PB troyen + log hijack Résolu

Question

Bonjour à tous.
Tout d'abord merci à tous ceux qui de part leurs connaissances aident les autres ca fait plaisir de savoir qu'on peut encore compter sur des gens un minimum altruiste.
Voila j'ai choppé un troyen qui se logge dans C:\WINDOWS\System32s32net.exe.
j'ai rien fait de spécial pour le chopper je fais gaffe j'ouvre pas n'importe quoi ca fait 2 ans que l'ordi tourne 24/24 sans problemes.
j'ai une version a jour de bit defender v10 et spy bot a jour aussi.
CCleaner me trouve 2 clés vérollées ds le registre, impossible de les éffacer.

Le troyen me télécharge d'autres malwares des que je me connecte sur le net que j'arrive plus ou moins à virer, mais celui dans rs32net est impossible à bouger.

Je me suis renseigné sur le forum et j'ai téléchargé hijackthis, MBAM, avast, Vundofix et OTMovIt3, apres plusieurs scan divers il me reste toujours le mm troyen 
j'atteins les limites de mes "compétences" en info donc je me tourne vers vous.
Merci d'avance.
je poste un log Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:19:43, on 30/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
d:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\1XConfig.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Steam\steam.exe
C:\WINDOWS\System32\msiexec.exe
d:\b2dfca2b0fb3873f844230\setup.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\MsiExec.exe
C:\WINDOWS\System32\MsiExec.exe
C:\Documents and Settings\xavier\Bureau	est.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - d:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: &Google Notebook - {CCCCCCD3-666F-4F81-8B69-745DE9F6D897} - C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-868825949.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Bloc-notes - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-868825949.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\system32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32s32net.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [eMuleAutoStart] D:\Program Files\eMule\emule.exe -AutoStart
O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32s32net.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Page à noter (Google Bloc-notes) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-868825949.dll/gn_menu1.html
O8 - Extra context menu item: À noter (Google Bloc-notes) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-868825949.dll/gn_menu2.html
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - d:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - d:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Destrio5 · Answer

Salut,

Je te fais une procédure ;)

Destrio5 · Answer

--> Télécharge haxfix.exe sur ton Bureau.
--> Ferme toutes les applications en cours. Double-clique sur haxfix.exe pour installer haxfix (L'installation standard est c:\program Files\haxfix).
--> Coche Create a desktop icon.
--> Clique Next.
--> Quand l'installation est terminée, assure-toi que Launch HaxFix est coché.
--> Clique Finish.

Une "fenêtre DOS" à fond rouge s'ouvre avec les options suivantes:

1. Make logfile (créer un rapport)
2. Run auto fix (lancer la réparation en mode automatique)
3. Run manual fix (lancer la réparation en mode manuel)
E. Exit Haxfix (quitter Haxfix)

--> Selectionne l'option 1 (Make logfile) en tapant 1 puis taper Entrée.
--> Haxfix va analyser le système. Quand il a fini, un rapport s'ouvrira : haxlog.txt > (c:\haxfix.txt)
--> Poste ce rapport.

afideg · Answer

Up   ;)
Al.

zazooxav · Answer

ok ca mis du temps mais il est sortit et maintenant jai bien toutes les options 1234U et E que tu m'as dites 
le rapport :
HAXFIX logfile - by Marckie

version 5.059
30/01/2009  15:50:42,70
running from C:\HaxFix

--- Checking for Haxdoor ---

checking for a3d files
a3d files not found

checking for matching notify keys
matching notify keys found 
AtiE
 
checking for matching services
matching services found
CmBatt
 
checking for matching safeboot services
no matching safeboot services found


--- Checking for Goldun - Spybanker ---

checking for SSODL keys
no ssodl keys found

checking for notify keys
no notify keys found

checking for services
no services found

checking for random used files and services
-- these files are not necessarily malicious
-- scanning all folders
C:\Documents and Settings\xavier\Bureau\Momo\Comptes_Maud.xls
C:\Documents and Settings\xavier\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ad 24b\Éléments en 649\5CF83C64-0000005F.eml
C:\Program Files\Windows Media Connect 2\wmccds.exe
C:\Program Files\Windows Media Connect 2\WMCCFG.exe
C:\Program Files\Adobe\Reader 8.0\Reader\plug_inseflow.FRA
C:\Program Files\OpenOffice.org 3\program\unopkg.com
C:\Program Files\OpenOffice.org 3\Basis\program\onlinecheck.dll
C:\Program Files\OpenOffice.org 3\Basis\share	emplate\fr\wizardeport\cnt-05.ott
C:\Program Files\Softwin\BitDefender10	rufos.dll
C:\WINDOWS\$NtServicePackUninstall$\fxsperf.dll
C:\WINDOWS\$NtServicePackUninstall$\snmptrap.exe
C:\WINDOWS\$NtServicePackUninstall$	ty.dll
C:\WINDOWS\$NtUninstallwmp11$\asferror.dll
C:\WINDOWS\Fonts\ega40857.fon
C:\WINDOWS\Fonts\modern.fon
C:\WINDOWS\system32\kbdjpn.dll
C:\WINDOWS\system32\uwdf.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\migregdb.exe
C:\WINDOWS\assembly\GAC\Accessibility\1.0.3300.0__b03f5f7f11d50a3a\Accessibility.dll
C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\Accessibility.dll
C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscortim.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\aspnet_compiler.resources.dll
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\asferror.dll
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\asferror.dll
C:\WINDOWS\ServicePackFiles\i386\ident2.htm
C:\WINDOWS\ServicePackFiles\i386\asferror.dll
C:\WINDOWS\ServicePackFiles\i386\fxsperf.dll
C:\WINDOWS\ServicePackFiles\i386\mscortim.dll
C:\WINDOWS\ServicePackFiles\i386\snmptrap.exe
C:\WINDOWS\ServicePackFiles\i386	ty.dll
C:\WINDOWS\system32\dllcache\infoctrs.dll
C:\WINDOWS\system32\dllcache\kbdjpn.dll
C:\WINDOWS\system32\dllcache\modern.fon
C:\WINDOWS\system32\fr-fr\icardie.dll.mui
C:\WINDOWS\system32\oobe\setup\ident2.htm
C:\WINDOWS\system32\spool\drivers\w32x86\3\sx450spp.BPD
no matching random used services found 

