Virus. Fermé

Question

Bonjour, Bonjour,Mon ordinateur etant trop lent j'ai fait une analyse en ligne avec Bitdefender et après avec combofix.Je mets les deux rapports plus celui de hijacjthis pour que vous pussiez me dire si tout est rentré dans l'ordre .Merci beaucoup ! BitDefender Online Scanner Rapport d'analyse généré à: Sat, Jan 24, 2009 - 17:10:05 Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\; Statistiques Temps 00:33:28 Fichiers 40982 Directoires 8348 Secteurs de boot 0 Archives 640 Paquets programmes 3321 Résultats Virus identifiés 1 Fichiers infectés 1 Fichiers suspects 0 Avertissements 0 Désinfectés 0 Fichiers effacés 1 Info sur les moteurs Définition virus 2591795 Version des moteurs AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14) Analyse des plugins 17 Archive des plugins 45 Unpack des plugins 7 E-mail plugins 6 Système plugins 4 Paramètres d'analyse Première action Désinfecté Seconde Action Supprimé Heuristique Oui Acceptez les avertissements Oui Extensions analysées exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas; Excludez les extensions Analyse d'emails Oui Analyse des Archives Oui Analyser paquets programmes Oui Analyse des fichiers Oui Analyse de boot Oui Fichier analysé Statut C:\System Volume Information\_restore{A57213C1-AAB6-42A7-873D-8F091491EAC7}\RP6\A0001013.dll Détecté avec: Adware.Generic.51151 C:\System Volume Information\_restore{A57213C1-AAB6-42A7-873D-8F091491EAC7}\RP6\A0001013.dll Supprimé COMBOFIX ComboFix 09-01-21.04 - Administrateur 2009-01-24 17:45:28.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.511.263 [GMT 1:00] Lancé depuis: c:\documents and settings\Administrateur.9C024B2278E9436\Bureau\ComboFix.exe AV: avast! antivirus 4.8.1296 [VPS 090123-0] *On-access scanning disabled* (Updated) FW: ZoneAlarm Firewall *disabled* * Un nouveau point de restauration a été créé AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . /wow section - STAGE 8 Accès refusé. ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-24 au 2009-01-24 )))))))))))))))))))))))))))))))))))) . 2009-01-24 16:03 . 2009-01-24 16:11 d-------- c:\documents and settings\Administrateur.9C024B2278E9436\.VirtualBox 2009-01-24 16:02 . 2009-01-24 16:23 d-------- c:\windows\LastGood 2009-01-23 15:54 . 2004-05-27 16:46 872,448 --a------ c:\windows\system32\libgfl211.dll 2009-01-23 15:54 . 2004-05-19 10:01 364,544 --a------ c:\windows\system32\Xfpx.dll 2009-01-23 15:54 . 2004-02-04 06:33 307,200 --a------ c:\windows\system32\libmng.dll 2009-01-23 15:54 . 2004-05-19 10:02 225,280 --a------ c:\windows\system32\Xjp2.dll 2009-01-23 15:54 . 2004-05-19 10:02 114,688 --a------ c:\windows\system32\Xjpegls.dll 2009-01-23 15:54 . 2004-05-19 10:01 81,920 --a------ c:\windows\system32\Xjbig.dll 2009-01-23 15:54 . 2004-05-19 10:02 49,152 --a------ c:\windows\system32\Xsusie.dll 2009-01-23 15:54 . 2004-05-19 10:01 49,152 --a------ c:\windows\system32\Xjng.dll 2009-01-22 02:01 . 2009-01-22 02:01 d-------- c:\documents and settings\All Users.WINDOWS\Application Data\EmailNotifier 2009-01-22 02:01 . 2009-01-22 02:01 d-------- c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\EmailNotifier 2009-01-19 21:11 . 2009-01-19 21:22 d-------- c:\program files\VirtualDub 2009-01-19 15:35 . 2009-01-19 15:35 dr-h----- C:\MSOCache 2009-01-17 16:19 . 2009-01-17 16:19 d-------- c:\program files\CDBurnerXP 2009-01-16 15:55 . 2009-01-16 15:55 d-------- C:\bootcd 2009-01-15 12:00 . 2009-01-15 12:00 d-------- c:\program files\FotoSketcher 2009-01-05 14:44 . 2009-01-17 15:42 d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Vso 2009-01-05 14:44 . 