un ver dans mon ordi Fermé

Question

Bonjour,
voile mon ordinateur et infecte par un ver et impossible de l'enlevai ou désinfecter par les anti-virus, le ver il et reconnue par F-Secure Inetrnet Security 2009 (Worm.win32.Mabezat.b) et Panda 2009 (w32.Mabezat.c.worm), alors svp aider moi si quelqu'un a une solution ou a était déjà infecter par se VERRRRR, Merci pour tout aide

Clo4clo · Answer

Dsl je ne pourrais pas t'aider je n'en ai jamais eu ...

etienne76400 · Answer

tu a du télécharger une démo de worms...
moi aussi je l'ai ue en fait il faut désinstaller le programme ou il est le plus vite possible et NE JAMAIS LE RéINSTALLER
a+
PS:LES VER SA FAIT BUGER TON ORDI

Destrio5 · Answer

Salut,

C'est une infection difficile à retirer.

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

Hombrez87 · Answer

salut et merci Destrio5
voila j'ai fait comme tu ma dit et voila le résultat
***************************************
ComboFix 09-02-08.01 - Kéfayfi 2009-02-08 22:58:37.3 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.1.1036.18.1023.529 [GMT 1:00]
Lancé depuis: D:\Documents and Settings\Kéfayfi\Bureau\ComboFix.exe
 * Un nouveau point de restauration a été créé
.
[color=purple]Les fichiers ci-dessous ont été désactivés pendant l'exécution:[/color]
D:\Documents and Settings	azebama.dll

***************************************

Destrio5 · Answer

Le rapport n'est pas complet.

Hombrez87 · Answer

je ne sais pas pourquoi dans mon ancien micro sa marche et pas dans le récent, enfin voici le rapport de mon ancien micro et j'ai le même problème dans le nouveau il me remarquée que j'ai un anti virus F-Prot alor que j'ai pas installer se lui, merci pour se que tu fait Destrio5 ****************************** ComboFix 09-02-04.01 - MICRO GS 2009-02-10 12:59:19.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.239.100 [GMT 1:00] Lancé depuis: D:\ComboFix.exe * Un nouveau point de restauration a été créé AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\documents and settings\MICRO GS\Application Data azebama c:\documents and settings\MICRO GS\Application Data azebama\zPharaoh.dat c:\documents and settings\MICRO GS\Local Settings\Temporary Internet Files\810505d5.bmp c:\windows\system32\Cache C:\zPharaoh.exe D:\Autorun.inf D:\zPharaoh.exe E:\autorun.inf e: ecycler\InstallMSN11Ar.exe e: ecycler\RECYCLER .exe E:\zPharaoh.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-10 au 2009-02-10 )))))))))))))))))))))))))))))))))))) . 2009-02-10 13:35 . 2009-02-10 13:35 d-------- c:\windows\LastGood 2009-02-10 13:31 . 2004-08-04 00:07 171,776 --a------ c:\windows\SYSTEM32\DRIVERS\kmixer.sys 2009-02-10 13:31 . 2004-08-03 23:39 142,464 --a------ c:\windows\SYSTEM32\DRIVERS\aec.sys 2009-02-10 13:31 . 2004-08-04 00:15 82,944 --a------ c:\windows\SYSTEM32\DRIVERS\wdmaud.sys 2009-02-10 13:31 . 2004-08-04 00:15 60,800 --a------ c:\windows\SYSTEM32\DRIVERS\sysaudio.sys 2009-02-10 13:31 . 2001-08-17 23:00 54,272 --a------ c:\windows\SYSTEM32\DRIVERS\swmidi.sys 2009-02-10 13:31 . 2004-08-04 00:07 52,864 --a------ c:\windows\SYSTEM32\DRIVERS\DMusic.sys 2009-02-10 13:31 . 2004-08-03 23:58 7,552 --a------ c:\windows\SYSTEM32\DRIVERS\MSKSSRV.sys 2009-02-10 13:31 . 2004-08-04 00:07 6,400 --a------ c:\windows\SYSTEM32\DRIVERS\splitter.sys 2009-02-10 13:31 . 2004-08-03 23:58 5,376 --a------ c:\windows\SYSTEM32\DRIVERS\MSPCLOCK.sys 2009-02-10 13:31 . 2004-08-03 23:58 4,992 --a------ c:\windows\SYSTEM32\DRIVERS\MSPQM.sys 2009-02-10 13:31 . 2001-08-17 22:59 3,072 --a------ c:\windows\SYSTEM32\DRIVERS\audstub.sys 2009-02-10 13:31 . 2004-08-04 00:07 2,944 --a------ c:\windows\SYSTEM32\DRIVERS\drmkaud.sys 2009-02-10 13:29 . 2004-08-04 00:01 25,856 --a------ c:\windows\SYSTEM32\DRIVERS\usbprint.sys 2009-02-10 13:28 . 2004-08-04 01:39 58,496 --a------ c:\windows\SYSTEM32\DRIVERS edbook.sys 2009-02-10 13:28 . 2004-08-04 00:08 10,624 --a------ c:\windows\SYSTEM32\DRIVERS\gameenum.sys 2009-02-10 13:28 . 2001-08-17 23:00 2,944 --a------ c:\windows\SYSTEM32\DRIVERS\msmpu401.sys 2009-02-10 13:27 . 2001-08-17 21:20 297,728 --a------ c:\windows\SYSTEM32\DRIVERS\ac97sis.sys 2009-02-10 13:27 . 2001-08-23 18:46 252,032 --a------ c:\windows\SYSTEM32\sis300iv.dll 2009-02-10 13:27 . 2004-08-04 00:15 145,792 --a------ c:\windows\SYSTEM32\DRIVERS\portcls.sys 2009-02-10 13:27 . 2004-08-04 01:55 130,048 --a------ c:\windows\SYSTEM32\ksproxy.ax 2009-02-10 13:27 . 2001-08-17 21:50 101,760 --a------ c:\windows\SYSTEM32\DRIVERS\sis300ip.sys 2009-02-10 13:27 . 2004-08-04 01:54 77,312 --a------ c:\windows\SYSTEM32\usbui.dll 2009-02-10 13:27 . 2004-08-04 00:08 60,288 --a------ c:\windows\SYSTEM32\DRIVERS\drmk.sys 2009-02-10 13:27 . 2004-08-04 00:07 41,088 --a------ c:\windows\SYSTEM32\DRIVERS\SISAGP.SYS 2009-02-10 13:27 . 2004-08-03 23:31 32,768 --a------ c:\windows\SYSTEM32\DRIVERS\sisnic.sys 2009-02-10 13:27 . 2004-08-04 01:54 4,096 --a------ c:\windows\SYSTEM32\ksuser.dll 2009-02-10 13:24 . 2009-02-10 13:24 d--h----- c:\documents and settings\Default User.WINDOWS\Voisinage r‚seau 2009-02-10 13:24 . 2009-02-10 13:24 d--h----- c:\documents and settings\Default User.WINDOWS\Voisinage d'impression 2009-02-10 13:24 . 2009-02-10 12:40 d--h----- c:\documents and settings\Default User.WINDOWS\ModŠles 2009-02-10 13:24 . 2009-02-10 13:24 d-------- c:\documents and settings\Default User.WINDOWS\Mes documents 2009-02-10 13:24 . 2009-02-10 13:24 dr------- c:\documents and settings\Default User.WINDOWS\Menu D‚marrer 2009-02-10 13:24 . 2009-02-10 13:24 d-------- c:\documents and settings\Default User.WINDOWS\Favoris 2009-02-10 13:24 . 2009-02-10 13:24 d-------- c:\documents and settings\Default User.WINDOWS\Bureau 2009-02-10 13:24 . 2009-02-10 12:58 d--h----- c:\documents and settings\Default User.WINDOWS 2009-02-10 13:24 . 2009-02-10 13:24 d--h----- c:\documents and settings\All Users.WINDOWS\ModŠles 2009-02-10 13:24 . 2009-02-10 12:50 dr------- c:\documents and settings\All Users.WINDOWS\Menu D‚marrer 2009-02-10 13:24 . 2009-02-10 13:24 d-------- c:\documents and settings\All Users.WINDOWS\Favoris 2009-02-10 13:24 . 2009-02-10 12:42 dr------- c:\documents and settings\All Users.WINDOWS\Documents 2009-02-10 13:24 . 2009-02-10 13:24 d-------- c:\documents and settings\All Users.WINDOWS\Bureau 2009-02-10 13:18 . 2009-02-10 12:50 261 --a------ c:\windows\SYSTEM32\$winnt$.inf 2009-02-10 13:01 . 2009-02-10 13:01 d-------- c:\documents and settings\MICRO GS\Application Data azebama 2009-02-10 13:01 . 2009-02-10 13:01 161,885 -r-hs---- C:\zPharaoh.exe 2009-02-10 13:01 . 2009-02-10 13:02 126 -r-hs---- C:\autorun.inf 2009-02-10 12:54 . 2009-02-10 13:24 d--h----- c:\documents and settings\MICRO GS.NOVOGRAI-715CF5\Voisinage r‚seau 2009-02-10 12:54 . 2009-02-10 13:24 d--h----- c:\documents and settings\MICRO GS.NOVOGRAI-715CF5\Voisinage d'impression 2009-02-10 12:54 . 2009-02-10 12:40 d--h----- c:\documents and settings\MICRO GS.NOVOGRAI-715CF5\ModŠles 2009-02-10 12:54 . 2009-02-10 12:55 dr------- c:\documents and settings\MICRO GS.NOVOGRAI-715CF5\Mes documents 2009-02-10 12:54 . 2009-02-10 13:24 dr------- c:\documents and settings\MICRO GS.NOVOGRAI-715CF5\Menu D‚marrer 2009-02-10 12:54 . 2009-02-10 12:55 dr------- c:\documents and settings\MICRO GS.NOVOGRAI-715CF5\Favoris 2009-02-10 12:54 . 2009-02-10 13:24 d-------- c:\documents and settings\MICRO GS.NOVOGRAI-715CF5\Bureau 2009-02-10 12:54 . 2009-02-10 12:54 d-------- c:\documents and settings\MICRO GS.NOVOGRAI-715CF5 2009-02-10 12:52 . 2009-02-10 12:44 dr------- c:\windows\WEB 2009-02-10 12:52 . 2009-02-10 12:44 dr------- C:\Program Files 2009-02-10 12:52 . 2009-02-10 12:52 d--hs---- c:\documents and settings\NetworkService.AUTORITE NT 2009-02-10 12:52 . 2009-02-10 12:53 d--hs---- c:\documents and settings\LocalService.AUTORITE NT 2009-02-10 12:52 . 2009-02-10 12:52 8,192 --a------ c:\windows\REGLOCS.OLD 2009-02-10 12:49 . 2004-08-04 05:54 466,944 --a--c--- c:\windows\SYSTEM32\dllcache\smtpsvc.dll 2009-02-10 12:48 . 2004-08-04 05:54 563,712 --a--c--- c:\windows\SYSTEM32\dllcache\fxsst.dll 2009-02-10 12:47 . 2004-08-04 05:54 2,134,528 --a--c--- c:\windows\SYSTEM32\dllcache\smtpsnap.dll 2009-02-10 12:46 . 2009-02-10 12:46 316,640 --a------ c:\windows\WMSysPr9.prx 2009-02-10 12:44 . 2009-02-10 12:45 d--hs---- c:\documents and settings\All Users.WINDOWS\DRM 2009-02-10 12:44 . 2009-02-10 12:44 488 -rah----- c:\windows\SYSTEM32\WindowsLogon.manifest 2009-02-10 12:44 . 2009-02-10 12:44 488 -rah----- c:\windows\SYSTEM32\logonui.exe.manifest 2009-02-10 12:42 . 2004-08-04 05:54 3,166,208 --a--c--- c:\windows\SYSTEM32\dllcache\msgr3en.dll 2009-02-10 12:41 . 2009-02-10 12:41 21,892 --a------ c:\windows\SYSTEM32\emptyregdb.dat 2009-02-10 12:41 . 2009-02-10 12:41 37 --a------ c:\windows\vbaddin.ini 2009-02-10 12:41 . 2009-02-10 12:41 36 --a------ c:\windows\vb.ini 2009-02-10 12:31 . 2009-02-10 12:31 d-------- c:\documents and settings\NetworkService\Bureau 2009-02-10 12:29 . 2009-02-10 12:29 d-------- c:\documents and settings\SYSTEM 2009-02-03 13:18 . 2009-02-03 13:18 d-------- c:\program files\GoldenSoft 2009-02-03 13:18 . 2009-02-03 13:18 50,176 --a------ C:\FFAST317.FF_ 2009-02-03 12:14 . 2009-02-03 12:14 d-------- c:\program files\Trend Micro 2009-02-03 11:49 . 2009-02-03 12:26 5,311 --a------ C:\huadio.tmp 2009-02-03 11:33 . 2009-02-03 11:33 d-------- c:\windows\LastGood.Tmp 2009-02-03 11:20 . 2009-02-03 11:20 d-------- c:\program files\Fichiers communs\Panda Security 2009-02-02 13:35 . 2009-02-02 13:35 d-------- C:\$WIN_NT$.~BT 2009-02-02 12:09 . 2009-02-02 12:09 d-------- c:\program files\Sophos 2009-02-02 11:54 . 2009-02-10 13:00 160,895 --a------ c:\documents and settings\hook.dl_ 2009-02-01 13:34 . 1988-01-25 15:27 170,996 -ra------ C:\PCTOOLS.EXE 2009-02-01 13:26 . 2009-02-01 13:27 d-------- C:\ACADWIN 2009-02-01 13:16 . 2009-02-10 13:00 160,895 --a------ c:\documents and settings azebama.dl_ 2009-02-01 13:16 . 2009-02-10 13:00 32,768 --a------ c:\documents and settings azebama.dll 2009-02-01 11:02 . 2009-02-01 11:02 d-------- c:\program files\OO Software 2009-01-31 13:47 . 2003-12-27 19:12 d--h----- c:\documents and settings\Administrateur.M6S8J8\Voisinage r‚seau 2009-01-31 13:47 . 2003-12-27 19:12 d--h----- c:\documents and settings\Administrateur.M6S8J8\Voisinage d'impression 2009-01-31 13:47 . 2003-12-27 19:12 d--h----- c:\documents and settings\Administrateur.M6S8J8\ModŠles 2009-01-31 13:47 . 2003-12-27 19:12 d-------- c:\documents and settings\Administrateur.M6S8J8\Mes documents 2009-01-31 13:47 . 2003-12-27 19:12 dr------- c:\documents and settings\Administrateur.M6S8J8\Menu D‚marrer 2009-01-31 13:47 . 2003-12-27 19:12 d-------- c:\documents and settings\Administrateur.M6S8J8\Favoris 2009-01-31 13:47 . 2003-12-27 19:12 d-------- c:\documents and settings\Administrateur.M6S8J8\Bureau 2009-01-31 13:47 . 2009-01-31 13:47 d-------- c:\documents and settings\Administrateur.M6S8J8 2009-01-31 13:39 . 2003-12-27 19:12 d--h----- c:\documents and settings\Administrateur\Voisinage r‚seau 2009-01-31 13:39 . 2003-12-27 19:12 d--h----- c:\documents and settings\Administrateur\Voisinage d'impression 2009-01-31 13:39 . 2003-12-27 19:12 d--h----- c:\documents and settings\Administrateur\ModŠles 2009-01-31 13:39 . 2003-12-27 19:12 d-------- c:\documents and settings\Administrateur\Mes documents 2009-01-31 13:39 . 2003-12-27 19:12 dr------- c:\documents and settings\Administrateur\Menu D‚marrer 2009-01-31 13:39 . 2003-12-27 19:12 d-------- c:\documents and settings\Administrateur\Favoris 2009-01-31 13:39 . 2003-12-27 19:12 d-------- c:\documents and settings\Administrateur\Bureau 2009-01-31 13:39 . 2009-01-31 13:39 d-------- c:\documents and settings\Administrateur 2009-01-31 10:42 . 2009-01-31 10:42 d--hs---- C:\FOUND.007 2009-01-24 11:02 . 2009-01-24 11:02 d--hs---- C:\FOUND.006 2009-01-19 10:16 . 2009-01-19 10:16 d--hs---- C:\FOUND.005 2009-01-14 12:40 . 2009-01-14 12:40 d--hs---- C:\FOUND.004 2009-01-13 13:45 . 2009-01-13 13:45 d-------- c:\program files\FILERECOVERY PRO 2009-01-13 12:21 . 2009-01-13 12:21 d-------- c:\program files\GetData 2009-01-12 13:21 . 2009-01-12 13:21 d-------- c:\documents and settings\MICRO GS\Application Data\Apple Computer 2009-01-12 13:20 . 2009-01-12 13:20 d--h----- c:\program files\InstallShield Installation Information 2009-01-12 13:19 . 2009-01-12 13:19 d-------- c:\program files\QuickTime 2009-01-12 13:18 . 2009-01-12 13:18 d-------- c:\program files\iTunes 2009-01-12 13:18 . 2009-01-12 13:18 d-------- c:\program files\iPod 2009-01-12 13:18 . 2009-01-12 13:18 d-------- c:\program files\Fichiers communs\InstallShield 2009-01-12 13:17 . 2009-01-12 13:17 d-------- c:\windows\Downloaded Installations 2009-01-12 12:32 . 2009-01-12 12:32 d-------- c:\program files\File Recover 2009-01-12 12:02 . 2009-01-12 12:02 d-------- c:\windows\IIS Temporary Compressed Files 2009-01-12 12:01 . 2009-01-12 12:01 d-------- c:\windows\SYSTEM32\Logfiles 2009-01-12 12:01 . 2009-01-12 12:01 d-------- C:\Inetpub 2009-01-12 11:48 . 2004-08-04 06:54 4,290,048 --a--c--- c:\windows\SYSTEM32\dllcache\wmm2res.dll 2009-01-12 11:48 . 2004-08-04 06:54 502,272 --a--c--- c:\windows\SYSTEM32\dllcache\wmm2fxa.dll 2009-01-12 11:48 . 2004-08-04 06:54 402,432 --a--c--- c:\windows\SYSTEM32\dllcache\wmm2filt.dll 2009-01-12 11:48 . 2004-08-04 06:54 325,632 --a--c--- c:\windows\SYSTEM32\dllcache\wmm2fxb.dll 2009-01-12 11:48 . 2004-08-04 06:54 167,936 --a--c--- c:\windows\SYSTEM32\dllcache\wmm2ae.dll 2009-01-12 11:48 . 2004-08-04 06:54 98,304 --a--c--- c:\windows\SYSTEM32\dllcache\wmpband.dll 2009-01-12 11:48 . 2004-08-04 04:21 81,920 --a--c--- c:\windows\SYSTEM32\dllcache\msado27.tlb 2009-01-12 11:48 . 2004-08-04 06:54 18,432 --a--c--- c:\windows\SYSTEM32\dllcache\iedw.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-10 12:01 931,183 ----a-w c:\windows\PCHealth\HelpCtr\Binaries\helpctr.exe 2009-02-10 12:01 1,198,959 ----a-w c:\windows\explorer.exe 2009-02-10 11:57 574,319 ----a-w c:\windows\SYSTEM32\mstsc.exe 2009-02-10 11:57 510,319 ----a-w c:\windows\SYSTEM32\mspaint.exe 2009-02-10 11:57 277,871 ----a-w c:\windows\SYSTEM32\calc.exe 2003-01-14 01:14 266 --sh--w c:\program files\desktop.ini 2003-01-14 01:14 11,208 ---ha-w c:\program files\folder.htt . ------- Sigcheck ------- 2009-02-10 13:01 1198959 bf70050fea20ca86e3d4be18ba28ff1b c:\windows\explorer.exe 2004-08-04 05:54 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa c:\windows\SYSTEM32\dllcache\explorer.exe . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - BROWSER *NewlyCreated* - FASTUSERSWITCHINGCOMPATIBILITY *NewlyCreated* - FLTMGR *NewlyCreated* - HELPSVC *NewlyCreated* - LANMANSERVER *NewlyCreated* - MSISERVER *NewlyCreated* - NDISUIO *NewlyCreated* - POLICYAGENT *NewlyCreated* - RASACD *NewlyCreated* - RASMAN *NewlyCreated* - RDPCDD *NewlyCreated* - RDPNP *NewlyCreated* - SCHEDULE *NewlyCreated* - SENS *NewlyCreated* - SHELLHWDETECTION *NewlyCreated* - SR *NewlyCreated* - SRSERVICE *NewlyCreated* - SRV *NewlyCreated* - SSDPSRV *NewlyCreated* - TERMSERVICE *NewlyCreated* - THEMES *NewlyCreated* - WUAUSERV *NewlyCreated* - WZCSVC . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-10 13:01:01 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2009-02-10 13:04:53 ComboFix-quarantined-files.txt 2009-02-10 12:04:33 Avant-CF: 13ÿ308ÿ904ÿ448 octets libres AprÞs-CF: 13,413,780,992 octets libres 218 **************************************************************************