checking for browser helper objects
no known browser helper objects found

checking for appinit files
no files found

checking for possible infected files
please submit these file here: https://www.bleepingcomputer.com/submit-malware.php?channel=11
C:\WINDOWS\system32\SMSUnins.dll] D41A8BEF2CC29091E168261F7DE0E389

checking for Active Setup Installed Components
no known Active Setup Installed Components found

checking iexplore.exe
iexplore.exe is not infected 


--- Checking for other Goldun, Spybanker and Haxdoor files ---
C:\WINDOWS\system32\bdod.bin


--- Catchme logfile - thank you Gmer ---

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-30 15:59:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:47,3a,a7,30,e9,96,c0,6a,f8,36,d7,45,e1,44,a7,c6,5a,8e,07,e3,4e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,8e,27,a8,a0,23,c5,6c,07,fe,b6,68,cd,77,ca,aa,9d,..
"khjeh"=hex:03,08,fe,f6,56,ac,d0,79,27,57,7d,d5,f1,b0,84,bb,05,9b,1b,46,7d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6a,d2,a1,cf,97,80,75,24,3d,f7,a9,96,09,1d,7a,2c,9c,f5,06,2e,68,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:1c,f0,16,47,a7,aa,dc,34,ab,f4,02,13,11,1a,a6,e8,a6,79,b6,d2,ed,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:af,7c,f9,62,ea,85,36,3c,5e,4d,71,f6,85,22,f1,3d,82,a4,19,87,cb,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:eb9c0b1b
"s2"=dword:fdd44c50
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:47,3a,a7,30,e9,96,c0,6a,f8,36,d7,45,e1,44,a7,c6,5a,8e,07,e3,4e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,8e,27,a8,a0,23,c5,6c,07,fe,b6,68,cd,77,ca,aa,9d,..
"khjeh"=hex:03,08,fe,f6,56,ac,d0,79,27,57,7d,d5,f1,b0,84,bb,05,9b,1b,46,7d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6a,d2,a1,cf,97,80,75,24,3d,f7,a9,96,09,1d,7a,2c,9c,f5,06,2e,68,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:1c,f0,16,47,a7,aa,dc,34,ab,f4,02,13,11,1a,a6,e8,a6,79,b6,d2,ed,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:af,7c,f9,62,ea,85,36,3c,5e,4d,71,f6,85,22,f1,3d,82,a4,19,87,cb,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:a4,39,34,cf,8a,7e,b3,9d,ee,31,03,03,40,15,dd,b3,6e,05,77,ec,fe,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,8e,27,a8,a0,23,c5,6c,07,fe,b6,68,cd,77,ca,aa,9d,..
"khjeh"=hex:ab,ca,47,a0,bd,1b,70,c5,64,48,81,25,20,26,c3,34,56,49,31,00,ec,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a9,14,7d,b7,a4,ea,76,b6,6d,0e,51,43,53,b6,da,8c,c2,90,46,ac,32,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:bb,8f,15,58,ca,02,67,8a,d2,2c,00,39,e1,58,34,a4,93,55,bb,81,3b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:af,7c,f9,62,ea,85,36,3c,5e,4d,71,f6,85,22,f1,3d,82,a4,19,87,cb,..
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000002
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000007
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000023
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000007
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\MRxDAV\EncryptedDirectories]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:47,3a,a7,30,e9,96,c0,6a,f8,36,d7,45,e1,44,a7,c6,5a,8e,07,e3,4e,..

[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,8e,27,a8,a0,23,c5,6c,07,fe,b6,68,cd,77,ca,aa,9d,..
"khjeh"=hex:03,08,fe,f6,56,ac,d0,79,27,57,7d,d5,f1,b0,84,bb,05,9b,1b,46,7d,..

[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6a,d2,a1,cf,97,80,75,24,3d,f7,a9,96,09,1d,7a,2c,9c,f5,06,2e,68,..

[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:1c,f0,16,47,a7,aa,dc,34,ab,f4,02,13,11,1a,a6,e8,a6,79,b6,d2,ed,..