2009-01-17 15:45 d-------- c:\documents and settings\All Users.WINDOWS\Application Data\log 2009-01-05 14:40 . 2009-01-17 15:47 d-------- c:\program files\VSO 2009-01-05 14:40 . 2009-01-17 15:46 d-------- c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\Vso 2009-01-05 14:40 . 2009-01-05 14:40 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys 2009-01-05 14:40 . 2009-01-17 15:46 47,360 --a------ c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\pcouffin.sys 2009-01-04 23:41 . 2009-01-06 12:16 d-------- c:\program files\InfraRecorder 2009-01-04 23:41 . 2009-01-04 23:59 d-------- c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\InfraRecorder 2009-01-04 22:17 . 2009-01-04 22:17 d-------- c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\Acoustica 2009-01-04 22:17 . 2007-08-07 11:32 57,344 --a------ c:\windows\system32\Wnaspint.dll 2009-01-04 22:17 . 2007-08-07 11:32 57,344 --a------ c:\windows\system32\~GLH0022.TMP 2009-01-04 22:17 . 2007-08-07 10:58 32,768 --a------ c:\windows\system32\Wnaspi32.dll 2009-01-04 01:25 . 2009-01-04 01:25 d-------- c:\program files\BlogDesk 2009-01-04 01:25 . 2009-01-04 01:25 d-------- c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\BlogDesk 2009-01-04 01:25 . 2006-01-30 18:26 765,952 --a------ c:\windows\system32\PolarSpellChecker.dll 2009-01-04 01:25 . 2003-01-04 12:10 536,576 --a------ c:\windows\system32\SftTree_IX86_A_45.ocx 2009-01-04 01:25 . 2006-03-21 11:27 276,320 --a------ c:\windows\system32\csftpapi.dll 2009-01-04 01:25 . 2003-02-20 11:59 221,184 --a------ c:\windows\system32\TidyATL.dll 2009-01-04 01:25 . 2004-03-09 00:00 212,240 --a------ c:\windows\system32\Richtx32.ocx 2009-01-04 01:25 . 2006-03-21 11:27 202,576 --a------ c:\windows\system32\csncdapi.dll 2009-01-01 17:45 . 2009-01-01 17:59 d-------- c:\program files\Radio Fr Solo 2008-12-30 15:05 . 2008-12-30 15:05 d-------- c:\program files\Bonjour 2008-12-30 12:29 . 2008-12-30 12:29 d-------- c:\windows\avxoscan 2008-12-27 01:55 . 2008-12-27 01:55 410 --a------ C:\Ri4m.ajb . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-24 16:48 39,913,504 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-01-24 16:42 --------- d-----w c:\program files\BitComet 2009-01-24 03:37 466,052 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-01-23 03:11 2,702,848 ----a-w c:\windows\Internet Logs\xDB92.tmp 2009-01-23 03:10 1,947,648 ----a-w c:\windows\Internet Logs\xDB93.tmp 2009-01-22 03:51 1,942,528 ----a-w c:\windows\Internet Logs\xDB91.tmp 2009-01-22 03:51 1,267,200 ----a-w c:\windows\Internet Logs\xDB90.tmp 2009-01-21 21:04 --------- d-----w c:\program files\Dictionnaire 2009-01-21 18:13 41,680 ----a-w c:\windows\system32\drivers\VBoxUSBMon.sys 2009-01-21 18:13 100,560 ----a-w c:\windows\system32\drivers\VBoxDrv.sys 2009-01-21 11:27 242,176 ----a-w c:\windows\Internet Logs\xDB8E.tmp 2009-01-21 11:27 1,932,288 ----a-w c:\windows\Internet Logs\xDB8F.tmp 2009-01-21 00:07 1,931,776 ----a-w c:\windows\Internet Logs\xDB8D.tmp 2009-01-21 00:07 1,776,640 ----a-w c:\windows\Internet Logs\xDB8C.tmp 2009-01-20 12:08 --------- d-----w c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\OpenOffice.org2 2009-01-20 01:18 2,757,120 ----a-w c:\windows\Internet Logs\xDB8A.tmp 2009-01-20 01:18 1,927,680 ----a-w c:\windows\Internet Logs\xDB8B.tmp 2009-01-19 15:07 --------- d-----w c:\program files\Mozilla Thunderbird 2009-01-19 03:24 2,036,901 ----a-w c:\windows\Internet Logs\tvDebug.zip 2009-01-19 03:22 3,003,904 ----a-w c:\windows\Internet Logs\xDB88.tmp 2009-01-19 03:22 1,913,344 ----a-w c:\windows\Internet Logs\xDB89.tmp 2009-01-18 03:23 1,909,760 ----a-w c:\windows\Internet Logs\xDB87.tmp 2009-01-18 03:23 1,591,808 ----a-w c:\windows\Internet Logs\xDB86.tmp 2009-01-17 18:27 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-01-17 14:48 2,326,528 ----a-w c:\windows\Internet Logs\xDB84.tmp 2009-01-17 14:48 1,899,520 ----a-w c:\windows\Internet Logs\xDB85.tmp 2009-01-16 21:59 1,939,968 ----a-w c:\windows\Internet Logs\xDB82.tmp 2009-01-16 21:58 1,891,328 ----a-w c:\windows\Internet Logs\xDB83.tmp 2009-01-16 01:56 998,912 ----a-w c:\windows\Internet Logs\xDB80.tmp 2009-01-16 01:56 1,869,824 ----a-w c:\windows\Internet Logs\xDB81.tmp 2009-01-16 01:48 --------- d-----w c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\FrostWire 2009-01-15 17:32 109,056 ----a-w c:\windows\Internet Logs\xDB7F.tmp 2009-01-15 03:47 119,808 ----a-w c:\windows\Internet Logs\xDB7E.tmp 2009-01-14 15:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-14 15:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-01-14 04:32 186,368 ----a-w c:\windows\Internet Logs\xDB7D.tmp 2009-01-13 03:51 38,912 ----a-w c:\windows\Internet Logs\xDB7C.tmp 2009-01-13 02:20 39,424 ----a-w c:\windows\Internet Logs\xDB7B.tmp 2009-01-12 01:11 40,448 ----a-w c:\windows\Internet Logs\xDB7A.tmp 2009-01-11 21:29 33,280 ----a-w c:\windows\Internet Logs\xDB79.tmp 2009-01-11 18:36 20 ---h--w c:\documents and settings\All Users.WINDOWS\Application Data\PKP_DLec.DAT 2009-01-11 18:36 20 ---h--w c:\documents and settings\All Users.WINDOWS\Application Data\PKP_DLds.DAT 2009-01-11 11:15 44,544 ----a-w c:\windows\Internet Logs\xDB78.tmp 2009-01-10 22:46 76,288 ----a-w c:\windows\Internet Logs\xDB76.tmp 2009-01-10 22:46 1,827,328 ----a-w c:\windows\Internet Logs\xDB77.tmp 2009-01-09 16:20 --------- d-----w c:\program files\MpcStar 2009-01-09 01:52 64,512 ----a-w c:\windows\Internet Logs\xDB74.tmp 2009-01-09 01:52 1,823,744 ----a-w c:\windows\Internet Logs\xDB75.tmp 2009-01-09 00:14 --------- d-----w c:\program files\IncrediMail 2009-01-08 02:57 58,368 ----a-w c:\windows\Internet Logs\xDB72.tmp 2009-01-08 02:57 1,809,408 ----a-w c:\windows\Internet Logs\xDB73.tmp 2009-01-07 20:00 92,672 ----a-w c:\windows\Internet Logs\xDB70.tmp 2009-01-07 20:00 1,808,384 ----a-w c:\windows\Internet Logs\xDB71.tmp 2009-01-07 19:59 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Grisoft 2009-01-07 02:01 20,480 ----a-w c:\windows\Internet Logs\xDB6E.tmp 2009-01-07 02:01 1,803,264 ----a-w c:\windows\Internet Logs\xDB6F.tmp 2009-01-07 01:55 129,536 ----a-w c:\windows\Internet Logs\xDB6C.tmp 2009-01-07 01:55 1,802,752 ----a-w c:\windows\Internet Logs\xDB6D.tmp 2009-01-06 10:36 23,040 ----a-w c:\windows\Internet Logs\xDB6A.tmp 2009-01-06 10:36 1,792,000 ----a-w c:\windows\Internet Logs\xDB6B.tmp 2009-01-06 03:44 112,640 ----a-w c:\windows\Internet Logs\xDB68.tmp 2009-01-06 03:44 1,791,488 ----a-w c:\windows\Internet Logs\xDB69.tmp 2009-01-06 03:39 --------- d-----w c:\program files\TuneUp Utilities 2008 2009-01-05 14:03 71,168 ----a-w c:\windows\Internet Logs\xDB66.tmp 2009-01-05 14:03 1,780,224 ----a-w c:\windows\Internet Logs\xDB67.tmp 2009-01-04 21:06 76,800 ----a-w c:\windows\Internet Logs\xDB64.tmp 2009-01-04 21:06 1,756,160 ----a-w c:\windows\Internet Logs\xDB65.tmp 2009-01-04 05:15 171,520 ----a-w c:\windows\Internet Logs\xDB62.tmp 2009-01-04 05:15 1,746,432 ----a-w c:\windows\Internet Logs\xDB63.tmp 2009-01-02 02:50 244,736 ----a-w c:\windows\Internet Logs\xDB60.tmp 2009-01-02 02:50 1,736,192 ----a-w c:\windows\Internet Logs\xDB61.tmp 2008-12-31 14:32 --------- d-----w c:\program files\Trend Micro 2008-12-31 14:26 --------- d-----w c:\program files\eMule 2008-12-31 