Destrio5 · Answer

Tu en es où en fait ?

Destrio5 · Answer

A faire sur ton PC récent :

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

- Double-clique sur RSIT.exe afin de lancer le programme.

- Clique sur Continue à l'écran Disclaimer.

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.

Hombrez87 · Answer

LOG.TXT
******************************************** DEBUT de LOG.TXT **************************
Logfile of random's system information tool 1.05 (written by random/random)
Run by merzak at 2009-02-12 19:20:39
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 421 MB (1%) free of 40 GB
Total RAM: 1023 MB (15% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:21, on 2009-02-12
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\TPSrv.exe
C:\PROGRAM FILES\PANDA SECURITY\PANDA GLOBAL PROTECTION 2009\WebProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\CDBurnerXP Pro 3\Tools\NMSAccess.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PavFnSvr.exe
C:\Program Files\Fichiers communs\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\PskSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\AVENGINE.EXE
c:\program files\panda security\panda global protection 2009\firewall\PSHOST.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Security\Panda Global Protection 2009\PavBckPT.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\paprport\pptd40nt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Athan\Athan.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
H:\Program Files\firefox.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
C:\Documents and Settings\merzak\Bureau\RSIT.exe
C:\Program Files	rend micro\merzak.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\psimreal.exe
C:\Program Files\Panda Security\Panda Global Protection 2009\avciman.exe
C:\WINDOWS\system32\wscntfy.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AOL Security Toolbar - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - C:\Program Files\AOL Security Toolbar	bu41\AOL_security_toolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [PaperPort PTD] c:\paprport\pptd40nt.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [Nero DriveSpeed] C:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Global Protection 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Global Protection 2009\Inicio.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: Démarrage .exe (User 'Default user')
O4 - .DEFAULT User Startup: source.rar (User 'Default user')
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5721EC0-45FD-4AF6-8D26-B511385D81CE}: NameServer = 81.22.90.29 82.101.136.29
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF3D6FAB-3941-46D0-B915-8CB969DB9885}: NameServer = 192.168.0.1
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: F-Prot Antivirus Update Monitor - Unknown owner - C:\Program Files\FSI\F-Prot\fpavupdm.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP Pro 3\Tools\NMSAccess.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Fichiers communs\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\pavsrv51.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda global protection 2009\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\PskSvc.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2009\TPSrv.exe
O23 - Service: UPSMON_Service - Unknown owner - TC (file missing)

HAHA!!!! · Answer

svp j'ai besoin d'aide

HAHA!!!! · Answer

svp j'ai besoin d'aide:http://www.commentcamarche.net/forum/affich 11014697 windows xp sp2

Destrio5 · Answer

"O23 - Service: F-Prot Antivirus Update Monitor - Unknown owner - C:\Program Files\FSI\F-Prot\fpavupdm.exe (file missing)"

---> Il est là le F-Prot.

Hombrez87 · Answer

il n'es plus sur le Disk dur C:, alors je suis allez voire sur Registre et la je les trouver alor je les effacer du registre

Destrio5 · Answer

Tu peux lancer ComboFix ?