[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:af,7c,f9,62,ea,85,36,3c,5e,4d,71,f6,85,22,f1,3d,82,a4,19,87,cb,..

scanning hidden registry entries ...

scanning hidden files ...

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\2RAHJDZ1\_getmirror[1].xml 158 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


--- Analysing Catchme logfile ---

no matching regkeys found


Finished!

Destrio5 · Answer

Envoie ce fichier : C:\WINDOWS\system32\SMSUnins.dll

Sur ce site :
https://www.bleepingcomputer.com/submit-malware.php?channel=11

zazooxav · Answer

C'est bon c'est envoyé :)
 je dois attendre une réponse sur leur site ??

Destrio5 · Answer

Fais ceci : "2. Run auto fix (lancer la réparation en mode automatique)"

zazooxav · Answer

j'ai relancé avec l'option 2 ca a tourné puis rebooté
au redemarrage Spybot ma demandé si je devais autoriser la modification de Explorer.exe par explorer.exe ca venait de Shell
jai mis refuser je sais pas exactement ce que c'est
 
sinon je te post le log de haxfix
HAXFIX logfile - by Marckie

version 5.059
30/01/2009  16:41:50,75 

--- Auto Haxdoorfix ---


Haxdoorfix Part 1

matching notifykey found: AtiExt

searching for matching services
services not found, haxdoorkey AtiE not added to delete

no infections found


Haxdoorfix Part 2

searching for notifykeys
no notifykeys found

searching for services
no services found

searching for safeboot services
no safeboot services found


--- Goldun- and SpyBankerfix ---


searching for other goldun- spybanker- and haxdoorfiles:
C:\WINDOWS\system32\bdod.bin
 
checking iexplore.exe
iexplore.exe is not infected 

searching for SSODLkeys
no SSODLkeys found

searching for browser helper objects
no known browser helper objects found

searching for appinit files

checking for Active Setup Installed Components
no known Active Setup Installed Components found

searching for notifykeys
no notify keys found

searching for services
no services found


--- Registrysettings ---

not necessary 


.....rebooting the computer.....


--- searching for ssodlkeys ---

not necessary  


--- searching for notifykeys ---

not necessary  


--- searching for services ---

not necessary  


--- searching for safeboot services ---

not necessary  


--- searching for browser helper objects ---



--- searching for active setup installed components ---

no known Active Setup Installed Components found


--- searching for files ---

C:\WINDOWS\system32\bdod.bin found
deleting C:\WINDOWS\system32\bdod.bin
C:\WINDOWS\system32\bdod.bin has been deleted


--- searching for other files in the system32 folder ---


--- searching for other files in windows folder ---

no other files found in the windows folder 


--- searching for a3d files ---

no a3d files found 


--- checking registry settings ---

not necessary


--- Catchme logfile ---

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-30 16:46:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:47,3a,a7,30,e9,96,c0,6a,f8,36,d7,45,e1,44,a7,c6,5a,8e,07,e3,4e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,8e,27,a8,a0,23,c5,6c,07,fe,b6,68,cd,77,ca,aa,9d,..
"khjeh"=hex:03,08,fe,f6,56,ac,d0,79,27,57,7d,d5,f1,b0,84,bb,05,9b,1b,46,7d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6a,d2,a1,cf,97,80,75,24,3d,f7,a9,96,09,1d,7a,2c,9c,f5,06,2e,68,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:1c,f0,16,47,a7,aa,dc,34,ab,f4,02,13,11,1a,a6,e8,a6,79,b6,d2,ed,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:af,7c,f9,62,ea,85,36,3c,5e,4d,71,f6,85,22,f1,3d,82,a4,19,87,cb,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:eb9c0b1b
"s2"=dword:fdd44c50
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:47,3a,a7,30,e9,96,c0,6a,f8,36,d7,45,e1,44,a7,c6,5a,8e,07,e3,4e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,8e,27,a8,a0,23,c5,6c,07,fe,b6,68,cd,77,ca,aa,9d,..
"khjeh"=hex:03,08,fe,f6,56,ac,d0,79,27,57,7d,d5,f1,b0,84,bb,05,9b,1b,46,7d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6a,d2,a1,cf,97,80,75,24,3d,f7,a9,96,09,1d,7a,2c,9c,f5,06,2e,68,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:1c,f0,16,47,a7,aa,dc,34,ab,f4,02,13,11,1a,a6,e8,a6,79,b6,d2,ed,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:af,7c,f9,62,ea,85,36,3c,5e,4d,71,f6,85,22,f1,3d,82,a4,19,87,cb,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:a4,39,34,cf,8a,7e,b3,9d,ee,31,03,03,40,15,dd,b3,6e,05,77,ec,fe,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,8e,27,a8,a0,23,c5,6c,07,fe,b6,68,cd,77,ca,aa,9d,..
"khjeh"=hex:ab,ca,47,a0,bd,1b,70,c5,64,48,81,25,20,26,c3,34,56,49,31,00,ec,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a9,14,7d,b7,a4,ea,76,b6,6d,0e,51,43,53,b6,da,8c,c2,90,46,ac,32,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:bb,8f,15,58,ca,02,67,8a,d2,2c,00,39,e1,58,34,a4,93,55,bb,81,3b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:af,7c,f9,62,ea,85,36,3c,5e,4d,71,f6,85,22,f1,3d,82,a4,19,87,cb,..
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000002
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000007
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000023
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000004
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties]
"DeviceType"=dword:00000007
"DeviceCharacteristics"=dword:00000100
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\MRxDAV\EncryptedDirectories]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:47,3a,a7,30,e9,96,c0,6a,f8,36,d7,45,e1,44,a7,c6,5a,8e,07,e3,4e,..