14:24 --------- d-----w c:\program files\CCleaner 2008-12-31 03:09 3,013,632 ----a-w c:\windows\Internet Logs\xDB5E.tmp 2008-12-31 03:09 1,720,832 ----a-w c:\windows\Internet Logs\xDB5F.tmp 2008-12-31 00:14 2,871,296 ----a-w c:\windows\Internet Logs\xDB5D.tmp 2008-12-30 20:52 --------- d-----w c:\program files\Avant Browser 2008-12-30 04:06 569,856 ----a-w c:\windows\Internet Logs\xDB5B.tmp 2008-12-30 04:06 1,715,200 ----a-w c:\windows\Internet Logs\xDB5C.tmp 2008-12-29 23:18 60,928 ----a-w c:\windows\Internet Logs\xDB5A.tmp 2008-12-29 16:56 63,488 ----a-w c:\windows\Internet Logs\xDB58.tmp 2008-12-29 16:56 1,731,072 ----a-w c:\windows\Internet Logs\xDB59.tmp 2008-12-29 04:18 63,488 ----a-w c:\windows\Internet Logs\xDB56.tmp 2008-12-29 04:18 1,730,560 ----a-w c:\windows\Internet Logs\xDB57.tmp 2008-12-28 21:35 65,024 ----a-w c:\windows\Internet Logs\xDB54.tmp 2008-12-28 21:35 1,730,048 ----a-w c:\windows\Internet Logs\xDB55.tmp 2008-12-28 02:43 95,744 ----a-w c:\windows\Internet Logs\xDB52.tmp 2008-12-28 02:43 1,729,536 ----a-w c:\windows\Internet Logs\xDB53.tmp 2008-12-27 03:58 40,960 ----a-w c:\windows\Internet Logs\xDB51.tmp 2008-12-27 01:14 48,640 ----a-w c:\windows\Internet Logs\xDB4F.tmp 2008-12-27 01:14 1,717,248 ----a-w c:\windows\Internet Logs\xDB50.tmp 2008-12-26 23:32 76,288 ----a-w c:\windows\Internet Logs\xDB4D.tmp 2008-12-26 23:32 1,719,296 ----a-w c:\windows\Internet Logs\xDB4E.tmp 2008-12-26 04:36 56,832 ----a-w c:\windows\Internet Logs\xDB4B.tmp 2008-12-26 04:36 1,713,152 ----a-w c:\windows\Internet Logs\xDB4C.tmp 2008-12-26 01:34 73,216 ----a-w c:\windows\Internet Logs\xDB4A.tmp 2008-12-25 03:26 87,552 ----a-w c:\windows\Internet Logs\xDB48.tmp 2008-12-25 03:26 1,711,616 ----a-w c:\windows\Internet Logs\xDB49.tmp 2008-12-24 11:46 96,256 ----a-w c:\windows\Internet Logs\xDB46.tmp 2008-09-15 20:00 16,384 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat 2008-09-15 20:00 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat 2008-09-15 20:00 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008091520080916\index.dat 2008-09-15 20:00 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((( snapshot@2008-12-31_ 1.50.47,84 ))))))))))))))))))))))))))))))))))))))))) . + 2007-06-18 15:16:32 12,259,160 ----a-r c:\windows\Installer\$PatchCache$\Managed\C040580900063D11C8EF10054038389C\11.0.8173\MSO.DLL + 2007-04-19 12:07:38 61,280 ----a-r c:\windows\Installer\$PatchCache$\Managed\C040580900063D11C8EF10054038389C\11.0.8173\MSOHTMED.EXE + 2007-04-19 12:10:20 65,888 ----a-r c:\windows\Installer\$PatchCache$\Managed\C040580900063D11C8EF10054038389C\11.0.8173\SEQCHK10.DLL + 2007-05-31 11:37:46 8,812,384 ----a-r c:\windows\Installer\$PatchCache$\Managed\C040580900063D11C8EF10054038389C\11.0.8173\WORDVIEW.EXE + 2009-01-05 21:58:05 4,710 ----a-r c:\windows\Installer\{5BE38A73-F54F-4A58-9B36-78D51D205F36}\NewShortcut11_86F3D0BB3537401DBB67D4F0DA976EAC.exe + 2009-01-05 21:58:05 4,710 ----a-r c:\windows\Installer\{5BE38A73-F54F-4A58-9B36-78D51D205F36}\NewShortcut12_86F3D0BB3537401DBB67D4F0DA976EAC.exe + 2009-01-05 21:58:05 4,710 ----a-r c:\windows\Installer\{5BE38A73-F54F-4A58-9B36-78D51D205F36}\NewShortcut13_86F3D0BB3537401DBB67D4F0DA976EAC.exe + 2009-01-05 21:58:05 14,366 ----a-r c:\windows\Installer\{5BE38A73-F54F-4A58-9B36-78D51D205F36}\NewShortcut14_86F3D0BB3537401DBB67D4F0DA976EAC.exe + 2009-01-05 21:58:05 2,238 ----a-r c:\windows\Installer\{5BE38A73-F54F-4A58-9B36-78D51D205F36}\NewShortcut22_86F3D0BB3537401DBB67D4F0DA976EAC.exe + 2009-01-05 21:58:05 2,238 ----a-r c:\windows\Installer\{5BE38A73-F54F-4A58-9B36-78D51D205F36}\NewShortcut23_86F3D0BB3537401DBB67D4F0DA976EAC.exe + 2009-01-20 11:32:50 135,168 ----a-r c:\windows\Installer\{9085040C-6000-11D3-8CFE-0150048383C9}\misc.exe + 2009-01-20 11:32:50 40,960 ----a-r c:\windows\Installer\{9085040C-6000-11D3-8CFE-0150048383C9}\wrdvicon.exe + 2008-11-21 20:10:26 93,776 ----a-w c:\windows\LastGood\system32\DRIVERS\VBoxDrv.sys + 2009-01-21 18:13:56 87,312 ----a-w c:\windows\LastGood\system32\DRIVERS\VBoxNetFlt.sys + 2008-11-21 20:10:28 41,744 ----a-w c:\windows\LastGood\system32\DRIVERS\VBoxUSBMon.sys + 2009-01-21 18:14:18 129,552 ----a-w c:\windows\LastGood\system32\VBoxNetFltNotify.dll - 2000-08-31 07:00:00 28,672 ----a-w c:\windows\NIRCMD.exe + 2000-08-31 07:00:00 29,696 ----a-w c:\windows\NIRCMD.exe - 2008-09-08 10:41:42 333,824 -c----w c:\windows\system32\dllcache\srv.sys + 2008-12-11 10:57:09 333,952 -c----w c:\windows\system32\dllcache\srv.sys - 2006-06-27 07:48:46 95,744 ----a-w c:\windows\system32\drivers\atapi.sys + 2008-04-13 19:40:30 96,512 ----a-w c:\windows\system32\drivers\atapi.sys - 2008-09-08 10:41:42 333,824 ----a-w c:\windows\system32\drivers\srv.sys + 2008-12-11 10:57:09 333,952 ----a-w c:\windows\system32\drivers\srv.sys - 2008-12-09 14:32:58 84,661 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe + 2009-01-22 01:24:27 84,661 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe - 2008-12-09 23:24:37 17,593,280 ----a-w c:\windows\system32\mrt.exe + 2009-01-10 01:35:28 20,853,704 ----a-w c:\windows\system32\mrt.exe + 2000-04-03 19:05:58 118,784 ----a-w c:\windows\system32\msstdfmt.dll + 2007-03-01 12:38:06 1,417,216 ----a-w c:\windows\system32\qpdf522.dll + 2004-08-28 14:00:00 27,904 ----a-w c:\windows\system32\ReinstallBackups\[u]0/u005\DriverFiles\VIAAGP1.SYS + 2009-01-24 13:30:24 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_228.dat + 2009-01-24 13:30:44 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_410.dat + 2009-01-16 22:36:51 82,432 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2008-04-14 138240] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2008-10-16 c:\windows\system32\advpack.dll] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=krrvpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.tscc"= c:\progra~1\MpcStar\Codecs\tscc\tsccvid.dll "vidc.3IV2"= 3ivxVfWCodec.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "IncrediMail"=c:\program files\IncrediMail\bin\IncMail.exe /c "IncrediMail Tray Application"=c:\program files\IncrediMail\bin\IncMail.exe "ctfmon.exe"=c:\windows\system32\ctfmon.exe "Pando"="c:\program files\Pando Networks\Pando\pando.exe" /Minimized "MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Styler"=c:\program files\styler\Styler.exe "TopDesk"=c:\windows\system32\topdesk.exe "TransBar"=c:\windows\System32\TransBar.exe /s "UberIcon"="c:\program files\UberIcon\UberIcon Manager.exe" "Vistadrv"=c:\windows\system32\Vistadrive\vsdrv.exe "VisualTaskTips"=c:\windows\System32\VisualTaskTips.exe "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" "snpstd"=c:\windows\vsnpstd.exe "Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime "SoundMan"=SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "c:\Program Files\IncrediMail\bin\ImApp.exe"= "c:\Program Files\IncrediMail\bin\IncMail.exe"= "c:\Program Files\IncrediMail\bin\ImpCnt.exe"= "c:\Program Files\HomePlayer\HomePlayer.exe"= "c:\Program Files\FrostWire\FrostWire.exe"= "c:\Program Files\Pando Networks\Pando\pando.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\MSN Messenger\msnmsgr.exe"= "c:\Program Files\MSN Messenger\livecall.