{13AE0E2F-3AF2-451D-BE80-32EA3D26F860}\RP386\A0105285.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\BZCD7KC8
ewads28[1].exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\BZCD7KC8
ewads33[1].exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\YPIBRYI3
ewads17[1].exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\YPIBRYI3
ewads21[1].exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\YPIBRYI3
ewads26[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Program Files\Common Files\PushWare\cpush.dll (Adware.CPush) -> No action taken.
C:\Program Files\Common Files\PushWare\Uninst.exe (Adware.CPush) -> No action taken.
C:\Program Files\Yiqilai\Uninstall.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\foobar\foo_ui_yqllyrics.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\iTunes\iTunesYQLyrics.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\lib\YQL_Lyrics_Common.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilaiealplayer\RealYQLyrics.rpv (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\Temp\foo_ui_yqllyrics.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\Temp\gen_yqllyrics.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\Temp\iTunesYQLyrics.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\Temp\RealYQLyrics.rpv (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\Temp\vis_yqllyrics.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\Temp\Ò»ÆðÀ´ÒôÀÖÖúÊÖ°ïÖú.url (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai	ools\GetMusic.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai	ools\music.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai	ools\YiqilaiLyrics.exe (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\winamp\gen_yqllyrics.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\winamp\vis_yqllyrics.dll (Trojan.Agent) -> No action taken.
C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\csrss.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\antiwpa.dll (Trojan.I.Stole.Windows) -> No action taken.
C:\WINDOWS\system32	askmagr.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\YQL_Lyrics_Common.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\HBWULIN2.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\HBZHUXIAN.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\HBCHIBI.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\HBTW2.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\System.exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2263.dll (Adware.CPush) -> No action taken.
C:\Documents and Settings\Rob\Favorites\Ò»ÆðÀ´ÒôÀÖÉçÇø.url (Trojan.Agent) -> No action taken.
C:\Documents and Settings\LocalService\Favorites\Ò»ÆðÀ´ÒôÀÖÉçÇø.url (Trojan.Agent) -> No action taken.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\2263.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\cpush.exe (Trojan.Agent) -> No action taken.

Il bloque sur : 

"Mise en quarantaine de C:\Documents and Settings\Rob\Favorites\Ò»ÆðÀ´ÒôÀÖÉçÇø.url (Trojan.Agent)"

*Soupir*

V-X · Answer

Re,

&#x25B6 Ouvre Malwarebyte,

&#x25B6 Clic sur l'onglet Quarantaine,

&#x25B6 Supprime tout ce que la quarantaine contient,

&#x25B6 Si il te propose de redémarrer ton PC =>Accepte

&#x25B6 Si il ne te le propose pas =>Redémarre normalement ton PC

&#x25B6 Poste le rapport suite à la suppression sur le forum.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Et fait ce qui suit.

&#x25B6 Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

&#x25B6 Double clique sur RSIT.exe pour lancer l'outil.

&#x25B6 Clique sur ' continue ' à l'écran Disclaimer.

&#x25B6 Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

&#x25B6 Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

podrob · Answer

J'ai fermé Malware Byte et terminé le nettoyage manuellement, il ne restait que les 4 derniers éléments du log...
En esperant que le plantage n'aie pas annulé la mise en quarantaine du reste...

Je reboot, et je relance un scan sur C: seulement puisqu'il n'y a que là qu'il trouve des crasses...

podrob · Answer

Ok je n'avais pas vu ton message, j'execute ^^

V-X · Answer

Re,

Va dans la quarantaine et supprime tout ce qu'il y a.

Ensuite tu redémarre ton pc et fait le rapport avec RSIT.

podrob · Answer

Waw ça devient vraiment sexy ces rapports ! Voici le rapport RSIT ! je n'ai pas enregistré le rapport Malware Byte après la suppression, donc je suis en train de rescanner C:. Il trouve à nouveau des éléments infectés malgré le nettoyage précédent...

Le rapport RSIT : 