[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,8e,27,a8,a0,23,c5,6c,07,fe,b6,68,cd,77,ca,aa,9d,..
"khjeh"=hex:03,08,fe,f6,56,ac,d0,79,27,57,7d,d5,f1,b0,84,bb,05,9b,1b,46,7d,..

[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6a,d2,a1,cf,97,80,75,24,3d,f7,a9,96,09,1d,7a,2c,9c,f5,06,2e,68,..

[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:1c,f0,16,47,a7,aa,dc,34,ab,f4,02,13,11,1a,a6,e8,a6,79,b6,d2,ed,..

[HKEY_LOCAL_MACHINE\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:af,7c,f9,62,ea,85,36,3c,5e,4d,71,f6,85,22,f1,3d,82,a4,19,87,cb,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


--- checking for random used files and services ---
- these files and service are not necessarily malicious
- these files and services will not be deleted by HaxFix
C:\Documents and Settings\xavier\Bureau\Momo\Comptes_Maud.xls
C:\Documents and Settings\xavier\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ad 24b\Éléments en 649\5CF83C64-0000005F.eml
C:\Program Files\Windows Media Connect 2\wmccds.exe
C:\Program Files\Windows Media Connect 2\WMCCFG.exe
C:\Program Files\Adobe\Reader 8.0\Reader\plug_inseflow.FRA
C:\Program Files\OpenOffice.org 3\program\unopkg.com
C:\Program Files\OpenOffice.org 3\Basis\program\onlinecheck.dll
C:\Program Files\OpenOffice.org 3\Basis\share	emplate\fr\wizardeport\cnt-05.ott
C:\Program Files\Softwin\BitDefender10	rufos.dll
C:\WINDOWS\$NtServicePackUninstall$\fxsperf.dll
C:\WINDOWS\$NtServicePackUninstall$\snmptrap.exe
C:\WINDOWS\$NtServicePackUninstall$	ty.dll
C:\WINDOWS\$NtUninstallwmp11$\asferror.dll
C:\WINDOWS\Fonts\ega40857.fon
C:\WINDOWS\Fonts\modern.fon
C:\WINDOWS\system32\kbdjpn.dll
C:\WINDOWS\system32\uwdf.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\migregdb.exe
C:\WINDOWS\assembly\GAC\Accessibility\1.0.3300.0__b03f5f7f11d50a3a\Accessibility.dll
C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\Accessibility.dll
C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscortim.dll
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fr\aspnet_compiler.resources.dll
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\asferror.dll
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\asferror.dll
C:\WINDOWS\ServicePackFiles\i386\ident2.htm
C:\WINDOWS\ServicePackFiles\i386\asferror.dll
C:\WINDOWS\ServicePackFiles\i386\fxsperf.dll
C:\WINDOWS\ServicePackFiles\i386\mscortim.dll
C:\WINDOWS\ServicePackFiles\i386\snmptrap.exe
C:\WINDOWS\ServicePackFiles\i386	ty.dll
C:\WINDOWS\system32\dllcache\infoctrs.dll
C:\WINDOWS\system32\dllcache\kbdjpn.dll
C:\WINDOWS\system32\dllcache\modern.fon
C:\WINDOWS\system32\fr-fr\icardie.dll.mui
C:\WINDOWS\system32\oobe\setup\ident2.htm
C:\WINDOWS\system32\spool\drivers\w32x86\3\sx450spp.BPD
no matching services found 


Finished

Destrio5 · Answer

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

- Double-clique sur RSIT.exe afin de lancer le programme.

- Clique sur Continue à l'écran Disclaimer.

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.

afideg · Answer

Salut Destrio

O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe
O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe 

rs32net.exe

https://www.pc-infopratique.com/forum-informatique/urgent-virus-symantec-email-proxy-vt-40209.html
Prevx1 V2 2008.10.15 Malicious Software 
File size: 23040 bytes 
MD5...: 56db9888acfc7015fd6cbbaa75fc94b3

https://forum.malekal.com/viewtopic.php?f=3&t=16603&start=0  ==> supprimé par ComboFix


Bizarre ce truc !
Al.

Destrio5 · Answer

1/

--> Démarre Spybot, clique sur Mode, coche Mode avancé.
--> A gauche, clique sur Outils, puis sur Résident.
--> Décoche la case devant Résident "TeaTimer" :
http://apu.mabul.org/up/5/apu-5-gpdx9e06cwz2dypom2q7n6nc.jpg
--> Quitte Spybot.


2/

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau.