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "11350:TCP"= 11350:TCP:BitComet 11350 TCP "11350:UDP"= 11350:UDP:BitComet 11350 UDP "21600:TCP"= 21600:TCP:BitComet 21600 TCP "21600:UDP"= 21600:UDP:BitComet 21600 UDP "56311:TCP"= 56311:TCP:Pando P2P TCP Listening Port "56311:UDP"= 56311:UDP:Pando P2P UDP Listening Port "24028:TCP"= 24028:TCP:BitComet 24028 TCP "24028:UDP"= 24028:UDP:BitComet 24028 UDP "58750:TCP"= 58750:TCP:Pando P2P TCP Listening Port "58750:UDP"= 58750:UDP:Pando P2P UDP Listening Port "25590:TCP"= 25590:TCP:BitComet 25590 TCP "25590:UDP"= 25590:UDP:BitComet 25590 UDP R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-29 111184] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-11-29 20560] R4 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592] S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Everest\kerneld.wnt [2008-08-16 20760] S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?] S4 ekrn;Eset Service;"c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe" --> c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [?] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - VBOXDRV *NewlyCreated* - VBOXUSBMON *Deregistered* - VBoxDrv *Deregistered* - VBoxUSBMon HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{60a86931-bd55-11dd-a1a4-001109a4cf42}] \Shell\AutoRun\command - M:\Setup.exe . Contenu du dossier 'Tâches planifiées' 2009-01-20 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-01-24 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 08:23] 2009-01-24 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20] . - - - - ORPHELINS SUPPRIMES - - - - Toolbar-ITBarLayout - (no file) Toolbar-ITBarLayout - (no file) Toolbar-ITBar7Position - (no file) WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file) . ------- Examen supplémentaire ------- . uDefault_Search_URL = hxxp://www.google.fr/keyword/%s uStart Page = hxxp://www.google.fr/ mWindow Title = uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab FF - ProfilePath - c:\documents and settings\Administrateur.9C024B2278E9436\Application Data\Mozilla\Firefox\Profiles\bsyas8tn.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll ---- PARAMETRES FIREFOX ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 200000 FF - user.js: content.notify.interval - 100000 FF - user.js: content.switch.threshold - 650000 FF - user.js: nglayout.initialpaint.delay - 300 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-24 17:48:05 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EverestDriver] "ImagePath"="\??\c:\program files\everest\kerneld.wnt" . Heure de fin: 2009-01-24 17:49:49 ComboFix-quarantined-files.txt 2009-01-24 16:49:46 ComboFix2.txt 2009-01-19 12:58:21 ComboFix3.txt 2009-01-01 12:13:30 ComboFix4.txt 2008-12-31 00:51:33 Avant-CF: 57 150 394 368 octets libres Après-CF: 57,141,985,280 octets libres Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4 351 --- E O F --- 2009-01-23 12:57:59 HIJACKTHIS Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:30, on 24/01/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20935) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Cooliris Plug-In for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - (no file) O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - https://www.eset.com/ O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1219780699484 O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/... O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab O20 - AppInit_DLLs: krrvpl.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing) O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing) O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