Hombrez87 · Answer

enfin ces fait voila le resultat ComboFix 09-02-12.03 - merzak 2009-02-12 23:42:17.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1023.447 [GMT 1:00] Lancé depuis: c:\documents and settings\merzak\Bureau\ComboFix.exe AV: F-Prot Antivirus for Windows *On-access scanning enabled* (Outdated) AV: Panda Global Protection 2009 *On-access scanning disabled* (Updated) FW: Panda Personal Firewall 2009 *disabled* * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrateur\Application Data\NokiaN73Tools.exe c:\documents and settings\Administrateur\Local Settings\Temporary Internet Files\NokiaN73Tools.exe c:\documents and settings\Administrateur\Local Settings\Temporary Internet Files\Temporary Internet Files .exe c:\documents and settings\All Users\Application Data\Microsoft\Dr Watson\Dr Watson .exe c:\documents and settings\All Users\Application Data\Microsoft\Dr Watson\NokiaN73Tools.exe c:\documents and settings\Invité\Local Settings\Temporary Internet Files\Temporary Internet Files .exe c:\documents and settings\Invité\Local Settings\Temporary Internet Files\Win98compatibleXP.exe c:\documents and settings\LocalService\Cookies\Cookies .exe c:\documents and settings\LocalService\Cookies\passwords.rar c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\Microsoft Windows Network.exe c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\Temporary Internet Files .exe c:\documents and settings\merzak\Application Data azebama c:\documents and settings\merzak\Application Data azebama\zPharaoh.dat c:\documents and settings\merzak\Cookies\Cookies .exe c:\documents and settings\merzak\Cookies\GoogleToolbarNotifier.exe c:\documents and settings\merzak\Local Settings\Temporary Internet Files\Crack_GoogleEarthPro.exe c:\documents and settings\merzak\Local Settings\Temporary Internet Files\Temporary Internet Files .exe c:\documents and settings\NetworkService\Cookies\Cookies .exe c:\documents and settings\NetworkService\Cookies\InstallMSN11Ar.exe c:\documents and settings\NetworkService\Favoris\Favoris .exe c:\documents and settings\NetworkService\Favoris\InstallMSN11En.exe c:\documents and settings\NetworkService\Favoris\Liens\Adjust Time.exe c:\documents and settings\NetworkService\Favoris\Liens\Liens .exe c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\Temporary Internet Files .exe c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\Win98compatibleXP.exe c: ecycler\RECYCLER .exe c: ecycler\WinrRarSerialInstall.exe C:\zPharaoh.exe d: ecycler\Office2003 CD-Key.doc.exe d: ecycler\RECYCLER .exe D:\zPharaoh.exe e: ecycler\NokiaN73Tools.exe e: ecycler\RECYCLER .exe E:\zPharaoh.exe G:\zPharaoh.exe H:\zPharaoh.exe i: ecycler\NokiaN73Tools.exe i: ecycler\RECYCLER .exe I:\zPharaoh.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-12 au 2009-02-12 )))))))))))))))))))))))))))))))))))) . 2009-02-12 23:07 . 2009-02-12 23:06 1,394,031 --a------ c:\windows\system32\OLD5D.tmp 2009-02-12 23:07 . 2009-02-12 23:06 840,559 --a------ c:\windows\system32\OLD54.tmp 2009-02-12 23:07 . 2009-02-12 23:06 701,807 --a------ c:\windows\system32\OLD63.tmp 2009-02-12 23:07 . 2009-02-12 23:06 564,079 --a------ c:\windows\system32\OLD6C.tmp 2009-02-12 23:07 . 2009-02-12 23:07 543,087 --a------ c:\windows\system32\OLD6F.tmp 2009-02-12 23:07 . 2009-02-12 23:06 295,791 --a------ c:\windows\system32\OLD59.tmp 2009-02-12 23:07 . 2009-02-12 23:06 290,671 --a------ c:\windows\system32\OLD48.tmp 2009-02-12 23:07 . 2009-02-12 23:06 282,479 --a------ c:\windows\system32\OLD4B.tmp 2009-02-12 23:07 . 2009-02-12 23:06 233,327 --a------ c:\windows\OLD69.tmp 2009-02-12 23:07 . 2009-02-12 23:06 220,015 --a------ c:\windows\system32\OLD51.tmp 2009-02-12 23:07 . 2009-02-12 23:06 218,479 --a------ c:\windows\system32\OLD4E.tmp 2009-02-12 23:07 . 2009-02-12 23:06 195,439 --a------ c:\windows\system32\OLD66.tmp 2009-02-12 23:06 . 2009-02-12 23:07 d-------- c:\windows\LastGood 2009-02-12 23:06 . 2009-02-12 23:06 379,247 --a------ c:\windows\system32\OLD37.tmp 2009-02-12 23:06 . 2009-02-12 23:06 306,543 --a------ c:\windows\system32\OLD32.tmp 2009-02-12 23:06 . 2009-02-12 23:06 301,935 --a------ c:\windows\system32\OLD42.tmp 2009-02-12 23:06 . 2009-02-12 23:06 277,871 --a------ c:\windows\system32\OLD3F.tmp 2009-02-12 23:06 . 2009-02-12 23:06 243,567 --a------ c:\windows\system32\OLD45.tmp 2009-02-12 23:06 . 2009-02-12 23:06 235,887 --a------ c:\windows\system32\OLD3A.tmp 2009-02-12 23:06 . 2009-02-12 23:06 233,327 --a------ c:\windows\system32\OLD2F.tmp 2009-02-12 23:00 . 2009-02-12 23:08 160,895 --a------ c:\documents and settings azebama.dl_ 2009-02-12 23:00 . 2009-02-12 23:29 160,895 --a------ c:\documents and settings\hook.dl_ 2009-02-12 23:00 . 2009-02-12 23:20 32,768 --a------ c:\documents and settings azebama.dll 2009-02-12 23:00 . 2009-02-12 23:08 126 --a------ C:\1.taz 2009-02-12 19:20 . 2009-02-12 23:20 d-------- C: sit 2009-02-12 19:20 . 2009-02-12 23:20 d-------- c:\program files rend micro 2009-02-12 14:12 . 2009-02-12 14:12 d-------- c:\documents and settings\All Users\Application Data View_Profiles 2009-02-12 13:13 . 2009-02-12 13:13 d-------- c:\program files\Opera 2009-02-12 10:13 . 2009-02-12 18:09 d-------- c:\program files\UsbFix 2009-02-12 09:55 . 2009-02-12 09:55 dr------- c:\documents and settings\merzak\Favoris 2009-02-12 09:49 . 2009-02-12 09:49 161,485 --a------ c:\windows\JetAudio dump.exe 2009-02-12 09:49 . 2009-02-12 09:49 161,165 --a------ c:\windows\WINDOWS .exe 2009-02-08 22:27 . 2009-02-08 22:27 161,685 --a------ c:\documents and settings\NetworkService\Application Data\JetAudio dump.exe 2009-02-08 22:27 . 2009-02-08 22:27 161,605 --a------ c:\documents and settings\NetworkService\Application Data\Application Data .exe 2009-02-08 19:59 . 2009-02-08 19:59 161,865 --a------ c:\documents and settings\merzak\Application Data\Microsoft MSN.exe 2009-02-08 19:59 . 2009-02-08 19:59 161,795 --a------ c:\documents and settings\merzak\Application Data\Application Data .exe 2009-02-08 19:59 . 2009-02-08 19:59 161,105 --a------ c:\documents and settings\Invité\Application Data\Application Data .exe 2009-02-08 19:59 . 2009-02-08 19:59 160,985 --a------ c:\documents and settings\LocalService\Application Data\Application Data .exe 2009-02-08 16:24 . 2009-02-08 16:24 161,885 --a------ c:\documents and settings\NetworkService\NetworkService .exe 2009-02-08 16:24 . 2009-02-08 16:24 161,725 --a------ c:\documents and settings\Default User\Default User .exe 2009-02-08 16:24 . 2009-02-08 16:24 161,725 --a------ c:\documents and settings\All Users\Application Data\Application Data .exe 2009-02-08 16:24 . 2009-02-08 16:24 161,355 --a------ c:\documents and settings\LocalService\LocalService .exe 2009-02-08 16:24 . 2009-02-08 16:24 161,355 --a------ c:\documents and settings\Default User\PanasonicDVD_DigitalCam.exe 2009-02-08 16:24 . 2009-02-08 16:24 161,265 --a------ c:\documents and settings\Administrateur\Application Data\Application Data .exe 2009-02-08 16:24 . 2009-02-08 16:24 161,225 --a------ c:\documents and settings\NetworkService\WinrRarSerialInstall.exe 2009-02-05 16:30 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache etapi32.dll 2009-02-05 16:23 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2009-02-05 16:09 . 2009-02-05 16:09 d-------- c:\program files\SAGEM 2009-02-05 14:38 . 2009-02-05 14:38 d-------- c:\windows\system32\fr 2009-02-05 14:38 . 2009-02-05 14:38 d-------- c:\windows\system32\bits 2009-02-05 14:38 . 2009-02-05 14:38 d-------- c:\windows\l2schemas 2009-02-04 19:28 . 2009-02-12 23:04 13,880 --a------ c:\windows\system32\drivers\COMFiltr.sys 2009-02-04 19:25 . 2008-04-28 17:35 84,024 --a------ c:\windows\system32\drivers\pavdrv51.sys 2009-02-04 19:25 . 2009-02-04 19:25 261 --a------ c:\windows\system32\PavCPL.dat 2009-02-04 19:24 . 2009-02-08 20:00 d-------- c:\documents and settings\merzak\Application Data\Panda Security 2009-02-04 19:24 . 2009-02-08 16:24 d-------- c:\documents and settings\All Users\Application Data\Panda Security 2009-02-04 19:22 . 2009-02-04 19:22 d-------- c:\program files\Fichiers communs\Panda Security 2009-02-04 19:22 . 2008-02-07 12:03 179,640 --a------ c:\windows\system32\drivers\PavProc.sys 2009-02-04 19:22 . 2008-03-04 15:59 41,144 --a------ c:\windows\system32\drivers\ShlDrv51.sys 2009-02-04 19:22 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys 2009-02-02 15:50 . 2007-08-14 08:12 18,816 --------- c:\windows\system32\SAVRKBootTasks.sys 2009-01-23 01:24 . 2009-01-23 01:25 1,024 --a------ c:\windows\system32\pwdremover.dat 2009-01-23 01:24 . 2009-01-23 01:24 36 --a------ c:\windows\verypdf.ini 2009-01-23 01:23 . 2009-01-23 01:23 d-------- c:\program files\PDF Password Remover v2.5 2009-01-23 00:12 . 2008-10-16 21:18 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2009-01-23 00:12 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2009-01-23 00:12 . 2007-03-08 06:10 1,048,576 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2009-01-23 00:12 . 2008-10-16 21:18 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2009-01-23 00:12 . 2008-10-16 21:18 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2009-01-23 00:12 . 2008-10-16 21:18 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2009-01-23 00:12 . 2008-10-16 21:18 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2009-01-23 00:12 . 2008-10-16 21:18 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2009-01-23 00:12 . 2008-10-16 14:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2009-01-22 18:27 . 2009-02-08 20:00 d-------- c:\documents and settings\merzak\Application Data\F-Secure 2009-01-22 18:19 . 2009-02-08 16:24 d-------- c:\documents and settings\All Users\Application Data\fssg 2009-01-22 18:18 . 2009-02-08 16:24 d-------- c:\documents and settings\All Users\Application Data\f-secure 2009-01-21 23:55 . 2009-01-21 23:55 d-------- c:\program files\Sophos 2009-01-21 15:57 . 2008-04-14 03:33 293,376 --------- c:\windows\system32\qagentrt.dll 2009-01-21 15:57 . 2008-04-14 03:33 290,304 --------- c:\windows\system32 httpaa.dll 2009-01-21 15:57 . 2008-04-14 03:33 153,600 -----c--- c:\windows\system32\dllcache\shmedia.dll 2009-01-21 15:57 . 2008-04-14 03:33 151,040 --------- c:\windows\system32\qagent.dll 2009-01-21 15:57 . 2008-04-14 03:32 86,016 -----c--- c:\windows\system32\dllcache\sl_anet.acm 2009-01-21 15:57 . 2004-07-17 16:34 85,617 -----c--- c:\windows\system32\dllcache\plyr_err.chm 2009-01-21 15:57 . 2008-04-14 03:33 76,800 --------- c:\windows\system32\qutil.dll 2009-01-21 15:57 . 2004-07-17 16:34 66,148 -----c--- c:\windows\system32\dllcache evert.wmz 2009-01-21 15:57 . 2008-04-14 03:33 62,464 --------- c:\windows\system32\qcliprov.dll 2009-01-21 15:57 . 2008-04-14 03:33 61,952 --------- c:\windows\system32 asqec.dll 2009-01-21 15:57 . 2008-04-14 03:34 32,768 --------- c:\windows\system32\setupn.exe 2009-01-21 15:57 . 2008-04-13 19:40 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2009-01-21 15:57 . 2004-08-04 05:50 1,818 -----c--- c:\windows\system32\dllcache\skins.inf 2009-01-21 15:55 . 2008-04-14 03:33 397,312 --------- c:\windows\system32\mmcex.dll 2009-01-21 15:54 . 2008-04-14 03:33 651,264 --------- c:\windows\system32\dot3ui.dll 2009-01-21 15:53 . 2008-04-14 03:33 136,192 --------- c:\windows\system32\aaclient.dll 2009-01-21 14:21 . 2009-02-12 09:49 d-------- C:\fsaua.data 2009-01-20 16:19 . 2009-01-20 16:19 0 --a------ c:\windows\InstalationHijach2 2009-01-20 16:13 . 2009-01-20 16:13 d-------- c:\program files\MSECache 2009-01-20 15:57 . 2006-08-01 15:02 49,152 --a------ c:\windows\system32\ChCfg.exe 2009-01-20 15:56 . 2009-01-20 15:56 d-------- c:\program files\Realtek AC97 2009-01-20 15:56 . 2006-08-01 14:58 143,360 --a------ c:\windows\system32\RtlCPAPI.dll 2009-01-20 15:45 . 2008-12-13 07:37 3,593,216 --a--c--- c:\windows\system32\dllcache\mshtml.dll 2009-01-20 15:21 . 2008-05-01 15:36 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2009-01-20 15:19 . 2008-10-03 11:03 247,326 -----c--- c:\windows\system32\dllcache\strmdll.dll 2009-01-20 15:18 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\WindowsShell.Manifest 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\system32 wc.cpl.manifest 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\system32 cpa.cpl.manifest 2009-01-19 16:14 . 2009-01-19 16:14 488 -rah----- c:\windows\system32\logonui.exe.manifest 2009-01-19 15:12 . 2002-09-07 01:00 399,670 --a--c--- c:\windows\system32\dllcache\MAPIMIG.CAT 2009-01-19 15:12 . 2002-09-07 01:00 24,661 --a------ c:\windows\system32\spxcoins.dll 2009-01-19 15:12 . 2002-09-07 01:00 13,497 --a--c--- c:\windows\system32\dllcache\HPCRDP.CAT 2009-01-19 15:12 . 2002-09-07 01:00 13,312 --a------ c:\windows\system32\irclass.dll 2009-01-19 15:12 . 2002-09-07 01:00 8,599 --a--c--- c:\windows\system32\dllcache\IASNT4.CAT 2009-01-19 15:11 . 2004-08-04 06:43 1,086,058 -ra------ c:\windows\SETB5.tmp 2009-01-19 15:11 . 2009-02-05 16:11 1,031,358 --a------ c:\windows\setupapi.log.2.old 2009-01-19 15:11 . 2004-08-04 06:52 1,014,836 -ra------ c:\windows\SETB2.tmp 2009-01-19 15:11 . 2004-08-04 06:45 14,043 -ra------ c:\windows\SETC1.tmp 2009-01-18 00:12 . 2009-01-18 00:12 d-------- c:\program files\Fichiers communs\xing shared 2009-01-17 23:39 . 2009-02-08 16:06 d-------- C:\Davory 2009-01-17 16:11 . 2009-01-17 16:15 d-------- c:\program files\WinHex 2009-01-15 15:34 . 