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:files 
C:\WINDOWS\System32\rs32net.exe 

:reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56f85526-e48a-11dc-b239-000d56eb22c7}] 
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rs32net] 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] 
"rs32net"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] 
"rs32net"=-

:commands
[purity]
[emptytemp]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

zazooxav · Answer

Voila le rapport
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\WINDOWS\System32s32net.exe not found.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56f85526-e48a-11dc-b239-000d56eb22c7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupregs32net\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\rs32net not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\rs32net not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\xavier\LOCALS~1\Temp\~DFCEDA.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_17c.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_398.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_588.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\ZLT0412c.TMP scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\ZLT0412f.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01312009_100857

Files moved on Reboot...
C:\DOCUME~1\xavier\LOCALS~1\Temp\~DFCEDA.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS	emp\Perflib_Perfdata_17c.dat not found!
File C:\WINDOWS	emp\Perflib_Perfdata_398.dat not found!
File C:\WINDOWS	emp\Perflib_Perfdata_588.dat not found!
File C:\WINDOWS	emp\ZLT0412c.TMP not found!
File C:\WINDOWS	emp\ZLT0412f.TMP not found!


Pour info j'ai fait hier soir ce que préconisait Afidegn j'ai téléchargé Combofix, et apres son éxécution qui m'as viré rs32net.exe, je ne retrouvais plus ces 2 clés vérollées dans la base de registre.
Et ce malgré plusieurs scans de MBAM et Spybot.
Cependant apres une demi heure et ceci sans etre connecté au net ces 2 clés liées a rs32net.exe reviennent tout le temps.
Je ne sai plus trop quoi faire j'ai l'impression d'y etre presque et a chaque fois elles reviennent.
En tout cas merci encore pour toute l'aide que tu me fournit.

zazooxav · Answer

Le fait que OTmoveit n'ai pa trouvé les fichiers ciblés vient peut etre du fait que Combofix que je venais d'éxécuter les avaient enlevé non ?

zazooxav · Answer

up :)

Destrio5 · Answer

Si tu as fait un scan ComboFix, poste le rapport (C:\ComboFix).

zazooxav · Answer

Salut Destrio,
J'ai comme l'impression que c'est reglé, j'avais utilisé Combofix hier, ca m'avait viré des trucs surtout les 2 clés de registre Rs32net.exe qui étaient la base de l'infection je pense.
depuis j'ai fait des scans avec Mbam, Spybot, CCleaner et Antivir et ils ne trouvent plus rien du tout.
je te poste néanmoins le rapport combofix, dis moi si il reste encore des trucs à faire pour etre absolument sur d'etre clean.
Encore merci pour toute ton aide

ComboFix 09-01-31.01 - xavier 2009-02-01 8:59:31.6 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.511.232 [GMT 1:00]
Lancé depuis: c:\documents and settings\xavier\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
AV: BitDefender Internet Security v10 *On-access scanning disabled* (Outdated)
FW: BitDefender Internet Security v10 *disabled*
FW: ZoneAlarm Firewall *enabled*
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FCI

((((((((((((((((((((((((((((( Fichiers créés du 2009-01-01 au 2009-02-01 ))))))))))))))))))))))))))))))))))))
.

2009-01-31 10:53 . 2009-01-31 10:53 <REP> d-------- c:\program files\Avira
2009-01-31 10:53 . 2009-01-31 10:53 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-01-30 19:11 . 2009-01-30 19:11 250 --a------ c:\windows\gmer.ini
2009-01-30 18:39 . 2009-01-31 09:43 172 --a------ c:\windows\wininit.ini
2009-01-30 18:12 . 2009-01-30 18:12 <REP> d-------- c:\windows\system32\XPSViewer
2009-01-30 18:12 . 2009-01-30 18:12 <REP> d-------- c:\program files\Reference Assemblies
2009-01-30 18:12 . 2009-01-30 18:12 <REP> d-------- c:\program files\MSBuild
2009-01-30 17:25 . 2009-02-01 09:03 938,016 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-01-30 17:25 . 2009-02-01 09:03 13,112 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-01-30 17:19 . 2009-01-30 17:19 <REP> d-------- c:\documents and settings\All Users\Application Data\MailFrontier
2009-01-30 17:17 . 2009-02-01 08:54 <REP> d-------- c:\windows\Internet Logs
2009-01-30 17:10 . 2009-01-31 01:06 <REP> d-------- c:\program files\trend micro
2009-01-30 15:05 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-01-30 15:03 . 2009-01-30 15:03 <REP> d-------- c:\windows\system32\xlive
2009-01-30 15:02 . 2009-01-30 15:04 <REP> d-------- c:\program files\Microsoft Games for Windows - LIVE
2009-01-29 13:26 . 2009-01-29 13:26 61,440 --a------ c:\windows\system32\drivers\fbhlxkgc.sys
2009-01-29 13:10 . 2009-01-29 13:10 <REP> d-------- c:\documents and settings\xavier\Application Data\Malwarebytes
2009-01-29 13:09 . 2009-01-29 13:09 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-29 13:09 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-29 13:09 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-24 18:08 . 2009-01-30 16:42 <REP> d-------- c:\windows\system32\m3V02
2009-01-10 10:57 . 2009-01-31 20:37 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-30 16:44 --------- d-----w c:\program files\Fichiers communs\Softwin
2009-01-20 09:04 --------- d-----w c:\program files\Google
2009-01-16 20:43 --------- d-----w c:\documents and settings\xavier\Application Data\uTorrent
2009-01-15 12:14 --------- d-----w c:\documents and settings\xavier\Application Data\U3
2008-12-31 07:45 --------- d-----w c:\documents and settings\xavier\Application Data\Bioshock
2008-12-29 14:14 --------- d-----w c:\program files\Java
2008-12-29 09:27 --------- d-----w c:\program files\PokerStars
2008-12-25 21:59 --------- d-----w c:\program files\Samsung
2008-12-20 17:05 --------- d-----w c:\documents and settings\All Users\Application Data\Tages
2008-12-20 17:03 278,984 ----a-w c:\windows\system32\drivers\atksgt.sys
2008-12-20 17:03 25,416 ----a-w c:\windows\system32\drivers\lirsgt.sys
2008-12-20 16:58 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-12-19 12:45 --------- d-----w c:\documents and settings\All Users\Application Data\2DBoy
2008-12-17 13:25 --------- d-----w c:\program files\Windows Live
2008-12-17 13:25 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2008-12-17 13:23 --------- d-----w c:\program files\Microsoft
2008-12-17 13:22 --------- d-----w c:\program files\Windows Live SkyDrive
2008-12-17 13:13 --------- d-----w c:\program files\Fichiers communs\Windows Live
2008-12-12 21:38 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment
2008-12-12 18:13 --------- d-----w c:\documents and settings\All Users\Application Data\America's Army Deploy Client
2008-12-12 16:43 --------- d-----w c:\documents and settings\xavier\Application Data\YuLeech
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-01 68856]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-29 136600]
"ZoneAlarm Client"="d:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"ZCfgSvc.exe"="c:\windows\system32\ZCfgSvc.exe" [2005-07-05 639040]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-06-27 135168]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"="d:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-01-14 399504]
"Malwarebytes Anti-Malware (reboot)"="d:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-01-14 1273488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2005-07-05 00:33 188482 c:\windows\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\c:\[u]0/uautocheck autochk *\[u]0/u