Logfile of random's system information tool 1.05 (written by random/random)
Run by Rob at 2009-01-16 19:48:10
Microsoft Windows XP Professional Service Pack 2
System drive C: has 6 GB (26%) free of 23 GB
Total RAM: 3326 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:17, on 16/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
D:\xampplite\apache\bin\apache.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Java\jre6\bin\jqs.exe
D:\xampplite\mysql\bin\mysqld-nt.exe
D:\xampplite\apache\bin\apache.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Razer\Copperheadazerhid.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\RivaTuner v2.06 test 6\RivaTuner.exe
C:\Program Files\Razer\Copperheadazertra.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Razer\Copperheadazerofa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32	askmagr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\ALCFDRTM.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\Rob\Desktop\RSIT.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
D:\Brikbrok\Bourdel de Grouik\Outils Utils Logs\Hijackthis\Rob.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bradsoft.com/
O1 - Hosts: 60.173.10.243 www.sznews.com
O1 - Hosts: 60.173.10.243 www.baidu.com
O1 - Hosts: 60.173.10.243 www.idoer.org
O1 - Hosts: 60.173.10.243 baidu.com
O1 - Hosts: 60.173.10.243 www.lhgz.com.cn
O1 - Hosts: 60.173.10.243 qq123.d189.5kweb.cn
O1 - Hosts: 60.173.10.243 www.taxexpert.com.cn
O1 - Hosts: 60.173.10.243 web.szds.gov.cn
O1 - Hosts: 60.173.10.243 www.szgs.gov.cn
O1 - Hosts: 60.173.10.243 www.szds.gov.cn
O1 - Hosts: 60.173.10.243 www.qz315.cn
O1 - Hosts: 60.173.10.243 www.315safe.com
O1 - Hosts: 60.173.10.243 www.315.gov.cn
O1 - Hosts: 60.173.10.243 www.315wm.com
O1 - Hosts: 60.173.10.243 www.ca315.com.cn
O1 - Hosts: 60.173.10.243 www.315ts.net
O1 - Hosts: 60.173.10.243 szgz.gov.cn
O1 - Hosts: 60.173.10.243 www.szgz.gov.cn
O1 - Hosts: 60.173.10.243 wenwen.soso.com
O1 - Hosts: 60.173.10.243 qbar.qq.com
O1 - Hosts: 60.173.10.243 imsafe.qq.com
O1 - Hosts: 60.173.10.243 service.qq.com
O1 - Hosts: 127.0.0.2 ymsdasdw1.cn
O1 - Hosts: 127.0.0.3 h96b.info
O1 - Hosts: 127.0.0.0 www.bypk.com
O1 - Hosts: 127.0.0.2 bnasnd83nd.cn
O1 - Hosts: 127.0.0.0 www.gamehacker.com.cn
O1 - Hosts: 127.0.0.0 gamehacker.com.cn
O1 - Hosts: 127.0.0.3 adlaji.cn
O1 - Hosts: 127.1.1.1 bnasnd83nd.cn
O1 - Hosts: 127.1.1.1 555.hfdy2828.com
O1 - Hosts: 127.1.1.1 666.hfdy2828.com
O1 - Hosts: 127.0.1.1 59.34.216.143
O1 - Hosts: 127.0.0.0 user1.12-27.net
O1 - Hosts: 127.0.0.0 fengent.cn
O1 - Hosts: 127.0.0.0 www.sony888.cn
O1 - Hosts: 127.0.0.0 user1.asp-33.cn
O1 - Hosts: 127.0.0.0 www.netkwek.cn
O1 - Hosts: 127.0.0.0 ymsdkad6.cn
O1 - Hosts: 127.0.0.0 www.lkwueir.cn
O1 - Hosts: 127.0.1.1 user1.23-17.net
O1 - Hosts: 127.0.0.0 upa.luzhiai.net
O1 - Hosts: 127.0.0.0 www.guccia.net
O1 - Hosts: 127.0.0.0 4m9mnlmi.cn
O1 - Hosts: 127.0.0.0 mm119mkssd.cn
O1 - Hosts: 127.0.0.0 61.128.171.115:8080
O1 - Hosts: 127.0.0.0 www.1119111.com
O1 - Hosts: 127.0.0.0 win.nihao69.cn
O1 - Hosts: 127.0.0.0 puc.lianxiac.net
O1 - Hosts: 127.0.0.0 pud.lianxiac.net
O1 - Hosts: 127.0.0.0 210.76.0.133
O1 - Hosts: 127.0.0.0 61.166.32.2
O1 - Hosts: 127.0.0.0 218.92.186.27