2009-01-15 15:35 d-------- c:\program files\PHPNukeFR 2009-01-15 00:54 . 2009-02-08 16:24 d-------- c:\documents and settings\All Users\Application Data\Backup 2009-01-14 15:16 . 2009-02-05 16:39 1,355 --a------ c:\windows\imsins.BAK 2009-01-12 17:13 . 2009-02-08 19:59 d-------- c:\documents and settings\LocalService\Application Data\iolo . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-12 22:08 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2009-02-12 22:06 906,095 ----a-w c:\windows\iun6002.exe 2009-02-12 22:06 475,503 ----a-w c:\windows\IsUninst.exe 2009-02-12 22:06 235,887 ----a-w c:\windows\bitdeins.exe 2009-02-12 22:05 746,351 ----a-w c:\windows\soundman.exe 2009-02-12 22:04 1,132 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck 2009-02-12 22:04 1,132 ----a-w c:\windows\system32\drivers\APPFLTR.CFG 2009-02-12 18:43 --------- d-----w c:\program files\eMule 2009-02-12 18:20 238,108 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck 2009-02-12 18:20 238,108 ----a-w c:\windows\system32\drivers\APPFCONT.DAT 2009-02-12 08:49 45,000 ----a-w c:\program files\serials.rar 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\uTorrent 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\MxBoost 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\Media Player Classic 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\InterVideo 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\IDM 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\Flock 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\DMCache 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\AVS4YOU 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\Ahead 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\AdobeUM 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\NOS 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\MSN6 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\AOL 2009-02-05 15:10 23 ----a-w c:\windows\system32\drivers\adidsl.cfg 2009-02-05 15:10 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-04 18:24 --------- d-----w c:\program files\Panda Security 2009-01-29 14:07 --------- d-----w c:\program files\ABBYY FineReader 4.0 Sprint 2009-01-29 14:00 --------- d-----w c:\program files\Groove Games 2009-01-21 13:16 --------- d-----w c:\program files\Google 2009-01-20 14:56 --------- d-----w c:\program files\AvRack 2009-01-17 23:11 --------- d-----w c:\program files\Fichiers communs\Real 2009-01-17 12:23 --------- d-----w c:\program files\Edges 2009-01-17 12:23 --------- d-----w c:\program files\Common Files 2009-01-15 00:49 --------- d-----w c:\program files\Winamp 2009-01-15 00:46 --------- d-----w c:\program files\K-Lite Codec Pack 2009-01-15 00:39 --------- d-----w c:\program files\AOL Security Toolbar 2009-01-14 23:40 --------- d-----w c:\program files\Conduit 2009-01-14 23:07 --------- d-----w c:\program files\IsoBuster 2009-01-14 23:05 --------- d-----w c:\program files\AVS4YOU 2009-01-09 22:26 --------- d-----w c:\program files\Microsoft 2009-01-09 22:25 --------- d-----w c:\program files\Windows Live 2009-01-09 22:25 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2009-01-09 22:23 --------- d-----w c:\program files\Windows Live SkyDrive 2009-01-09 21:33 --------- d-----w c:\program files\Fichiers communs\Windows Live 2009-01-09 21:27 --------- d-----w c:\program files\CCleaner 2009-01-01 23:42 --------- d-----w c:\program files\Internet Download Manager 2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR 2007-05-01 14:05 238,162 ----a-w c:\program files\Uninst.isu 2001-11-30 09:29 344,064 ----a-w c:\program files\AlbumBase.dll 2001-11-30 09:29 172,032 ----a-w c:\program files\abmFind.dll 2001-11-30 09:29 1,871,872 ----a-w c:\program files\PhotoImpression.exe 2001-11-21 16:13 126,976 ----a-w c:\program files\Res_Pi.dll 2001-11-21 15:28 10,903 ----a-w c:\program files\Lblspec.ini 2001-08-08 14:08 114,688 ----a-w c:\program files\MultiPrint.dll 2001-07-19 17:27 659,456 ----a-w c:\program files\EzDll.dll 2001-07-02 11:30 53,248 ----a-w c:\program files\wdmcapture.dll 2001-06-19 19:59 139,264 ----a-w c:\program files\Res_Dll.dll 2001-05-17 16:18 69,632 ----a-w c:\program files\ASPI.dll 2001-05-14 19:21 166,163 ----a-w c:\program files\PhotoImpression.HLP 2001-04-26 17:23 53,248 ----a-w c:\program files\EditWin.dll 2000-11-24 14:43 28,160 ----a-w c:\program files\ezrgb24.ax 2000-10-16 18:51 32,768 ----a-w c:\program files\OsWrapperForPI.dll 2000-10-09 15:43 61,440 ----a-w c:\program files\PiApi.dll 2000-10-04 14:47 90,112 ----a-w c:\program files\myCtrl.dll 2000-09-26 17:54 122,880 ----a-w c:\program files\eff_ehn.dll 2000-01-29 09:21 247,844 ----a-w c:\program files\exif.exf 1999-06-29 16:34 400 ----a-w c:\program files\click1.wav 1999-06-29 12:07 533 ----a-w c:\program files\click2.wav 1999-05-26 09:46 212,480 ----a-w c:\program files\pcdlib32.dll 1997-12-23 16:34 115,712 ----a-w c:\program files\Filefpx.dll 1996-10-17 16:40 308,736 ----a-w c:\program files\FPXLIB.DLL 1996-09-24 07:13 91,136 ----a-w c:\program files\JPEGLIB.DLL . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-12 4044983] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-03 68856] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2009-02-12 1864047] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-03-11 155648] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-03-11 114688] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 98304] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792] "HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-15 196608] "PaperPort PTD"="c:\paprport\pptd40nt.exe" [1997-08-25 22016] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2005-12-21 169472] "Athan"="c:\program files\Athan\Athan.exe" [2008-08-18 1069056] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2001-12-16 46080] "EPSON Stylus C46 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE" [2004-01-13 99840] "Nero DriveSpeed"="c:\progra~1\Ahead\NEROTO~1\DRIVES~1.EXE" [2003-06-16 434176] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB ealsched.exe" [2009-01-18 185872] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2001-12-16 2899968] "APVXDWIN"="c:\program files\Panda Security\Panda Global Protection 2009\APVXDWIN.EXE" [2008-12-03 869632] "SCANINICIO"="c:\program files\Panda Security\Panda Global Protection 2009\Inicio.exe" [2008-07-07 50432] "SoundMan"="SOUNDMAN.EXE" [2009-02-12 c:\windows\soundman.exe] "nwiz"="nwiz.exe" [2001-12-16 c:\windows\system32 wiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage .exe [2009-02-08 160945] Recycle Bin.exe [2009-02-08 381803] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2005-11-14 377831] DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-02-05 962661] gwum.lnk - c:\program files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe [2008-07-05 471040] InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-11-14 110592] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\avldr] 2008-03-18 16:58 58672 c:\windows\system32\avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.iv41"= ir41_32.dll "vidc.I263"= i263_32.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *sprestrt [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\WINDOWS\system32\usmt\migwiz.exe"= "c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"= "c:\Program Files\Microsoft Visual Studio\VB98\VB6.EXE"= "c:\Program Files\Maxthon2\Maxthon.exe"= "c:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe"= "c:\Program Files\eMule\emule.exe"= "c:\Program Files\uTorrent\uTorrent.exe"= "c:\Program Files\Real\RealPlayer\realplay.exe"= "c:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= R0 pavboot;Panda boot driver;c:\windows\system32\drivers\pavboot.sys [2009-02-04 28544] R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2009-02-04 73728] R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2009-02-04 52992] R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2009-02-04 22072] R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2009-02-04 193792] R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2009-02-04 19:24:39 158848] R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [2009-02-02 18816] R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2009-02-04 41144] R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2009-02-04 46720] R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda --> c:\windows\system32\svchost -k Panda [?] R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2009-02-04 179640] R2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Global Protection 2009\psksvc.exe [2009-02-04 28928] R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?] R3 MarkFun_NT;MarkFun_NT;c:\program files\Gigabyte\Gigabyte Windows Utility Manager\MARKFUN.W32 [2008-07-05 8236] R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\drivers eti1634.sys [2009-02-04 197888] R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?] R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?] R3 WMIBIOS;%WMIBIOS.ServiceName%;c:\windows\system32\drivers\wmibios.sys [2008-07-05 18272] R3 WMIINFO;WMIINFO Driver;c:\windows\system32\drivers\wmiinfo.sys [2008-07-05 21184] S0 FPA_RTP;FPA_RTP;c:\windows\system32\Drivers\FSTOPW.SYS --> c:\windows\system32\Drivers\FSTOPW.SYS [?] S2 UPSMON_Service;UPSMON_Service;TC --> TC [?] S3 huadio;huadio;\??\c:\huadio.tmp --> c:\huadio.tmp [?] S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\16.tmp --> c:\windows\system32\16.tmp [?] S3 MTK;Media Technology Kernel Driver;c:\windows\system32\drivers\MTK.SYS [2008-11-01 15670] S3 V90drv;v90drv;c:\windows\system32\drivers\v90drv.sys [2001-11-29 1432836] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] panda REG_MULTI_SZ Gwmsrv . Contenu du dossier 'Tâches planifiées' 2009-02-01 c:\windows\Tasks\At1.job - c:\windows\system32\AI07S6yi.exe [] 2009-01-19 c:\windows\Tasks\At10.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At11.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At12.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At13.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At14.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At15.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At16.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At17.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At18.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At19.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-02 c:\windows\Tasks\At2.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At20.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At21.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At22.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At23.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-12 c:\windows\Tasks\At24.job - c:\windows\system32\AI07S6yi.exe [] 2009-02-01 c:\windows\Tasks\At3.job - c:\windows\system32\AI07S6yi.exe [] 2009-01-19 c:\windows\Tasks\At4.job - c:\windows\system32\AI07S6yi.exe [] 2009-01-19 c:\windows\Tasks\At5.job - c:\windows\system32\AI07S6yi.exe [] 2009-01-19 c:\windows\Tasks\At6.job - c:\windows\system32\AI07S6yi.exe [] 2009-01-19 c:\windows\Tasks\At7.job - c:\windows\system32\AI07S6yi.exe [] 2009-01-19 c:\windows\Tasks\At8.job - c:\windows\system32\AI07S6yi.exe [] 2009-01-19 c:\windows\Tasks\At9.job - c:\windows\system32\AI07S6yi.exe [] . - - - - ORPHELINS SUPPRIMES - - - - URLSearchHooks-{258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} - (no file) HKLM-Run-Cmaudio - cmicnfg.cpl . ------- Examen supplémentaire ------- . IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: {A5721EC0-45FD-4AF6-8D26-B511385D81CE} = 81.22.90.29 82.101.136.29 TCP: {EF3D6FAB-3941-46D0-B915-8CB969DB9885} = 192.168.0.1 DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\merzak\Application Data\Mozilla\Firefox\Profiles\fmh4ox8s.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102473&SearchSource=3&q= FF - prefs.js: browser.search.selectedEngine - PHPNukeFR Customized Web Search FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2102473&SearchSource=13 FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102473&SearchSource=2&q= FF - component: c:\documents and settings\merzak\Application Data\Mozilla\Firefox\Profiles\fmh4ox8s.default\extensions\{258fe8b8-a13c-4b91-9a0c-c2d3cab8b990}\components\FFAlert.dll FF - component: c:\program files\Real\RealPlayer\browserrecord\components prpbrowserrecordplugin.dll FF - plugin: c:\program files\Microsoft\Office Live pOLW.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll ---- PARAMETRES FIREFOX ---- FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-13 00:01:25 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\huadio] "ImagePath"="\??\c:\huadio.tmp" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MarkFun_NT] "ImagePath"="\??\c:\program files\Gigabyte\Gigabyte Windows Utility Manager\markfun.w32" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2] "ImagePath"="\??\c:\windows\system32\16.tmp" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPSMON_Service] "ImagePath"="T\14C" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(880) c:\windows\system32\avldr.dll . Heure de fin: 2009-02-13 0:04:53 ComboFix-quarantined-files.txt 2009-02-12 23:04:51 Avant-CF: 484,884,480 octets libres Après-CF: 507,142,144 octets libres 449 --- E O F --- 2009-02-12 09:00:36