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati0xcxx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\eMule\\emule.exe"=
"d:\\Program Files\\Steam\\steamapps\\steamzazoo\\counter-strike source\\hl2.exe"=
"d:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

S0 ati0xcxx;ati0xcxx;c:\windows\system32\Drivers\ati0xcxx.sys --> c:\windows\system32\Drivers\ati0xcxx.sys [?]
S1 8f8a8bfc;8f8a8bfc;c:\windows\system32\drivers\8f8a8bfc.sys --> c:\windows\system32\drivers\8f8a8bfc.sys [?]
S3 ATIXPGAA;ATIXPGAA;c:\dell\drivers\R74793\atixpgaa.sys [2006-09-16 11648]
S4 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56f85525-e48a-11dc-b239-000d56eb22c7}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7061011-6f42-11db-b184-8000600fe800}]
\Shell\AutoRun\command - E:\CheckRun.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc54b271-43fc-11db-b146-f48fbf5cdb5b}]
\Shell\AutoRun\command - E:\autorun.exe
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Page à noter (Google Bloc-notes) - c:\program files\Google\Google Notebook\gnotes1.0.2.19-868825949.dll/gn_menu1.html
IE: À noter (Google Bloc-notes) - c:\program files\Google\Google Notebook\gnotes1.0.2.19-868825949.dll/gn_menu2.html
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-01 09:05:30
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\sfcure01]
"ImagePath"="S\[u]0/u0y\[u]0/u0s\[u]0/u0t\[u]0/u0e\[u]0/u0m\[u]0/u03\[u]0/u02\[u]0/u0\\[u]0/u0d\[u]0/u0r\[u]0/u0i\[u]0/u0v\[u]0/u0e\[u]0/u0r\[u]0/u0s\[u]0/u0\\[u]0/u0s\[u]0/u0f\[u]0/u0c\[u]0/u0u\[u]0/u0r\[u]0/u0e\[u]0/u00\[u]0/u01\[u]0/u0.\[u]0/u0s\[u]0/u0y\[u]0/u0s"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1177238915-2111687655-1343024091-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1177238915-2111687655-1343024091-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000004
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1177238915-2111687655-1343024091-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000003
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1177238915-2111687655-1343024091-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000002
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1177238915-2111687655-1343024091-1003\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]
"Name"="Outlook"
"DisplayName"="Microsoft Outlook"
"Param1"="Outlook"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:00000002