O1 - Hosts: 127.0.0.0 www.fsfsfag.cn
O1 - Hosts: 127.0.0.0 ovo.ovovov.cn
O1 - Hosts: 127.0.0.0 dw.com.com
O1 - Hosts: 127.0.0.0 t.myblank.cn
O1 - Hosts: 127.0.0.0 x.myblank.cn
O1 - Hosts: 127.0.0.0 qq-xing.com.cn
O1 - Hosts: 127.0.0.0 59.125.231.177:17777
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - (no file)
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E5CEEDA-BC3A-4624-B932-F6025E979E74} - C:\Program Files\Internet Explorer\Rsentz.z91
O2 - BHO: Skype Control Class - {9018F6A8-2495-45DF-9F16-C738F8F3C8FF} - C:\WINDOWS\system32\SkypeComm.dll
O2 - BHO: (no name) - {A95083BE-3D1F-4C7E-ACCC-EC11EA9D498A} - C:\Program Files\Internet Explorer\UfzsKetNt.Ps3
O2 - BHO: JavaSunSurf Class - {AAB6C1A0-F3A4-4DAC-A922-F82E601E73A8} - C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2263.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperheadazerhid.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.06 test 6\RivaTuner.exe" /S
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.06 test 6\RivaTuner.exe" /T
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [Alcmtr] anymie360.exe
O4 - HKLM\..\Policies\Explorer\Run: [qq] C:\DOCUME~1\Rob\LOCALS~1\Temp\585143
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ghjmecno.dll,fghhmibe.dll,HBZHUXIAN.dll,HBWULIN2.dll,clafgnfi.dll,HBCHIBI.dll,HBTW2.dll,kfccmajk.dll,oephnmak.dll,mbhckeig.dll,bcjockjc.dll,lihlofaa.dll,baicmhnc.dll,nciimnic.dll,mocndgba.dll,aifkojnj.dll,enjlenil.dll,fcpikjee.dll,ejjmdefk.dll,bhdndaak.dll,enikimgp.dll,jakgkbni.dll,lakhhbfb.dll,mnpadelo.dll,dnhbcijo.dll,okniockd.dll,gfankmnh.dll,fnigpbdj.dll,gpapcncn.dll,ndofgojk.dll,jofhikdc.dll,gjcajmin.dll,damiklec.dll,olakiplp.dll,npfbafib.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: 0136EC78 - {0136EC78-845D-4103-9AE7-D2F4A860E300} - C:\WINDOWS\system32\ghjmecno.dll
O21 - SSODL: C5AF07F2 - {C5AF07F2-0D18-4A52-B4F2-400B29ACC637} - C:\WINDOWS\system32\clafgnfi.dll
O21 - SSODL: F01162BE - {F01162BE-F75D-491D-B46F-0632164B9316} - C:\WINDOWS\system32\fghhmibe.dll
O21 - SSODL: 4FCC6A34 - {4FCC6A34-49C7-49CD-8457-8746ABBA4A2C} - C:\WINDOWS\system32\kfccmajk.dll
O21 - SSODL: 8E9176A4 - {8E9176A4-9C94-4A16-8843-6F42B0C78960} - C:\WINDOWS\system32\oephnmak.dll
O21 - SSODL: 6B1C4E20 - {6B1C4E20-030E-4757-BF0D-7E410C9AA51B} - C:\WINDOWS\system32\mbhckeig.dll
O21 - SSODL: BC38C43C - {BC38C43C-7319-4C56-BA61-F80F53C65E20} - C:\WINDOWS\system32\bcjockjc.dll
O21 - SSODL: 52158FAA - {52158FAA-7FCA-476C-BFA3-7C135676D905} - C:\WINDOWS\system32\lihlofaa.dll
O21 - SSODL: 187E16CA - {187E16CA-29F2-4046-A428-206164E2A8C4} - (no file)
O21 - SSODL: 7A87C5DA - {7A87C5DA-D26B-44E6-8711-515321418E13} - (no file)
O21 - SSODL: 56CE52F4 - {56CE52F4-B5E3-436A-BA04-2B672A02CDDF} - (no file)
O21 - SSODL: B23266BE - {B23266BE-D020-4C59-B3DB-E6956B752606} - (no file)
O21 - SSODL: 467FB717 - {467FB717-837B-4DE7-9A5E-2B42A353CA4C} - (no file)
O21 - SSODL: 7995C461 - {7995C461-CCA7-46F8-9505-4D7EF0C8466A} - (no file)
O21 - SSODL: 3AFE8CF1 - {3AFE8CF1-9392-4665-8D5A-775B1ABA7F7E} - (no file)
O21 - SSODL: 0D792E9D - {0D792E9D-54A8-4F79-962D-36E51BDBED94} - (no file)
O21 - SSODL: C6FB199A - {C6FB199A-846C-46FA-8FDF-5CCFEE779021} - (no file)