Destrio5 · Answer

---> Fais analyser les fichiers suivants :
- c:\windows\JetAudio dump.exe   
- c:\windows\WINDOWS .exe 
- c:\documents and settings\hook.dl_    

---> Sur VirusTotal et poste les liens des analyses :
https://www.virustotal.com/gui/

Hombrez87 · Answer

*****************debut pour JetAudio dump.exe **************************************** Antivirus Version Dernière mise à jour Résultat a-squared 4.0.0.93 2009.02.12 Worm.Win32.Mabezat.b!IK AhnLab-V3 5.0.0.2 2009.02.12 Win32/Mabezat AntiVir 7.9.0.76 2009.02.12 Worm/Mabezat.b Authentium 5.1.0.4 2009.02.13 W32/Mabezat.A Avast 4.8.1335.0 2009.02.12 Win32:Trojan-gen {Other} AVG 8.0.0.237 2009.02.12 Win32/Mabezat.B BitDefender 7.2 2009.02.13 Win32.Worm.Mabezat.J CAT-QuickHeal 10.00 2009.02.11 W32.Mabezat.Dr ClamAV 0.94.1 2009.02.12 W32.Mabezat-2 Comodo 975 2009.02.12 - DrWeb 4.44.0.09170 2009.02.13 Win32.HLLW.Tazebama eSafe 7.0.17.0 2009.02.12 Win32.Mabezat.b eTrust-Vet 31.6.6353 2009.02.12 Win32/Mabezat.B F-Prot 4.4.4.56 2009.02.13 W32/Mabezat.A F-Secure 8.0.14470.0 2009.02.12 Worm.Win32.Mabezat.b Fortinet 3.117.0.0 2009.02.12 W32/Mabezat.B GData 19 2009.02.12 Win32.Worm.Mabezat.J Ikarus T3.1.1.45.0 2009.02.12 Worm.Win32.Mabezat.b K7AntiVirus 7.10.628 2009.02.12 Virus.Win32.Mabezat.b-3 Kaspersky 7.0.0.125 2009.02.12 Worm.Win32.Mabezat.b McAfee 5524 2009.02.12 W32/Mabezat McAfee+Artemis 5524 2009.02.12 W32/Mabezat Microsoft 1.4306 2009.02.13 Virus:Win32/Mabezat.B NOD32 3849 2009.02.12 Win32/Mabezat.A Norman 6.00.02 2009.02.12 Mabezat.B nProtect 2009.1.8.0 2009.02.12 Win32.Worm.Mabezat.J Panda 10.0.0.10 2009.02.12 W32/Mabezat.C.worm PCTools 4.4.2.0 2009.02.12 Worm.Mabezat.A Prevx1 V2 2009.02.13 Malicious Software Rising 21.16.32.00 2009.02.12 Win32.Mabezat.b SecureWeb-Gateway 6.7.6 2009.02.12 Worm.Mabezat.b Sophos 4.38.0 2009.02.12 W32/Mabezat-B Sunbelt 3.2.1851.2 2009.02.12 Worm.Win32.Mabezat.b (v) Symantec 10 2009.02.13 W32.Mabezat.B TheHacker 6.3.1.9.254 2009.02.12 - TrendMicro 8.700.0.1004 2009.02.12 PE_MABEZAT.B-O VBA32 3.12.8.12 2009.02.11 Worm.Win32.Mabezat.b ViRobot 2009.2.12.1603 2009.02.12 Worm.Win32.Mabezat.154751 VirusBuster 4.5.11.0 2009.02.12 Worm.Mabezat.A Information additionnelle File size: 161485 bytes MD5...: 5a9d75e010d8fd7d7626154770ae56e4 SHA1..: 7cd1fb4a3c58766155143cd975b59ca688e2e219 SHA256: 210505f0843474a5d6a39069bcc3cbb3015afbd370400dea55c2537215db2c07 SHA512: 5bbc24e30888c94988d8aab81000014d71e49280dc48ded85d099a85a388802a c0ec30174c13d4d42c5b44035b5a980621494589dee192c208a9d2f9a7c4d10f ssdeep: 1536:cRStJJV6oedAx0NFe2zaeahETbbQs0PFR3qUbeqn4TGhF/+Y6pSFtdBSts/ zTH/F:AoWAx0NFZCpeI/QYVpSKbL/qe1XVnOBg PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000 timedatestamp.....: 0x47257ae1 (Mon Oct 29 06:17:05 2007) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xd15a 0xd200 6.30 dc4af243f434d50e2773070fa9cc8405 .rdata 0xf000 0xfd6 0x1000 3.21 0a15e36ffbdbfe3c1dc992522468a94e .data 0x10000 0x44bc 0x2800 5.44 65a878ff23c36649ac78d07f65bf59e1 .rsrc 0x15000 0x265c 0x2800 1.23 74ca46feb5f06d30bf25ea7eb96f72d8 ( 3 imports ) > MSVCRT.dll: srand, memcmp, strcat, isdigit, isspace, memcpy, rename, memset, _EH_prolog, __CxxFrameHandler, strcmp, strncpy, strstr, strcpy, rand, abs, strlen > USER32.dll: MessageBoxA, wvsprintfA > KERNEL32.dll: GetModuleHandleA, HeapReAlloc, HeapFree, GetProcessHeap, HeapAlloc, LoadLibraryA, GetProcAddress, GetTickCount, GetStartupInfoA, GetCommandLineA, ExitProcess ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=6634971FCDA8F95E76FF022A6D4D73004DDE8E59 ************************Fin JetAudio dump.exe ********************************************* ***********************Debut Windows .exe *********************************************** Antivirus Version Dernière mise à jour Résultat a-squared 4.0.0.93 2009.02.12 Worm.Win32.Mabezat.b!IK AhnLab-V3 5.0.0.2 2009.02.12 Win32/Mabezat AntiVir 7.9.0.76 2009.02.12 Worm/Mabezat.b Authentium 5.1.0.4 2009.02.13 W32/Mabezat.A Avast 4.8.1335.0 2009.02.12 Win32:Trojan-gen {Other} AVG 8.0.0.237 2009.02.12 Win32/Mabezat.B BitDefender 7.2 2009.02.13 Win32.Worm.Mabezat.J CAT-QuickHeal 10.00 2009.02.11 W32.Mabezat.Dr ClamAV 0.94.1 2009.02.12 W32.Mabezat-2 Comodo 975 2009.02.12 - DrWeb 4.44.0.09170 2009.02.13 Win32.HLLW.Tazebama eSafe 7.0.17.0 2009.02.12 Win32.Mabezat.b eTrust-Vet 31.6.6353 2009.02.12 Win32/Mabezat.B F-Prot 4.4.4.56 2009.02.13 W32/Mabezat.A F-Secure 8.0.14470.0 2009.02.12 Worm.Win32.Mabezat.b Fortinet 3.117.0.0 2009.02.12 W32/Mabezat.B GData 19 2009.02.12 Win32.Worm.Mabezat.J Ikarus T3.1.1.45.0 2009.02.12 Worm.Win32.Mabezat.b K7AntiVirus 7.10.628 2009.02.12 Virus.Win32.Mabezat.b-3 Kaspersky 7.0.0.125 2009.02.12 Worm.Win32.Mabezat.b McAfee 5524 2009.02.12 W32/Mabezat McAfee+Artemis 5524 2009.02.12 W32/Mabezat Microsoft 1.4306 2009.02.13 Virus:Win32/Mabezat.B NOD32 3849 2009.02.12 Win32/Mabezat.A Norman 6.00.02 2009.02.12 Mabezat.B nProtect 2009.1.8.0 2009.02.12 Win32.Worm.Mabezat.J Panda 10.0.0.10 2009.02.12 W32/Mabezat.C.worm PCTools 4.4.2.0 2009.02.12 Worm.Mabezat.A Prevx1 V2 2009.02.13 Malicious Software Rising 21.16.32.00 2009.02.12 Win32.Mabezat.b SecureWeb-Gateway 6.7.6 2009.02.12 Worm.Mabezat.b Sophos 4.38.0 2009.02.12 W32/Mabezat-B Sunbelt 3.2.1851.2 2009.02.12 Worm.Win32.Mabezat.b (v) Symantec 10 2009.02.13 W32.Mabezat.B TheHacker 6.3.1.9.254 2009.02.12 - TrendMicro 8.700.0.1004 2009.02.12 PE_MABEZAT.B-O VBA32 3.12.8.12 2009.02.11 Worm.Win32.Mabezat.b ViRobot 2009.2.12.1603 2009.02.12 Worm.Win32.Mabezat.154751 VirusBuster 4.5.11.0 2009.02.12 Worm.Mabezat.A Information additionnelle File size: 161165 bytes MD5...: 42298692894aa42fe884da8efdff463e SHA1..: 48df3ef4ce09c17ddb41b93ec140d159efdfb19e SHA256: fb1a4b8ba3f78654ec0177a677bdd3e435fec40a91800f9bdc68acfc3a010fb5 SHA512: 99f354eccb5c54c077abd268d9c0e43296bf489dc22b8b0de98ba2c1d36cbb2e 838f7c50089394c9c83c4409182199da6c5c8e2b61ea89d620ad298706c552e7 ssdeep: 3072:n9oThrDkdztDjKs4dXhnH2k6EjQp4lCcqUAlKds6IZj1pX154/f:nqThrQd ljKJdtWmj1GUAD1T54/f PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000 timedatestamp.....: 0x47257ae1 (Mon Oct 29 06:17:05 2007) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xd15a 0xd200 6.31 d7ed67f222691ad815fd09aecbe8f36a .rdata 0xf000 0xfd6 0x1000 3.21 0a15e36ffbdbfe3c1dc992522468a94e .data 0x10000 0x44bc 0x2800 5.44 db281f4f46345b21d9df9131aa01f2b5 .rsrc 0x15000 0x265c 0x2800 0.92 bb039337678b6fe7d7549315b5c61283 ( 3 imports ) > MSVCRT.dll: srand, memcmp, strcat, isdigit, isspace, memcpy, rename, memset, _EH_prolog, __CxxFrameHandler, strcmp, strncpy, strstr, strcpy, rand, abs, strlen > USER32.dll: MessageBoxA, wvsprintfA > KERNEL32.dll: GetModuleHandleA, HeapReAlloc, HeapFree, GetProcessHeap, HeapAlloc, LoadLibraryA, GetProcAddress, GetTickCount, GetStartupInfoA, GetCommandLineA, ExitProcess ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=24E278688D53E94375B502FB2F0B7B00144AB5EA **************************Fin pour Windows exe ********************************************** **************************Debut pour hook.dl_ *********************************************** ntivirus Version Dernière mise à jour Résultat a-squared 4.0.0.93 2009.02.12 Worm.Win32.Mabezat.b!IK AhnLab-V3 5.0.0.2 2009.02.12 Win32/Mabezat AntiVir 7.9.0.76 2009.02.12 Worm/Mabezat.b Authentium 5.1.0.4 2009.02.13 W32/Mabezat.A Avast 4.8.1335.0 2009.02.12 Win32:Trojan-gen {Other} AVG 8.0.0.237 2009.02.12 Win32/Mabezat.B BitDefender 7.2 2009.02.13 Win32.Worm.Mabezat.J CAT-QuickHeal 10.00 2009.02.11 W32.Mabezat.Dr ClamAV 0.94.1 2009.02.12 W32.Mabezat-2 Comodo 975 2009.02.12 - DrWeb 4.44.0.09170 2009.02.13 Win32.HLLW.Tazebama eSafe 7.0.17.0 2009.02.12 Win32.Mabezat.b eTrust-Vet 31.6.6353 2009.02.12 Win32/Mabezat.B F-Prot 4.4.4.56 2009.02.13 W32/Mabezat.A F-Secure 8.0.14470.0 2009.02.12 Worm.Win32.Mabezat.b Fortinet 3.117.0.0 2009.02.12 W32/Mabezat.B GData 19 2009.02.12 Win32.Worm.Mabezat.J Ikarus T3.1.1.45.0 2009.02.12 Worm.Win32.Mabezat.b K7AntiVirus 7.10.628 2009.02.12 Virus.Win32.Mabezat.b-3 Kaspersky 7.0.0.125 2009.02.12 Worm.Win32.Mabezat.b McAfee 5524 2009.02.12 W32/Mabezat McAfee+Artemis 5524 2009.02.12 W32/Mabezat Microsoft 1.4306 2009.02.13 Virus:Win32/Mabezat.B NOD32 3849 2009.02.12 Win32/Mabezat.A Norman 6.00.02 2009.02.12 Mabezat.B nProtect 2009.1.8.0 2009.02.12 Win32.Worm.Mabezat.J Panda 10.0.0.10 2009.02.12 W32/Mabezat.C.worm PCTools 4.4.2.0 2009.02.12 Worm.Mabezat.A Prevx1 V2 2009.02.13 - Rising 21.16.32.00 2009.02.12 Win32.Mabezat.b SecureWeb-Gateway 6.7.6 2009.02.12 Worm.Mabezat.b Sophos 4.38.0 2009.02.12 W32/Mabezat-B Sunbelt 3.2.1851.2 2009.02.12 Worm.Win32.Mabezat.b (v) Symantec 10 2009.02.13 W32.Mabezat.B TheHacker 6.3.1.9.254 2009.02.12 - TrendMicro 8.700.0.1004 2009.02.12 PE_MABEZAT.B-O VBA32 3.12.8.12 2009.02.11 Worm.Win32.Mabezat.b ViRobot 2009.2.12.1603 2009.02.12 Worm.Win32.Mabezat.154751 VirusBuster 4.5.11.0 2009.02.12 Worm.Mabezat.A Information additionnelle File size: 160895 bytes MD5...: d629f69152576baba87c612d6d23254d SHA1..: ee1000c29c986f0a55720939d4f5702627a198b7 SHA256: 274c559b13fe369cd803e092326e72097c987f5d3a9ca29e0c11ee4f7b50270c SHA512: 23627226b58f31ccf29a0c2aad6c81e5a3d0204fb60c04aeaf42dd09ec28a632 48aa7624433c08e60b0bbc28a2eee5bc876720940a292158849e88b901d48f55 ssdeep: 1536:3I0+sr7fLeyYDfemNLa6ufmtekoiwi6VVLcsE2Z4WvwoZiQxoKe+J/k0FnK 6dpFw:JJdok6t6VVnE2KawoZizp+hrxx3IAm9 PEiD..: - TrID..: File type identification DirectShow filter (52.6%) Windows OCX File (32.2%) Win32 Executable MS Visual C++ (generic) (9.8%) Win32 Executable Generic (2.2%) Win32 Dynamic Link Library (generic) (1.9%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000 timedatestamp.....: 0x47257ae1 (Mon Oct 29 06:17:05 2007) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xd15a 0xd200 6.31 f61d48fcf64b064c98216b2a48623ca2 .rdata 0xf000 0xfd6 0x1000 3.21 0a15e36ffbdbfe3c1dc992522468a94e .data 0x10000 0x44bc 0x2800 5.44 f65d417aca1b0b1e4933c742347774f1 .rsrc 0x15000 0x265c 0x2800 0.92 bb039337678b6fe7d7549315b5c61283 ( 3 imports ) > MSVCRT.dll: srand, memcmp, strcat, isdigit, isspace, memcpy, rename, memset, _EH_prolog, __CxxFrameHandler, strcmp, strncpy, strstr, strcpy, rand, abs, strlen > USER32.dll: MessageBoxA, wvsprintfA > KERNEL32.dll: GetModuleHandleA, HeapReAlloc, HeapFree, GetProcessHeap, HeapAlloc, LoadLibraryA, GetProcAddress, GetTickCount, GetStartupInfoA, GetCommandLineA, ExitProcess ( 0 exports ) **************************** Fin pour hook.dl_*********************************************