[HKEY_USERS\S-1-5-21-1177238915-2111687655-1343024091-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:97,f3,30,47,44,93,c4,48,46,ef,af,2a,bb,31,1f,be,d5,86,0d,ef,e8,49,3c,
4d,7e,ee,f0,b3,ac,62,e7,fa,4a,11,c4,a4,cd,5d,90,88,87,52,ba,1b,1c,c4,da,07,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-1177238915-2111687655-1343024091-1003\Software\SecuROM\License information*]
"datasecu"=hex:58,55,34,ad,30,59,f7,d3,22,05,92,c4,c7,a3,7a,68,07,32,ef,d3,be,
73,46,a1,05,df,a8,79,e1,b7,55,81,2b,bd,6e,17,43,6f,a2,e3,a3,fb,cb,9c,8e,19,\
"rkeysecu"=hex:b1,f5,ad,aa,30,5a,1e,bf,04,ed,7c,9e,b8,19,57,2c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,e7,ea,5a,1a,14,
06,88,e3,c8,28,51,af,b0,29,a3,98,8a,a4,7d,91,8e,dd,0c,71,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,89,95,e7,d2,38,
95,69,06,71,3b,04,66,8b,46,0d,96,40,df,68,41,ef,ba,b1,1e,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,90,ec,86,30,b1,
68,7a,1c,25,da,ec,7e,55,20,c9,26,d4,0d,ac,1b,4e,18,81,c9,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,f0,02,b2,d0,0e,
0c,1e,32,3e,1e,9e,e0,57,5a,93,61,df,2a,b1,de,d7,a8,94,08,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:e9,02,6c,fa,fb,1d,47,57,51,f0,c7,ee,d8,
bc,1d,52,cd,44,cd,b9,a6,33,6c,cd,82,50,c3,7b,ee,39,51,87,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,b3,97,2d,31,3e,
3d,28,bb,b0,18,ed,a7,3f,8d,37,a4,21,99,a3,64,5f,85,54,ed,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,3b,f9,be,b9,93,
df,0b,ce,31,77,e1,ba,b1,f8,68,02,b1,dc,16,b5,01,a8,1e,a4,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,14,51,ca,28,20,
3a,28,15,83,6c,56,8b,a0,85,96,ab,f6,1f,23,1f,1a,66,b5,96,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:b2,46,9a,e2,1b,fe,1b,94,bf,76,ff,7f,4f,
31,c7,51,51,fa,6e,91,28,9e,14,cc,08,64,c8,b3,52,ed,f4,ee,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,77,9f,a9,27,fe,
3a,bf,8f,b1,cd,45,5a,a8,c4,f8,b9,a9,4b,c1,28,75,41,a1,93,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,77,f0,63,79,84,
e4,02,55,e3,0e,66,d5,eb,bc,2f,6b,0f,76,98,c3,bf,57,02,7d,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:05,73,21,dd,54,d8,4a,c5,40,a8,55,1c,4f,
6a,b3,ca,fa,ea,66,7f,d4,3b,6b,70,31,c8,9d,65,8b,a2,cf,da,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(936)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LgNotify.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\S24EvMon.exe
c:\windows\system32\ZoneLabs\vsmon.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\1XConfig.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\windows\system32\RegSrvc.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Heure de fin: 2009-02-01 9:09:48 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-02-01 08:09:43

Avant-CF: 3 077 750 784 octets libres
Après-CF: 3,029,884,928 octets libres

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
270 --- E O F --- 2009-01-31 01:01:52

Destrio5 · Answer

Tu as deux antivirus ?

---> Menu Démarrer > Exécuter > Tape combofix /u et valide.

---> Télécharge JavaRa.zip (de Paul 'Prm753' McLain et Fred de Vries) sur ton Bureau.
* Décompresse le fichier sur le Bureau (Clic droit > Extraire tout).
* Double-clique sur le répertoire JavaRa.
* Puis double-clique sur le fichier JavaRa.exe (le exe peut ne pas s'afficher).
* Choisis Français puis clique sur Select.
* Clique sur Effacer les anciennes versions.
* Clique sur Oui pour confirmer. Laisse travailler et clique ensuite sur OK, puis une deuxième fois sur OK.
* Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse.
* Ferme l'application.

Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log.

zazooxav · Answer

Oui j'avais avast mais je suis passé a antivir suite aux posts concernant la faible securité d'avast.
Je l'ai désormais désinstallé proprement.
Sinon Antivir m'a sortit 3 alertes concernant Combofix, jai considéré que c'etait des faux positifs mais si tu pouvais me rassurer ca serait cool. :)

JavaRa 1.13 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sun Feb 01 18:11:41 2009

Found and removed: C:\Program Files\Java\jre1.6.0_03

Found and removed: C:\Program Files\Java\jre1.6.0_04

Found and removed: C:\Program Files\Java\jre1.6.0_07

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Classes\JavaPlugin.160_03

Found and removed: SOFTWARE\Classes\JavaPlugin.160_04

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_04

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_04

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610004

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160040}

Found and removed: Software\Classes\JavaPlugin.160_03

Found and removed: Software\Classes\JavaPlugin.160_04

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_04

Found and removed: Software\JavaSoft\Java2D\1.6.0_03

Found and removed: Software\JavaSoft\Java2D\1.6.0_04

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_04

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_03\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_04\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_03\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_04\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_07\bin\

------------------------------------

Finished reporting.

Destrio5 · Answer

"Sinon Antivir m'a sortit 3 alertes concernant Combofix, jai considéré que c'etait des faux positifs mais si tu pouvais me rassurer ca serait cool. :)"
---> Oui, ce sont bien des faux-positifs.

---> Supprime JavaRa.

---> Double-clique sur l'icône d'Antivir (Parapluie) dans la barre des tâches.

---> Dans Antivir, choisis Outils puis Configuration.

---> Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages.

---> Fais un scan complet et poste le rapport.

zazooxav · Answer

Je pense que la on est pas mal :)


Avira AntiVir Personal
Date de création du fichier de rapport : dimanche 1 février 2009  19:22

La recherche porte sur 1302306 souches de virus.

Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme :      Windows XP
Version de Windows :(Service Pack 3)  [5.1.2600]
Mode Boot :       Démarré normalement
Identifiant :     SYSTEM
Nom de l'ordinateur :ZAZOOPORTABLE

Informations de version :
BUILD.DAT     : 8.2.0.52       16931 Bytes  02/12/2008 14:55:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  18/11/2008 08:21:00
AVSCAN.DLL    : 8.1.4.1        49921 Bytes  21/07/2008 13:44:27
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 12:44:16
LUKERES.DLL   : 8.1.4.0        13057 Bytes  04/07/2008 07:30:27
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  27/10/2008 11:30:36
ANTIVIR1.VDF  : 7.1.1.113    2817536 Bytes  14/01/2009 09:55:23
ANTIVIR2.VDF  : 7.1.1.207    1359360 Bytes  30/01/2009 09:55:36
ANTIVIR3.VDF  : 7.1.1.208       2048 Bytes  30/01/2009 09:55:37
Version du moteur: 8.2.0.70  
AEVDF.DLL     : 8.1.1.0       106868 Bytes  31/01/2009 09:56:00
AESCRIPT.DLL  : 8.1.1.39      344443 Bytes  31/01/2009 09:55:58
AESCN.DLL     : 8.1.1.6       127348 Bytes  31/01/2009 09:55:57
AERDL.DLL     : 8.1.1.3       438645 Bytes  04/11/2008 13:58:38
AEPACK.DLL    : 8.1.3.5       393588 Bytes  31/01/2009 09:55:56
AEOFFICE.DLL  : 8.1.0.33      196987 Bytes  31/01/2009 09:55:54
AEHEUR.DLL    : 8.1.0.89     1569143 Bytes  31/01/2009 09:55:51
AEHELP.DLL    : 8.1.2.0       119159 Bytes  31/01/2009 09:55:41
AEGEN.DLL     : 8.1.1.12      328053 Bytes  31/01/2009 09:55:40
AEEMU.DLL     : 8.1.0.9       393588 Bytes  14/10/2008 10:05:56
AECORE.DLL    : 8.1.6.3       176501 Bytes  31/01/2009 09:55:38
AEBB.DLL      : 8.1.0.3        53618 Bytes  14/10/2008 10:05:56
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 08:40:02
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 09:27:58
AVREP.DLL     : 8.0.0.2        98344 Bytes  31/07/2008 12:02:15
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 11:26:37
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 08:29:19
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 12:27:46
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 12:49:36
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 12:05:07
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  04/07/2008 07:23:16
RCTEXT.DLL    : 8.0.52.1       86273 Bytes  17/07/2008 10:08:43

Configuration pour la recherche actuelle :
Nom de la tâche..................: Contrôle intégral du système
Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\sysscan.avp
Documentation....................: bas
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: C:, D:, 
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: marche
Fichier mode de recherche........: Sélection de fichiers intelligente
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Types d'archives divergents......: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, 
Heuristique de macrovirus........: marche
Heuristique fichier..............: élevé
Catégories de dangers divergentes: +APPL,+GAME,+JOKE,+PCK,+SPR,

Début de la recherche : dimanche 1 février 2009  19:22

La recherche d'objets cachés commence.
'48997' objets ont été contrôlés, '0' objets cachés ont été trouvés.

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wlcomm.exe' - '1' module(s) sont contrôlés
Processus de recherche 'iexplore.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiapsrv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'TeaTimer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'GoogleToolbarNotifier.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'msnmsgr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'atiptaxx.exe' - '1' module(s) sont contrôlés
Processus de recherche 'PRONoMgr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'zlclient.exe' - '0' module(s) sont contrôlés
Processus de recherche 'jusched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'RegSrvc.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sqlservr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'jqs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche '1XConfig.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ZCfgSvc.exe' - '1' module(s) sont contrôlés
Processus de recherche 'vsmon.exe' - '0' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'S24EvMon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'38' processus ont été contrôlés avec '38' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
    [INFO]      Aucun virus trouvé !

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
    [INFO]      Aucun virus trouvé !
Secteur d'amorçage 'D:\'
    [INFO]      Aucun virus trouvé !

La recherche sur les renvois aux fichiers exécutables (registre) commence.
Le registre a été contrôlé ( '58' fichiers).


La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\'
C:\pagefile.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\WINDOWS\system32\drivers\sptd.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
Recherche débutant dans 'D:\'


Fin de la recherche : dimanche 1 février 2009  19:59
Temps nécessaire: 37:06 Minute(s)

La recherche a été effectuée intégralement

   5449 Les répertoires ont été contrôlés
 200377 Des fichiers ont été contrôlés
      0 Des virus ou programmes indésirables ont été trouvés
      0 Des fichiers ont été classés comme suspects
      0 Des fichiers ont été supprimés
      0 Des virus ou programmes indésirables ont été réparés
      0 Les fichiers ont été déplacés dans la quarantaine
      0 Les fichiers ont été renommés
      2 Impossible de contrôler des fichiers
 200375 Fichiers non infectés
   2956 Les archives ont été contrôlées
      2 Avertissements
      0 Consignes
  48997 Des objets ont été contrôlés lors du Rootkitscan
      0 Des objets cachés ont été trouvés

PB troyen + log hijack

22 réponses

Votre réponse

Discussions similaires

Newsletters