O21 - SSODL: 16913F10 - {16913F10-8C46-49E5-BFD4-F9EC3206305D} - (no file)
O21 - SSODL: 99EB4268 - {99EB4268-07D0-48C3-B334-163EB5521716} - (no file)
O21 - SSODL: D6C1A116 - {D6C1A116-B833-4F4F-871C-FDBE2E0C173E} - (no file)
O21 - SSODL: BA2C617C - {BA2C617C-AA42-46DD-81A9-0210EB00B285} - C:\WINDOWS\system32\baicmhnc.dll
O21 - SSODL: A2F48373 - {A2F48373-0D34-4321-96B8-0C101AB0A261} - C:\WINDOWS\system32\aifkojnj.dll
O21 - SSODL: A829F352 - {A829F352-4FEF-4331-859D-C4A70FEAD4EB} - (no file)
O21 - SSODL: 336A0EC4 - {336A0EC4-EB82-41D7-997D-C89A11AE5DE5} - (no file)
O21 - SSODL: EF6447A6 - {EF6447A6-3A93-47C8-B898-13B7E069CF0C} - (no file)
O21 - SSODL: 1B9B0C3C - {1B9B0C3C-A0B5-4434-97CB-6BB1E64F6264} - (no file)
O21 - SSODL: 96EB6C46 - {96EB6C46-DFD9-45CA-87C5-500F86EC5BE0} - (no file)
O21 - SSODL: 9160D308 - {9160D308-DD6D-4C86-ADB8-2C5D509AF220} - (no file)
O21 - SSODL: FC9243EE - {FC9243EE-227E-4D9A-BB29-117EAFA860E7} - C:\WINDOWS\system32\fcpikjee.dll
O21 - SSODL: E735E725 - {E735E725-8B86-4775-887F-8311D6097AC4} - C:\WINDOWS\system32\enjlenil.dll
O21 - SSODL: 84728C4D - {84728C4D-298B-4FC5-A783-57DECD9C2AA6} - C:\WINDOWS\system32\okniockd.dll
O21 - SSODL: 68C7D0BA - {68C7D0BA-D10A-4B81-A366-3DBE3CD7D821} - C:\WINDOWS\system32\mocndgba.dll
O21 - SSODL: 7C22672C - {7C22672C-BE49-42FE-A0A5-05F88DDA8E0F} - C:\WINDOWS\system32
ciimnic.dll
O21 - SSODL: D71BC238 - {D71BC238-9A93-4DF2-80BC-11EE03EFE7A9} - C:\WINDOWS\system32\dnhbcijo.dll
O21 - SSODL: F7209BD3 - {F7209BD3-9AFB-4236-911A-F7223B1004DD} - C:\WINDOWS\system32\fnigpbdj.dll
O21 - SSODL: 679ADE58 - {679ADE58-CF1C-4F83-82AB-ACBA44BAEE41} - C:\WINDOWS\system32\mnpadelo.dll
O21 - SSODL: 5A411BFB - {5A411BFB-A9FD-4843-B6DE-B9985EE715F4} - C:\WINDOWS\system32\lakhhbfb.dll
O21 - SSODL: 3A404B72 - {3A404B72-9C45-472C-8FF0-9C6994E54EE6} - C:\WINDOWS\system32\jakgkbni.dll
O21 - SSODL: E7242609 - {E7242609-6890-403F-B881-F2AB16C89A1B} - C:\WINDOWS\system32\enikimgp.dll
O21 - SSODL: B1D7DAA4 - {B1D7DAA4-4F05-4B5A-AD72-1AFE14BF0579} - C:\WINDOWS\system32\bhdndaak.dll
O21 - SSODL: E336DEF4 - {E336DEF4-F2F2-4EB7-9DA8-C6496C585154} - C:\WINDOWS\system32\ejjmdefk.dll
O21 - SSODL: 0FA74671 - {0FA74671-1460-4FE0-A271-B417DB3780E3} - C:\WINDOWS\system32\gfankmnh.dll
O21 - SSODL: AE29D1A4 - {AE29D1A4-67F7-48D8-96B0-2E614BEDB740} - (no file)
O21 - SSODL: 09A9C7C7 - {09A9C7C7-4B97-473D-A391-BA402D385D16} - C:\WINDOWS\system32\gpapcncn.dll
O21 - SSODL: 7D8F0834 - {7D8F0834-FE85-4459-875B-934C67B0E728} - C:\WINDOWS\system32
dofgojk.dll
O21 - SSODL: 38F124DC - {38F124DC-8A44-4F12-A314-2BA7F84C1AD5} - C:\WINDOWS\system32\jofhikdc.dll
O21 - SSODL: 03CA3627 - {03CA3627-33AA-4119-880B-EE303C4082F8} - C:\WINDOWS\system32\gjcajmin.dll
O21 - SSODL: DA6245EC - {DA6245EC-140C-4B85-8AA0-1AFDFD469752} - C:\WINDOWS\system32\damiklec.dll
O21 - SSODL: 85A42959 - {85A42959-2836-48C8-9B72-FA4A13718AC5} - C:\WINDOWS\system32\olakiplp.dll
O21 - SSODL: 79FBAF2B - {79FBAF2B-C061-4C5B-89B1-B3EEC9CAF348} - C:\WINDOWS\system32
pfbafib.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2.2 - Apache Software Foundation - D:\xampplite\apache\bin\apache.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: mysql - Unknown owner - D:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