Destrio5 · Answer

/!\ Seul Hombrez87 peut suivre cette procédure. /!\


1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :







KillAll::

Driver::
huadio

File::
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
c:\documents and settings	azebama.dl_
c:\documents and settings\hook.dl_    
c:\documents and settings	azebama.dll  
C:\1.taz  
c:\windows\JetAudio dump.exe 
c:\windows\WINDOWS .exe  
c:\documents and settings\NetworkService\Application Data\JetAudio dump.exe       
c:\documents and settings\NetworkService\Application Data\Application Data .exe    
c:\documents and settings\merzak\Application Data\Microsoft MSN.exe    
c:\documents and settings\merzak\Application Data\Application Data .exe   
c:\documents and settings\Invité\Application Data\Application Data .exe  
c:\documents and settings\LocalService\Application Data\Application Data .exe     
c:\documents and settings\NetworkService\NetworkService .exe       
c:\documents and settings\Default User\Default User .exe     
c:\documents and settings\All Users\Application Data\Application Data .exe    
c:\documents and settings\LocalService\LocalService .exe      
c:\documents and settings\Default User\PanasonicDVD_DigitalCam.exe   
c:\documents and settings\Administrateur\Application Data\Application Data .exe    
c:\documents and settings\NetworkService\WinrRarSerialInstall.exe    
c:\huadio.tmp 
 






--> Colle la sélection dans le Bloc-notes.

--> Enregistre ce fichier sur le Bureau (Impératif).

--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.


2/

--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

--> Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

--> Une fois le scan achevé, un rapport va s'afficher : poste-le.