gen-hackman · Answer

salut :


Telecharge maintenant FindyKill sur ton bureau : 

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe 

--> Lance l installation avec les parametres par default 

--> Au menu principal,choisi l option 1 (Recherche) 

--> Post le rapport FindyKill.txt 

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

jacques.gache · Answer

bonjour, pour moi pas de traces d'infection visible , tu as utilisé combofix fais attention car il y a des pc qui plantent avec surtout que tu n'avais pas installé la console de récupération avant de l'utiliser , si juste pour savoir ou plutôt être sur ton windows ne me parrais pas une version légal si je ne me trompe pas ????

gen-hackman · Answer

ensuite en attendant la reponse tu feras :


Télécharge SDFix sur ton bureau : 
ici http://downloads.andymanchesta.com/RemovalTools/SDFix.exe. 
ou ici http://download.bleepingcomputer.com/andymanchesta/SDFix.exe­ 
ou ici http://sdfix.net/SDFix.exe 

--> Double-clique sur SDFix.exe et choisis "Install" . 

( tuto ici : https://www.malekal.com/slenfbot-still-an-other-irc-bot/ ) 

Puis une fois l'installe faite , 

Impératif : Démarrer en mode sans echec . 

/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\ 

Comment aller en Mode sans échec : 
1) Redémarre ton ordi . 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" . 
3) Tu tapotes jusqu' à l'apparition de l'écran avec les options de démarrage . 
4) Choisis la première option : Sans Échec , et valide en tapant sur [Entrée] . 
5) Choisis ton compte habituel ( et pas Administrateur ). 
attention : pas de connexion possible en mode sans échec , donc copie ou imprime bien la manipe pour éviter les erreurs ... 


Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double-clique sur RunThis.bat pour lancer l'outil . 
-->Tapes Y pour lancer le script ... 
Le Fix supprime les services du virus et nettoie le registre, de ce fait un redémarrage est nécessaire , donc : 
presses une touche pour redémarrer quand il te le sera demandé . 

Le PC va mettre du temps avant de démarrer ( c'est normale ), après le chargement du Bureau presses une touche lorsque "Finished" s'affiche . 

Le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier 
C:\SDFix sous le nom "Report.txt". 

Poste ce dernier dans ta prochaine réponse accompagné d'un nouveau rapport Hijakcthis pour analyse

ouaib · Answer

###################### [ FindyKill V4.714 ]

# User : Administrateur - 9C024B2278E9436
# Emplacement : C:\Program Files\FindyKill
# Outils Mis a jours le 19/01/09 par Chiquitine29
# Recherche effectuée à 20:06:25 le 24/01/2009
# Windows XP - Internet Explorer 7.0.5730.11
 
# [ FindyKill V4.714 - Scan ] ############## 
 
\\\\\\\\\\  [ Processus actifs ]  ///////////////////  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Media Player\wmplayer.exe
 
\\\\\\\\\  [ Fichiers/Dossiers infectieux ]  ///////////////////  
 
 
################## [ C:\ ] 
 
 
################## [ C:\WINDOWS ] 
 
 
################## [ C:\WINDOWS\Prefetch ] 
 
 
################## [ C:\WINDOWS\system32 ] 
 