podrob · Answer

Le rapport n°2 : 

info.txt logfile of random's system information tool 1.05 2009-01-16 19:48:19

======Uninstall list======

-->MsiExec /X{45235788-142C-44BE-8A4D-DDE9A84492E5}
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88E5FCB8-5F25-11D5-B16F-0800460222F0}\setup.exe" -l0x40c UNINSTALL
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D76298C2-E532-4A11-BCFF-76F3F19DA84D}\setup.exe" UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3DMark06-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}\setup.exe" -l0x9  -removeonly
abti uGuru-->C:\Program Files\InstallShield Installation Information\{FF8500E6-EA0D-11D7-8755-0080C8F92A32}\setup.exe -runfromtemp -l0x0009 -removeonly
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2-->msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
AGEIA PhysX v7.09.13-->MsiExec.exe /X{45235788-142C-44BE-8A4D-DDE9A84492E5}
Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Arnapou / GWBuildManager-->C:\Program Files\Arnapou\GWBuildManager\uninstall.exe
Assassin's Creed-->C:\Program Files\InstallShield Installation Information\{8CFA9151-6404-409A-AF22-4632D04582FD}\setup.exe -runfromtemp -l0x0009 -removeonly
ATITool Overclocking Utility-->"C:\Program Files\ATITool\Uninstall.exe"
Brother MFL-Pro Suite-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40A6C96D-808E-41DD-8716-617AB6B0F1F1}\Setup.exe" -l0x40c Brunin03.dllBrunin03.dll
Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0409
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Command & Conquer 3-->MsiExec.exe /I{B0C30E93-D3D9-4F04-A2AC-54749B573275}
ConTEXT-->"C:\Program Files\ConTEXT\unins000.exe"
CPU Stress MT 1.0.4-->"C:\Program Files\CPU Stress MT\unins000.exe"
Crysis(R)-->MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4}
Dark Messiah -->C:\Program Files\InstallShield Installation Information\{A8E2EF8F-73EF-4DD8-BB38-31FCCAF50103}\setup.exe -runfromtemp -l0x0009 -removeonly
DC++ 0.705-->"C:\Program Files\DC++\uninstall.exe"
DH Driver Cleaner Professional Edition-->C:\Program Files\Driver Cleaner Pro\Uninstall.exe
Digital Audio Copy for Win32, Version 1.55-->C:\PROGRA~1\WinDAC32\uninst.exe
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EVEREST Ultimate Edition v4.20-->"C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
FileZilla (remove only)-->"C:\Program Files\FileZilla\uninstall.exe"
FlashGet 1.9.6.1073-->C:\Program Files\FlashGet\uninst.exe
Fraps (remove only)-->"C:\Program Files\Fraps\uninstall.exe"
Free Mp3 Wma Converter V 1.6.3-->"C:\Program Files\MP3Converter\unins000.exe"
Future Pinball-->"E:\Games\Future Pinball\unins000.exe"
Get a Life Final v1.0-->"E:\GAMES\VALVE\steamapps\SourceMods\Get_A_Life\unins000.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
GRID-->"C:\Program Files\InstallShield Installation Information\{5A0B7BA5-4682-4273-81C2-69B17E649103}\setup.exe" -runfromtemp -l0x040c -removeonly
GUILD WARS-->"E:\Games\GUILD WARS\Gw.exe" -uninstall
Half-Life 2: Deathmatch-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/320
Half-Life 2: Episode One-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/380
Half-Life 2: Episode Two-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/420
Half-Life 2: Lost Coast-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/340
Half-Life Deathmatch: Source-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/360
Half-Life(R) 2-->MsiExec.exe /I{D45EC259-4A19-4656-B588-C2C360DD18EA}
Half-Life: Source-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/280
HD Tune 2.54-->"C:\Program Files\HD Tune\unins000.exe"
Hellgate: London-->MsiExec.exe /X{A2B4455D-1046-4732-BFBC-0821BEFC07BC}
HijackThis 2.0.2-->"D:\Brikbrok\Bourdel de Grouik\Outils Utils Logs\Hijackthis\HijackThis.exe" /uninstall
HP USB Disk Storage Format Tool-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}\Setup.exe" -l0x9  anything
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
JMB36X Raid Configurer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}\setup.exe" -l0x9  -removeonly
K!TV-->C:\Program Files\K!TV\UninstKTV.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Metal Gear Solid-->"E:\Games\Metal gear Solid\UNINSTAL.EXE" /runtemp /addremove