--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt

Hombrez87 · Answer

voici le résultat et toujours je vous remercie. ********************************** debut combofix.txt ********************************* ComboFix 09-02-12.03 - merzak 2009-02-13 1:17:08.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1023.351 [GMT 1:00] Lancé depuis: c:\documents and settings\merzak\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\merzak\Bureau\CFScript.txt AV: F-Prot Antivirus for Windows *On-access scanning enabled* (Outdated) AV: Panda Global Protection 2009 *On-access scanning disabled* (Updated) FW: Panda Personal Firewall 2009 *disabled* * Un nouveau point de restauration a été créé FILE :: C:\1.taz c:\documents and settings\Administrateur\Application Data\Application Data .exe c:\documents and settings\All Users\Application Data\Application Data .exe c:\documents and settings\Default User\Default User .exe c:\documents and settings\Default User\PanasonicDVD_DigitalCam.exe c:\documents and settings\hook.dl_ c:\documents and settings\Invité\Application Data\Application Data .exe c:\documents and settings\LocalService\Application Data\Application Data .exe c:\documents and settings\LocalService\LocalService .exe c:\documents and settings\merzak\Application Data\Application Data .exe c:\documents and settings\merzak\Application Data\Microsoft MSN.exe c:\documents and settings\NetworkService\Application Data\Application Data .exe c:\documents and settings\NetworkService\Application Data\JetAudio dump.exe c:\documents and settings\NetworkService\NetworkService .exe c:\documents and settings\NetworkService\WinrRarSerialInstall.exe c:\documents and settings azebama.dl_ c:\documents and settings azebama.dll c:\huadio.tmp c:\windows\JetAudio dump.exe c:\windows\Tasks\At1.job c:\windows\Tasks\At10.job c:\windows\Tasks\At11.job c:\windows\Tasks\At12.job c:\windows\Tasks\At13.job c:\windows\Tasks\At14.job c:\windows\Tasks\At15.job c:\windows\Tasks\At16.job c:\windows\Tasks\At17.job c:\windows\Tasks\At18.job c:\windows\Tasks\At19.job c:\windows\Tasks\At2.job c:\windows\Tasks\At20.job c:\windows\Tasks\At21.job c:\windows\Tasks\At22.job c:\windows\Tasks\At23.job c:\windows\Tasks\At24.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job c:\windows\Tasks\At5.job c:\windows\Tasks\At6.job c:\windows\Tasks\At7.job c:\windows\Tasks\At8.job c:\windows\Tasks\At9.job c:\windows\WINDOWS .exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\1.taz c:\documents and settings\Administrateur\Application Data\Application Data .exe c:\documents and settings\All Users\Application Data\Application Data .exe c:\documents and settings\Default User\Default User .exe c:\documents and settings\Default User\PanasonicDVD_DigitalCam.exe c:\documents and settings\hook.dl_ c:\documents and settings\Invité\Application Data\Application Data .exe c:\documents and settings\LocalService\Application Data\Application Data .exe c:\documents and settings\LocalService\LocalService .exe c:\documents and settings\merzak\Application Data\Application Data .exe c:\documents and settings\merzak\Application Data\Microsoft MSN.exe c:\documents and settings\NetworkService\Application Data\Application Data .exe c:\documents and settings\NetworkService\Application Data\JetAudio dump.exe c:\documents and settings\NetworkService\NetworkService .exe c:\documents and settings\NetworkService\WinrRarSerialInstall.exe c:\documents and settings azebama.dl_ c:\documents and settings azebama.dll c:\windows\JetAudio dump.exe c:\windows\Tasks\At1.job c:\windows\Tasks\At10.job c:\windows\Tasks\At11.job c:\windows\Tasks\At12.job c:\windows\Tasks\At13.job c:\windows\Tasks\At14.job c:\windows\Tasks\At15.job c:\windows\Tasks\At16.job c:\windows\Tasks\At17.job c:\windows\Tasks\At18.job c:\windows\Tasks\At19.job c:\windows\Tasks\At2.job c:\windows\Tasks\At20.job c:\windows\Tasks\At21.job c:\windows\Tasks\At22.job c:\windows\Tasks\At23.job c:\windows\Tasks\At24.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job c:\windows\Tasks\At5.job c:\windows\Tasks\At6.job c:\windows\Tasks\At7.job c:\windows\Tasks\At8.job c:\windows\Tasks\At9.job . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_HUADIO -------\Service_huadio ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-13 au 2009-02-13 )))))))))))))))))))))))))))))))))))) . 2009-02-13 01:23 . 2009-02-13 01:23 d-------- c:\documents and settings\merzak\Application Data azebama 2009-02-13 01:23 . 2009-02-13 01:23 161,625 -r-hs---- C:\zPharaoh.exe 2009-02-13 01:22 . 2009-02-13 01:22 d-------- c:\windows\LastGood 2009-02-13 01:22 . 2009-02-13 01:22 76,800 --a------ c:\windows\system32\OLD2.tmp 2009-02-12 19:20 . 2009-02-12 23:20 d-------- C: sit 2009-02-12 19:20 . 2009-02-12 23:20 d-------- c:\program files rend micro 2009-02-12 14:12 . 2009-02-12 14:12 d-------- c:\documents and settings\All Users\Application Data View_Profiles 2009-02-12 13:13 . 2009-02-12 13:13 d-------- c:\program files\Opera 2009-02-12 10:13 . 2009-02-12 18:09 d-------- c:\program files\UsbFix 2009-02-12 09:55 . 2009-02-12 09:55 dr------- c:\documents and settings\merzak\Favoris 2009-02-12 09:49 . 2009-02-12 09:49 161,165 --a------ c:\windows\WINDOWS .exe 2009-02-05 16:30 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache etapi32.dll 2009-02-05 16:23 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2009-02-05 16:09 . 2009-02-05 16:09 d-------- c:\program files\SAGEM 2009-02-05 14:38 . 2009-02-05 14:38 d-------- c:\windows\system32\fr 2009-02-05 14:38 . 2009-02-05 14:38 d-------- c:\windows\system32\bits 2009-02-05 14:38 . 2009-02-05 14:38 d-------- c:\windows\l2schemas 2009-02-04 19:28 . 2009-02-13 01:22 13,880 --a------ c:\windows\system32\drivers\COMFiltr.sys 2009-02-04 19:25 . 2008-04-28 17:35 84,024 --a------ c:\windows\system32\drivers\pavdrv51.sys 2009-02-04 19:25 . 2009-02-04 19:25 261 --a------ c:\windows\system32\PavCPL.dat 2009-02-04 19:24 . 2009-02-08 20:00 d-------- c:\documents and settings\merzak\Application Data\Panda Security 2009-02-04 19:24 . 2009-02-08 16:24 d-------- c:\documents and settings\All Users\Application Data\Panda Security 2009-02-04 19:22 . 2009-02-04 19:22 d-------- c:\program files\Fichiers communs\Panda Security 2009-02-04 19:22 . 2008-02-07 12:03 179,640 --a------ c:\windows\system32\drivers\PavProc.sys 2009-02-04 19:22 . 2008-03-04 15:59 41,144 --a------ c:\windows\system32\drivers\ShlDrv51.sys 2009-02-04 19:22 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys 2009-02-02 15:50 . 2007-08-14 08:12 18,816 --------- c:\windows\system32\SAVRKBootTasks.sys 2009-01-23 01:24 . 2009-01-23 01:25 1,024 --a------ c:\windows\system32\pwdremover.dat 2009-01-23 01:24 . 2009-01-23 01:24 36 --a------ c:\windows\verypdf.ini 2009-01-23 01:23 . 2009-01-23 01:23 d-------- c:\program files\PDF Password Remover v2.5 2009-01-23 00:12 . 2008-10-16 21:18 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2009-01-23 00:12 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2009-01-23 00:12 . 2007-03-08 06:10 1,048,576 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2009-01-23 00:12 . 2008-10-16 21:18 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2009-01-23 00:12 . 2008-10-16 21:18 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2009-01-23 00:12 . 2008-10-16 21:18 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2009-01-23 00:12 . 2008-10-16 21:18 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2009-01-23 00:12 . 2008-10-16 21:18 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2009-01-23 00:12 . 2008-10-16 14:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2009-01-22 18:27 . 2009-02-08 20:00 d-------- c:\documents and settings\merzak\Application Data\F-Secure 2009-01-22 18:19 . 2009-02-08 16:24 d-------- c:\documents and settings\All Users\Application Data\fssg 2009-01-22 18:18 . 2009-02-08 16:24 d-------- c:\documents and settings\All Users\Application Data\f-secure 2009-01-21 23:55 . 2009-01-21 23:55 d-------- c:\program files\Sophos 2009-01-21 15:57 . 2008-04-14 03:33 293,376 --------- c:\windows\system32\qagentrt.dll 2009-01-21 15:57 . 2008-04-14 03:33 290,304 --------- c:\windows\system32 httpaa.dll 2009-01-21 15:57 . 2008-04-14 03:33 153,600 -----c--- c:\windows\system32\dllcache\shmedia.dll 2009-01-21 15:57 . 2008-04-14 03:33 151,040 --------- c:\windows\system32\qagent.dll 2009-01-21 15:57 . 2008-04-14 03:32 86,016 -----c--- c:\windows\system32\dllcache\sl_anet.acm 2009-01-21 15:57 . 2004-07-17 16:34 85,617 -----c--- c:\windows\system32\dllcache\plyr_err.chm 2009-01-21 15:57 . 2008-04-14 03:33 76,800 --------- c:\windows\system32\qutil.dll 2009-01-21 15:57 . 2004-07-17 16:34 66,148 -----c--- c:\windows\system32\dllcache evert.wmz 2009-01-21 15:57 . 2008-04-14 03:33 62,464 --------- c:\windows\system32\qcliprov.dll 2009-01-21 15:57 . 2008-04-14 03:33 61,952 --------- c:\windows\system32 asqec.dll 2009-01-21 15:57 . 2008-04-14 03:34 32,768 --------- c:\windows\system32\setupn.exe 2009-01-21 15:57 . 2008-04-13 19:40 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2009-01-21 15:57 . 2004-08-04 05:50 1,818 -----c--- c:\windows\system32\dllcache\skins.inf 2009-01-21 15:55 . 2008-04-14 03:33 397,312 --------- c:\windows\system32\mmcex.dll 2009-01-21 15:54 . 2008-04-14 03:33 651,264 --------- c:\windows\system32\dot3ui.dll 2009-01-21 15:53 . 2008-04-14 03:33 136,192 --------- c:\windows\system32\aaclient.dll 2009-01-21 14:21 . 2009-02-12 09:49 d-------- C:\fsaua.data 2009-01-20 16:19 . 2009-01-20 16:19 0 --a------ c:\windows\InstalationHijach2 2009-01-20 16:13 . 2009-01-20 16:13 d-------- c:\program files\MSECache 2009-01-20 15:57 . 2006-08-01 15:02 49,152 --a------ c:\windows\system32\ChCfg.exe 2009-01-20 15:56 . 2009-01-20 15:56 d-------- c:\program files\Realtek AC97 2009-01-20 15:56 . 2006-08-01 14:58 143,360 --a------ c:\windows\system32\RtlCPAPI.dll 2009-01-20 15:45 . 2008-12-13 07:37 3,593,216 --a--c--- c:\windows\system32\dllcache\mshtml.dll 2009-01-20 15:21 . 2008-05-01 15:36 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll 2009-01-20 15:19 . 2008-10-03 11:03 247,326 -----c--- c:\windows\system32\dllcache\strmdll.dll 2009-01-20 15:18 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\WindowsShell.Manifest 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\system32 wc.cpl.manifest 2009-01-19 16:14 . 2009-01-19 16:14 749 -rah----- c:\windows\system32 cpa.cpl.manifest 2009-01-19 16:14 . 2009-01-19 16:14 488 -rah----- c:\windows\system32\logonui.exe.manifest 2009-01-19 15:12 . 2002-09-07 01:00 399,670 --a--c--- c:\windows\system32\dllcache\MAPIMIG.CAT 2009-01-19 15:12 . 2002-09-07 01:00 24,661 --a------ c:\windows\system32\spxcoins.dll 2009-01-19 15:12 . 2002-09-07 01:00 13,497 --a--c--- c:\windows\system32\dllcache\HPCRDP.CAT 2009-01-19 15:12 . 2002-09-07 01:00 13,312 --a------ c:\windows\system32\irclass.dll 2009-01-19 15:12 . 2002-09-07 01:00 8,599 --a--c--- c:\windows\system32\dllcache\IASNT4.CAT 2009-01-19 15:11 . 2004-08-04 06:43 1,086,058 -ra------ c:\windows\SETB5.tmp 2009-01-19 15:11 . 2009-02-05 16:11 1,031,358 --a------ c:\windows\setupapi.log.2.old 2009-01-19 15:11 . 2004-08-04 06:52 1,014,836 -ra------ c:\windows\SETB2.tmp 2009-01-19 15:11 . 2004-08-04 06:45 14,043 -ra------ c:\windows\SETC1.tmp 2009-01-18 00:12 . 2009-01-18 00:12 d-------- c:\program files\Fichiers communs\xing shared 2009-01-17 23:39 . 2009-02-08 16:06 d-------- C:\Davory 2009-01-17 16:11 . 2009-01-17 16:15 d-------- c:\program files\WinHex 2009-01-15 15:34 . 2009-01-15 15:35 d-------- c:\program files\PHPNukeFR 2009-01-15 00:54 . 2009-02-08 16:24 d-------- c:\documents and settings\All Users\Application Data\Backup 2009-01-14 15:16 . 2009-02-05 16:39 1,355 --a------ c:\windows\imsins.BAK . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-13 00:23 752,495 ----a-w c:\windows\soundman.exe 2009-02-13 00:22 1,132 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck 2009-02-13 00:22 1,132 ----a-w c:\windows\system32\drivers\APPFLTR.CFG 2009-02-12 22:08 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2009-02-12 22:06 906,095 ----a-w c:\windows\iun6002.exe 2009-02-12 22:06 475,503 ----a-w c:\windows\IsUninst.exe 2009-02-12 22:06 235,887 ----a-w c:\windows\bitdeins.exe 2009-02-12 18:43 --------- d-----w c:\program files\eMule 2009-02-12 18:20 238,108 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck 2009-02-12 18:20 238,108 ----a-w c:\windows\system32\drivers\APPFCONT.DAT 2009-02-12 08:49 45,000 ----a-w c:\program files\serials.rar 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\uTorrent 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\MxBoost 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\Media Player Classic 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\iolo 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\InterVideo 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\IDM 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\Flock 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\DMCache 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\AVS4YOU 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\Ahead 2009-02-08 19:00 --------- d-----w c:\documents and settings\merzak\Application Data\AdobeUM 2009-02-08 18:59 --------- d-----w c:\documents and settings\LocalService\Application Data\iolo 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\NOS 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\MSN6 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\iolo 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU 2009-02-08 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\AOL 2009-02-05 15:10 23 ----a-w c:\windows\system32\drivers\adidsl.cfg 2009-02-05 15:10 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-04 18:24 --------- d-----w c:\program files\Panda Security 2009-01-29 14:07 --------- d-----w c:\program files\ABBYY FineReader 4.0 Sprint 2009-01-29 14:00 --------- d-----w c:\program files\Groove Games 2009-01-21 13:16 --------- d-----w c:\program files\Google 2009-01-20 14:56 --------- d-----w c:\program files\AvRack 2009-01-17 23:11 --------- d-----w c:\program files\Fichiers communs\Real 2009-01-17 12:23 --------- d-----w c:\program files\Edges 2009-01-17 12:23 --------- d-----w c:\program files\Common Files 2009-01-15 00:49 --------- d-----w c:\program files\Winamp 2009-01-15 00:46 --------- d-----w c:\program files\K-Lite Codec Pack 2009-01-15 00:39 --------- d-----w c:\program files\AOL Security Toolbar 2009-01-14 23:40 --------- d-----w c:\program files\Conduit 2009-01-14 23:07 --------- d-----w c:\program files\IsoBuster 2009-01-14 23:05 --------- d-----w c:\program files\AVS4YOU 2009-01-09 22:26 --------- d-----w c:\program files\Microsoft 2009-01-09 22:25 --------- d-----w c:\program files\Windows Live 2009-01-09 22:25 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2009-01-09 22:23 --------- d-----w c:\program files\Windows Live SkyDrive 2009-01-09 21:33 --------- d-----w c:\program files\Fichiers communs\Windows Live 2009-01-09 21:27 --------- d-----w c:\program files\CCleaner 2009-01-01 23:42 --------- d-----w c:\program files\Internet Download Manager 2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR 2007-05-01 14:05 238,162 ----a-w c:\program files\Uninst.isu 2001-11-30 09:29 344,064 ----a-w c:\program files\AlbumBase.dll 2001-11-30 09:29 172,032 ----a-w c:\program files\abmFind.dll 2001-11-30 09:29 1,871,872 ----a-w c:\program files\PhotoImpression.exe 2001-11-21 16:13 126,976 ----a-w c:\program files\Res_Pi.dll 2001-11-21 15:28 10,903 ----a-w c:\program files\Lblspec.ini 2001-08-08 14:08 114,688 ----a-w c:\program files\MultiPrint.dll 2001-07-19 17:27 659,456 ----a-w c:\program files\EzDll.dll 2001-07-02 11:30 53,248 ----a-w c:\program files\wdmcapture.dll 2001-06-19 19:59 139,264 ----a-w c:\program files\Res_Dll.dll 2001-05-17 16:18 69,632 ----a-w c:\program files\ASPI.dll 2001-05-14 19:21 166,163 ----a-w c:\program files\PhotoImpression.HLP 2001-04-26 17:23 53,248 ----a-w c:\program files\EditWin.dll 2000-11-24 14:43 28,160 ----a-w c:\program files\ezrgb24.ax 2000-10-16 18:51 32,768 ----a-w c:\program files\OsWrapperForPI.dll 2000-10-09 15:43 61,440 ----a-w c:\program files\PiApi.dll 2000-10-04 14:47 90,112 ----a-w c:\program files\myCtrl.dll 2000-09-26 17:54 122,880 ----a-w c:\program files\eff_ehn.dll 2000-01-29 09:21 247,844 ----a-w c:\program files\exif.exf 1999-06-29 16:34 400 ----a-w c:\program files\click1.wav 1999-06-29 12:07 533 ----a-w c:\program files\click2.wav 1999-05-26 09:46 212,480 ----a-w c:\program files\pcdlib32.dll 1997-12-23 16:34 115,712 ----a-w c:\program files\Filefpx.dll 1996-10-17 16:40 308,736 ----a-w c:\program files\FPXLIB.DLL 1996-09-24 07:13 91,136 ----a-w c:\program files\JPEGLIB.DLL . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-12 4044983] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-03 68856] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2009-02-12 1864047] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-03-11 155648] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-03-11 114688] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-11-08 98304] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792] "HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-15 196608] "PaperPort PTD"="c:\paprport\pptd40nt.exe" [1997-08-25 22016] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2005-12-21 169472] "Athan"="c:\program files\Athan\Athan.exe" [2008-08-18 1069056] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2001-12-16 46080] "EPSON Stylus C46 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE" [2004-01-13 99840] "Nero DriveSpeed"="c:\progra~1\Ahead\NEROTO~1\DRIVES~1.EXE" [2009-02-13 596847] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB ealsched.exe" [2009-01-18 185872] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2001-12-16 2899968] "APVXDWIN"="c:\program files\Panda Security\Panda Global Protection 2009\APVXDWIN.EXE" [2008-12-03 869632] "SCANINICIO"="c:\program files\Panda Security\Panda Global Protection 2009\Inicio.exe" [2008-07-07 50432] "SoundMan"="SOUNDMAN.EXE" [2009-02-13 c:\windows\soundman.exe] "nwiz"="nwiz.exe" [2001-12-16 c:\windows\system32 wiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Administrateur\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage .exe [2009-02-08 160945] Recycle Bin.exe [2009-02-08 381803] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2005-11-14 377831] DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-02-05 962661] gwum.lnk - c:\program files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe [2008-07-05 471040] InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-11-14 110592] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\avldr] 2008-03-18 16:58 58672 c:\windows\system32\avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.iv41"= ir41_32.dll "vidc.I263"= i263_32.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *sprestrt [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\WINDOWS\system32\usmt\migwiz.exe"= "c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"= "c:\Program Files\Microsoft Visual Studio\VB98\VB6.EXE"= "c:\Program Files\Maxthon2\Maxthon.exe"= "c:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe"= "c:\Program Files\eMule\emule.exe"= "c:\Program Files\uTorrent\uTorrent.exe"= "c:\Program Files\Real\RealPlayer\realplay.exe"= "c:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= R0 pavboot;Panda boot driver;c:\windows\system32\drivers\pavboot.sys [2009-02-04 28544] R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2009-02-04 73728] R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2009-02-04 52992] R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2009-02-04 22072] R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2009-02-04 193792] R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2009-02-04 19:24:39 158848] R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [2009-02-02 18816] R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2009-02-04 41144] R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2009-02-04 46720] R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda --> c:\windows\system32\svchost -k Panda [?] R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2009-02-04 179640] R2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Global Protection 2009\psksvc.exe [2009-02-04 28928] R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?] R3 MarkFun_NT;MarkFun_NT;c:\program files\Gigabyte\Gigabyte Windows Utility Manager\MARKFUN.W32 [2008-07-05 8236] R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\drivers eti1634.sys [2009-02-04 197888] R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?] R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?] R3 WMIBIOS;%WMIBIOS.ServiceName%;c:\windows\system32\drivers\wmibios.sys [2008-07-05 18272] R3 WMIINFO;WMIINFO Driver;c:\windows\system32\drivers\wmiinfo.sys [2008-07-05 21184] S0 FPA_RTP;FPA_RTP;c:\windows\system32\Drivers\FSTOPW.SYS --> c:\windows\system32\Drivers\FSTOPW.SYS [?] S2 UPSMON_Service;UPSMON_Service;TC --> TC [?] S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\16.tmp --> c:\windows\system32\16.tmp [?] S3 MTK;Media Technology Kernel Driver;c:\windows\system32\drivers\MTK.SYS [2008-11-01 15670] S3 V90drv;v90drv;c:\windows\system32\drivers\v90drv.sys [2001-11-29 1432836] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] panda REG_MULTI_SZ Gwmsrv . . ------- Examen supplémentaire ------- . IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: {A5721EC0-45FD-4AF6-8D26-B511385D81CE} = 81.22.90.29 82.101.136.29 TCP: {EF3D6FAB-3941-46D0-B915-8CB969DB9885} = 192.168.0.1 DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\merzak\Application Data\Mozilla\Firefox\Profiles\fmh4ox8s.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102473&SearchSource=3&q= FF - prefs.js: browser.search.selectedEngine - PHPNukeFR Customized Web Search FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2102473&SearchSource=13 FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102473&SearchSource=2&q= FF - component: c:\documents and settings\merzak\Application Data\Mozilla\Firefox\Profiles\fmh4ox8s.default\extensions\{258fe8b8-a13c-4b91-9a0c-c2d3cab8b990}\components\FFAlert.dll FF - component: c:\program files\Real\RealPlayer\browserrecord\components prpbrowserrecordplugin.dll FF - plugin: c:\program files\Microsoft\Office Live pOLW.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll ---- PARAMETRES FIREFOX ---- FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-13 01:23:28 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\windows\system32\OLD16.tmp 277871 bytes executable c:\windows\system32\OLD19.tmp 301935 bytes executable c:\windows\system32\OLD1C.tmp 243567 bytes executable c:\windows\system32\OLD1F.tmp 840559 bytes executable c:\windows\system32\OLD22.tmp 510319 bytes executable c:\windows\system32\OLD27.tmp 295791 bytes executable c:\windows\system32\OLD2A.tmp 1394031 bytes executable c:\windows\system32\OLD31.tmp 290671 bytes executable c:\windows\system32\OLD34.tmp 282479 bytes executable c:\windows\system32\OLD37.tmp 218479 bytes executable c:\windows\system32\OLD3A.tmp 220015 bytes executable c:\windows\system32\OLD3D.tmp 701807 bytes executable c:\windows\system32\OLD40.tmp 195439 bytes executable c:\windows\system32\OLD45.tmp 233327 bytes executable c:\windows\system32\OLDF.tmp 233327 bytes executable Scan terminé avec succès Fichiers cachés: 15 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MarkFun_NT] "ImagePath"="\??\c:\program files\Gigabyte\Gigabyte Windows Utility Manager\markfun.w32" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2] "ImagePath"="\??\c:\windows\system32\16.tmp" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPSMON_Service] "ImagePath"="T\14C" . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\System\Setup\AllowStart\DcomLaunch] @DACL=(02 0000) [HKEY_LOCAL_MACHINE\System\Setup\AllowStart\Sacsvr] @DACL=(02 0000) . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(884) c:\windows\system32\avldr.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Panda Security\Panda Global Protection 2009\TPSrv.exe c:\program files\APC\APC PowerChute Personal Edition\mainserv.exe c:\windows\system32\inetsrv\inetinfo.exe c:\program files\CDBurnerXP Pro 3\Tools\NMSAccess.exe c:\windows\system32 vsvc32.exe c:\program files\Panda Security\Panda Global Protection 2009\PsCtrlS.exe c:\program files\Panda Security\Panda Global Protection 2009\PavFnSvr.exe c:\program files\Fichiers communs\Panda Security\PavShld\PavPrSrv.exe c:\program files\Panda Security\Panda Global Protection 2009\PsImSvc.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\Panda Security\Panda Global Protection 2009\PAVSRV51.EXE c:\program files\Panda Security\Panda Global Protection 2009\AVENGINE.EXE c:\program files\Panda Security\Panda Global Protection 2009\FIREWALL\PSHost.exe c:\program files\Panda Security\Panda Global Protection 2009\PavBckPT.exe c:\windows\system32 undll32.exe c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe c:\windows\system32\wscntfy.exe c:\windows\system32 undll32.exe c:\qoobox\Quarantine\c\Documents and Settings azebama.dl_.vir c:\windows\system32\msiexec.exe . ************************************************************************** . Heure de fin: 2009-02-13 1:28:09 - La machine a redémarré ComboFix-quarantined-files.txt 2009-02-13 00:28:06 ComboFix2.txt 2009-02-12 23:04:56 Avant-CF: 528 150 528 octets libres Après-CF: 449,855,488 octets libres 461 --- E O F --- 2009-02-12 09:00:36 ***************************** Fin Combofix.txt ************************************

Destrio5 · Answer

/!\ Seul Hombrez87 peut suivre cette procédure. /!\


1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :







KillAll::

File::
C:\zPharaoh.exe 
c:\documents and settings\merzak\Application Data	azebama   
c:\windows\WINDOWS .exe 
 






--> Colle la sélection dans le Bloc-notes.

--> Enregistre ce fichier sur le Bureau (Impératif).

--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.


2/

--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

--> Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

--> Une fois le scan achevé, un rapport va s'afficher : poste-le.

--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt

Un ver dans mon ordi

28 réponses