 
################## [ C:\WINDOWS\system32\drivers ] 
 
 
################## [ C:\Documents and Settings\Administrateur.9C024B2278E9436\Application Data ] 
 
 
################## [ C:\DOCUME~1\ADMINI~1.9C0\LOCALS~1\Temp ] 
 
 
\\\\\\\\\  [ Registre / Startup ]  ///////////////////  
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersionun]
   ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
   MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionun]
   ZoneAlarm Client="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
   avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents\IMAIL=
   Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents\MAPI=
   Installed=1
   NoChange=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents\MSFS=
   Installed=1
 
 
\\\\\\\\\  [ Registre / Clés infectieuses ] ///////////////////  
 
 
 
 
\\\\\\\\\  [ Etat / Services ]  ///////////////////  
 

# Services : [ Auto=2 / Demande=3 / Désactivé=4 ] 

Ndisuio - # Type de démarrage = 3 
 
EapHost - # Type de démarrage = 3 
 
Ip6Fw - # Type de démarrage = 3 
 
SharedAccess - # Type de démarrage = 2 
 
wuauserv - # Type de démarrage = 2 
 
wscsvc - # Type de démarrage = 2 
 
WinDefend - # Type de démarrage = 2 
 
 
\\\\\\\\\  [ Recherche dans supports amovibles]  ///////////////////  
 
 
# Informations : 

C: - Lecteur fixe

 
# presence des fichiers :  

 
 
\\\\\\\\\  [ Registre / Mountpoint2 ]  ///////////////////  
 
 
-> Not found ! 
 
 
################## [ ! Fin du rapport # FindyKill V4.714 ! ]

gen-hackman · Answer

ok j attends le rapport sdfix
  
:)

ouaib · Answer

[b]SDFix: Version 1.240 [/b]
Run by Administrateur on 24/01/2009 at 20:27

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 20:39:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:41,83,1b,0f,64,1e,25,fc,cb,94,49,f3,44,03,77,48,7f,7b,29,4b,cf,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:42,16,05,b3,62,0d,46,28,7f,34,6d,5e,4b,9c,25,02,b5,5d,cd,fd,4e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:42,16,05,b3,62,0d,46,28,7f,34,6d,5e,4b,9c,25,02,b5,5d,cd,fd,4e,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:09,d5,fd,82,54,24,df,e0,bf,0f,1a,de,ac,39,fa,ab,db,45,80,b3,32,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d2,68,c0,27,51,1c,e1,8a,62,a1,eb,fd,a1,a9,49,7b,be,7b,4a,89,ea,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:09,d5,fd,82,54,24,df,e0,bf,0f,1a,de,ac,39,fa,ab,db,45,80,b3,32,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d2,68,c0,27,51,1c,e1,8a,62,a1,eb,fd,a1,a9,49,7b,be,7b,4a,89,ea,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\IncrediMail\bin\ImApp.exe"="C:\Program Files\IncrediMail\bin\ImApp.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\IncMail.exe"="C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\ImpCnt.exe"="C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\Program Files\HomePlayer\HomePlayer.exe"="C:\Program Files\HomePlayer\HomePlayer.exe:*:Enabled:HomePlayer"
"C:\Program Files\FrostWire\FrostWire.exe"="C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire"
"C:\Program Files\Pando Networks\Pando\pando.exe"="C:\Program Files\Pando Networks\Pando\pando.exe:*:Enabled:Pando Application"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Sat  8 Nov 2008         1,152 A.SH. --- "C:\wjwfao30.sys"
Mon  3 Mar 2008         5,702 A..H. --- "C:\WINDOWS
od32restoretemdono.reg"
Tue  2 Sep 2008         4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Tue 26 Aug 2008             0 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]

gen-hackman · Answer

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir 


--> Fais clic droit sur le raccourci FindyKill sur ton bureau 

--> Au menu principal,choisi l option 2 (Suppression) 


/!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "nettoyage effectué" 

/!\ Ne te sert pas du pc durant la suppression , ton bureau ne sera pas accessible c est normal ! 

-------> ensuite post le rapport FindyKill.txt 

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

ouaib · Answer

Merci de m'avoir aidé ! Bon dimanche.

gen-hackman · Answer

c est pas fini !!!

Virus.

9 réponses

Discussions similaires