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{20DEB77C-21D6-4D22-BB47-233E47613D57}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft WorldWide Telescope-->MsiExec.exe /I{F9C80FE8-DB25-4EE5-AE6D-4332FB0E8B83}
Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.19)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
NVIDIA Drivers-->C:\WINDOWS\System32
vudisp.exe UninstallGUI
Ò»ÆðÀ´ÒôÀÖÖúÊÖ-->C:\Program Files\Yiqilai\Uninstall.exe
OCCT Perestroika 2.0.0a-->"C:\Program Files\OCCT\unins000.exe"
OpenAL-->"C:\Program Files\OpenAL\OalinstGridRelease.exe" /U
OpenMG Limited Patch 4.6-06-09-04-01-->C:\Program Files\Common Files\Sony Shared\OpenMG\HotFixes\HotFix4.6-06-09-04-01\HotFixSetup\setup.exe /u
OpenMG Secure Module 4.6.00-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{D5654243-0EDC-4BE7-8353-16ECE4019CD1} UNINSTALL
OpenOffice.org 2.3-->MsiExec.exe /I{FADB55D0-403F-4413-A268-CF0A6F1185C2}
Opera 9.50-->MsiExec.exe /X{7472B5B4-3FB7-446F-BC78-6BBA506EC473}
PDF Manual NW-S600/S700F Series-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EF71D37B-0CC7-4B8B-863C-FB23849A508E}\setup.exe" -l0x40c UNINSTALL -removeonly
Peggle Extreme-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/3483
Phun beta 3.12-->"E:\Games\Phun\unins000.exe"
Picasa 2-->"C:\Program Files\Picasa2\Uninstall.exe"
Portal-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/400
PowerArchiver 2007 French-->MsiExec.exe /I{93618EE5-68FE-4737-BDF4-6AA44D3A11F3}
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe"  -uninstall
PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
PowerQuest PartitionMagic 8.0-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BE2A4A4-99FB-48ED-AE1E-4E850389F804} 
PunkBuster Services-->C:\WINDOWS\System32\pbsvc.exe -u
QuickTime Alternative 2.2.0-->"C:\Program Files\QuickTime Alternative\unins000.exe"
QuickTime-->MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
Razer Copperhead-->C:\Program Files\InstallShield Installation Information\{28A946E1-E83B-4662-BC7C-23451851489E}\setup.exe -runfromtemp -l0x0009 -removeonly
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9  -removeonly
RivaTuner v2.06 test 6-->"C:\Program Files\RivaTuner v2.06 test 6\uninstall.exe"
Services Off-line de Home'Bank 4.04-->"C:\Program Files\ING\Off-line\unins000.exe"
Skype™ 3.5-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sony Vegas 5.0a-->MsiExec.exe /I{784DF107-2945-4B65-ADE3-A58ECD6C37A9}
SoulSeek Client 157 test 12c-->"C:\Program Files\Soulseek-Test\uninstall.exe"
Source SDK Base-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/215
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Steam(TM)-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Studio PCTV-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Pinnacle\Studio PCTV\PCTVUnin.isu" -cC:\WINDOWS\PCTV.dll
Studio PCTV-->C:\WINDOWS\System32\UnInW2k.exe
Team Fortress 2-->"E:\GAMES\VALVE\steam.exe" steam://uninstall/440
The Witcher-->"C:\Program Files\InstallShield Installation Information\{F138762F-5A1F-4CF0-A5E1-1588EF6088A4}\setup.exe" -runfromtemp -l0x0009 -removeonly
TmUnitedForever_Fix_2008_06_10-->"E:\Games\TmUnitedForever\unins000.exe"
TopStyle Lite (Version 3.0)-->C:\WINDOWS\unlite3.exe "C:\Program Files\Bradbury\TopStyle3"
Total Commander (Remove or Repair)-->C:\Program Files	otalcmd	cuninst.exe
TrackMania United DL Patch 2006-12-15-->"E:\Games\TrackMania United\unins000.exe"
Trillian-->C:\Program Files\Trillian	rillian.exe /uninstall
UBox 2.02-->"E:\Games\UtopiaBOX 2.02\unins000.exe"
Unreal Tournament 3 Demo-->MsiExec.exe /X{3266FEA9-98E9-448B-B235-DAC63D4CE781}
VideoLAN VLC media player 0.8.6d-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WD Diagnostics-->MsiExec.exe /X{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Driver Package - ABIT (UGURU) System  (3.0.2005.531 )-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst.exe /u C:\WINDOWS\System32\DRVSTORE\uguru_347F83755F38F1570B602823E659DC5335F5A948\uguru.inf
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows XP Service Pack 2-->C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe
WingMan Software-->MsiExec.exe /X{435673AB-6821-416D-806A-E477DFA60A42}
World in Conflict-->C:\Program Files\InstallShield Installation Information\{F11ADC64-C89E-47F4-A0B3-3665FF859397}\setup.exe -runfromtemp -l0x0009 -removeonly

======Hosts File======

60.173.10.243 www.sznews.com
60.173.10.243 www.baidu.com
60.173.10.243 www.idoer.org
60.173.10.243 baidu.com
60.173.10.243 www.lhgz.com.cn
60.173.10.243 qq123.d189.5kweb.cn
60.173.10.243 www.taxexpert.com.cn
60.173.10.243 web.szds.gov.cn
60.173.10.243 www.szgs.gov.cn
60.173.10.243 www.szds.gov.cn

System event log

Computer Name: ROBBY
Event Code: 7036
Message: The Telephony service entered the running state.

Record Number: 23354
Source Name: Service Control Manager
Time Written: 20081021110045.000000+120
Event Type: information
User: 

Computer Name: ROBBY
Event Code: 7036
Message: The SSDP Discovery Service service entered the running state.

Record Number: 23353
Source Name: Service Control Manager
Time Written: 20081021110044.000000+120
Event Type: information
User: 

Computer Name: ROBBY
Event Code: 7035
Message: The SSDP Discovery Service service was successfully sent a start control.

Record Number: 23352
Source Name: Service Control Manager
Time Written: 20081021110044.000000+120
Event Type: information
User: ROBBY\Rob

Computer Name: ROBBY
Event Code: 7035
Message: The RivaTuner32 service was successfully sent a start control.

Record Number: 23351
Source Name: Service Control Manager
Time Written: 20081021110040.000000+120
Event Type: information
User: ROBBY\Rob

Computer Name: ROBBY
Event Code: 7036
Message: The Fast User Switching Compatibility service entered the running state.

Record Number: 23350
Source Name: Service Control Manager
Time Written: 20081021110039.000000+120
Event Type: information
User: 

Application event log

Computer Name: ROBBY
Event Code: 1
Message: 
Record Number: 2018
Source Name: Bonjour Service
Time Written: 20080420121403.000000+120
Event Type: information
User: 

Computer Name: ROBBY
Event Code: 1002
Message: Hanging application time_adjuster.exe, version 0.0.3.1, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 2017
Source Name: Application Hang
Time Written: 20080419230727.000000+120
Event Type: error
User: 

Computer Name: ROBBY
Event Code: 1002
Message: Hanging application time_adjuster.exe, version 0.0.3.1, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 2016
Source Name: Application Hang
Time Written: 20080419230640.000000+120
Event Type: error
User: 

Computer Name: ROBBY
Event Code: 101
Message: wuauclt (3968) The database engine stopped.

Record Number: 2015
Source Name: ESENT
Time Written: 20080419142309.000000+120
Event Type: information
User: 

Computer Name: ROBBY
Event Code: 103
Message: wuaueng.dll (3968) SUS20ClientDataStore: The database engine stopped the instance (0).

Record Number: 2014
Source Name: ESENT
Time Written: 20080419142309.000000+120
Event Type: information
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\QuickTime Alternative\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=0f02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"HellgateEnv"=E:\Games\Hellgate London\
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

-----------------EOF-----------------

V-X · Answer

Re,

Tu as bien supprimer la quarantaine de malwarebyte ?

podrob · Answer

Oui, mais comme je l'ai dis ci dessus, il a freeze durant la suppression de l'un des des derniers éléments. J'ai supprimé les derniers éléments du log à la main, mais je ne suis pas sûr que celà soit bien clean. Donc je suis en ce moment même en train de refaire un scan Malware Byte de mon disque système. Ca devrait être bientôt fini.

Il retrouve moultes éléments infectés...

Dès que c'est fini, je supprime, je paste le log, et je reboot. Puis je re-run RSIT...

V-X · Answer

Re,

OKI.

podrob · Answer

Mmh en attendant je me demandais, je devrais pas désactiver la restoration système ? Je vois que MB trouve des merdes dans le dossier c:\system volume information\_restore_blahblah

C'est pas lié ?

V-X · Answer

Re,

Si t'as resto et infecter mais sa on le feras en fin.

podrob · Answer

Bon voilà un log Malware Byte. C'est le 3ème et il trouve de plus en plus d'éléments infectés ! 

Le log après vidange de la quarantaine : 

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1654
Windows 5.1.2600 Service Pack 2

16/01/2009 20:52:33
mbam-log-2009-01-16 (20-52-33).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 103663
Temps écoulé: 19 minute(s), 15 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 29
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 11
Fichier(s) infecté(s): 40

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\csrss.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\antiwpa.dll (Trojan.I.Stole.Windows) -> Not selected for removal.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\b54321.ieencryptapp (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{09eb15fa-17d8-4d60-8598-3f549a848df2} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09eb15fa-17d8-4d60-8598-3f549a848df2} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09eb15fa-17d8-4d60-8598-3f549a848df2} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT
ewadpopup.toolbardetector (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT
ewadpopup.toolbardetector.1 (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{0ad3ab16-6d0e-4f04-8660-fb1f36bc2dc0} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2f685b36-c53a-4653-9231-1dae5736de45} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{50c4cdd9-22d7-49ff-ac6d-7d4d528a3ab2} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f9ba1aa9-cad4-4c14-bde6-922dff5f6f38} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7dbc6adb-5788-4fb9-aec3-b40a58ac11df} (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cde9eb54-a08e-4570-b748-13f5ddb5781c} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{34a12a06-48c0-420d-8f11-73552ee9631a} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{11f09afd-75ad-4e51-ab43-e09e9351ce16} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{de2267bd-b163-407f-9e8d-6adec771e7ab} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11f09afd-75ad-4e51-ab43-e09e9351ce16} (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11f09afd-75ad-4e51-ab43-e09e9351ce16} (Adware.CPush) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{68f25c63-e798-4255-89ce-243aa3757638} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{68f25c63-e798-4255-89ce-243aa3757638} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7dbc6adb-5788-4fb9-aec3-b40a58ac11df} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msiffei (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\apcdli (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\Effects\YiqilaiLyrics (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YiqilaiLyrics (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Yiqilai (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE
ewpush (Adware.CPush) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\cpush (Adware.CPush) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MicroPlugins (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentMatch (Adware.CPush) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Alcmtr (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HBService32 (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Common Files\PushWare (Adware.CPush) -> Delete on reboot.
C:\Program Files\Yiqilai (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\foobar (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\html (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\iTunes (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\lib (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilaiealplayer (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Temp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai	ools (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\winamp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\wmp (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\Internet Explorer\PLUGINS\b54321.bho (Spyware.OnlineGames) -> Delete on reboot.
C:\Documents and Settings\Rob\Local Settings\Temp\11529.dll (Trojan.Starter) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rob\Local Settings\Temp\84a1.dll (Trojan.Starter) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rob\Local Settings\Temp\fd0d.dll (Trojan.Starter) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rob\Local Settings\Temp\suchots.exe (Trojan.Ducky) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rob\Temporary Internet Files\Content.IE5\1N3C0V26
ewads26[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rob\Temporary Internet Files\Content.IE5\1N3C0V26
ewads28[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rob\Temporary Internet Files\Content.IE5\3DJLO6MW
ewads21[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\anymie360.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\PushWare\cpush.dll (Adware.CPush) -> Delete on reboot.
C:\Program Files\Common Files\PushWare\Uninst.exe (Adware.CPush) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\foobar\foo_ui_columns.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\foobar\foo_ui_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\iTunes\iTunesYQLyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\lib\YQL_Lyrics_Common.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilaiealplayer\RealYQLyrics.rpv (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Temp\foo_ui_columns.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Temp\foo_ui_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Temp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Temp\iTunesYQLyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Temp\RealYQLyrics.rpv (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Temp\vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\Temp\Ò»ÆðÀ´ÒôÀÖÖúÊÖ°ïÖú.url (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai	ools\GetMusic.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai	ools\music.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai	ools\YiqilaiLyrics.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\winamp\gen_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\winamp\vis_yqllyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\System.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\csrss.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\antiwpa.dll (Trojan.I.Stole.Windows) -> Not selected for removal.
C:\WINDOWS\system32\YQL_Lyrics_Common.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\HBWULIN2.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\HBCHIBI.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2263.dll (Adware.CPush) -> Delete on reboot.
C:\Documents and Settings\Rob\Favorites\Ò»ÆðÀ´ÒôÀÖÉçÇø.url (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\cpush.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\YiqilaiLyrics_2001.exe (Trojan.Agent) -> Quarantined and deleted successfully.


Je reboot pour un scan RSIT...

V-X · Answer

Re,


-Tu utilises une version pirate de WINDOWS;

J'utilise une version piratée de Windows

Pourquoi CCM n'aide pas à pirater des logiciels

Charte d'utilisation de CommentCaMarche.net - Aspects légaux

le bonus

Le super bonus

podrob · Answer

Oooh désolé de t'avoir fait perdre ton temps alors. Sincèrement.

Je ne savais pas que ce genre de principes étaient d'actualité ici, j'ai cru que ce forum était une endroit ou la majorité des utilisateurs "casual" pouvaient exprimer leurs problèmes. Car on sait tous qu'il y a plus de particuliers "pirates", que de particuliers propriétaire d'une licence bien sûr... 

Soit, loin de moi l'idée de lancer un débat stérile sur le prix des licences Windows, ou pire sur leur rapport qualité/prix !!! Non je veux juste m'excuser de t'avoir fait perdre ton temps.

Je vais encore passer quelques scans mais le problème semble récurent et je n'ai pas les compétences requises pour m'en débarasser. Un petit format C: fera l'affaire, et c'est reparti pour deux ans... for free ! ;)

ps : Si mes jeux tournaient sous Linux, je me transformerais en Pingouin bien volontier. Malheureusement, j'aime le jeu vidéo et dans cette mesure, je n'ai pas bcp de choix. Pourquoi devrai-je payer pour une olbligation dictée par les lois de la demande et du marché ? 

Merci encore pour ton aide ;)

podrob · Answer

ps: Ton super bonus est très amusant et fera certainement peur à...mmmh...personne à l'heure actuelle ? :D

psII : Enfin si c'était de l'humour j'ai bien aimé.

Win32.TrojanDownloader.Agent - Page 2

Discussions similaires

Newsletters