Spyware, Keylogger, A L'AIDE!! - Page 2

ComboFix 09-03-19.02 - cunnigganh 2009-03-22 21:18:46.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.767.453 [GMT 1:00]
Lancé depuis: c:\documents and settings\cunnigganh\Bureau\scan.exe
Commutateurs utilisés :: c:\documents and settings\cunnigganh\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
AV: BitDefender Antivirus *On-access scanning disabled* (Updated)
FW: BitDefender Firewall *disabled*
* Un nouveau point de restauration a été créé

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!

FILE ::
C:\luk1ylq.com
J:\m9ma.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\bekehutu
c:\documents and settings\All Users\Application Data\bisomasu
c:\documents and settings\All Users\Application Data\boliraka
c:\documents and settings\All Users\Application Data\duzileru
c:\documents and settings\All Users\Application Data\duzileru\urelizud.ini
c:\documents and settings\All Users\Application Data\gojidisi
c:\documents and settings\All Users\Application Data\gojidisi\isidijog.ini
c:\documents and settings\All Users\Application Data\hejivego
c:\documents and settings\All Users\Application Data\jivuvomo
c:\documents and settings\All Users\Application Data\jogihuju
c:\documents and settings\All Users\Application Data\kojofaba
c:\documents and settings\All Users\Application Data\miziwiva
c:\documents and settings\All Users\Application Data\nitesani
c:\documents and settings\All Users\Application Data\rekomeve
c:\documents and settings\All Users\Application Data\rekomeve\evemoker.ini
c:\documents and settings\All Users\Application Data\silugihi
c:\documents and settings\All Users\Application Data\tevupiru
c:\documents and settings\All Users\Application Data\vagiwara
c:\documents and settings\All Users\Application Data\vagiwara\arawigav.ini
c:\documents and settings\All Users\Application Data\vekesuwo
c:\documents and settings\All Users\Application Data\vekesuwo\owusekev.ini
c:\documents and settings\All Users\Application Data\vekesuwo\owusekev.ini2
c:\documents and settings\All Users\Application Data\zawibavu
c:\documents and settings\All Users\Application Data\zenemure
C:\luk1ylq.com

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-22 au 2009-03-22 ))))))))))))))))))))))))))))))))))))
.

2009-03-21 22:33 . 2009-03-21 22:34 <REP> d-------- C:\ComboFix
2009-03-21 22:27 . 2009-03-22 20:38 <REP> d-------- C:\ToolBar SD
2009-03-21 21:19 . 2009-03-21 21:19 578,048 --a--c--- c:\windows\system32\dllcache\user32.dll
2009-03-21 21:14 . 2009-03-21 21:14 <REP> d-------- c:\windows\ERUNT
2009-03-21 21:13 . 2009-03-21 21:56 <REP> d-------- C:\SDFix
2009-03-20 13:29 . 2009-03-20 13:29 <REP> d-------- c:\program files\Avira
2009-03-20 13:29 . 2009-03-20 13:29 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-03-19 13:40 . 2009-03-19 13:40 <REP> d-------- c:\windows\nvidia icons
2009-03-19 13:39 . 2009-03-19 13:39 <REP> d-------- C:\NVIDIA
2009-03-06 17:38 . 2009-03-06 17:40 <REP> d-------- c:\documents and settings\cunnigganh\Application Data\U3

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-22 20:00 --------- d-----w c:\documents and settings\cunnigganh\Application Data\uTorrent
2009-03-21 19:32 --------- d-----w c:\program files\trend micro
2009-03-21 13:51 --------- d-----w c:\program files\Steam
2009-03-20 15:34 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-17 17:56 --------- d-----w c:\program files\World of Warcraft
2009-03-16 16:25 --------- d-----w c:\documents and settings\cunnigganh\Application Data\OpenOffice.org2
2009-03-13 19:49 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-10 19:08 --------- d-----w c:\documents and settings\cunnigganh\Application Data\teamspeak2
2009-02-14 15:35 --------- d-----w c:\program files\Teamspeak2_RC2
2009-02-13 00:00 --------- d-----w c:\program files\DivX
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-09 11:56 --------- d-----w c:\program files\CCleaner
2009-02-01 08:59 --------- d-----w c:\program files\Peggle Nights Deluxe
2009-01-31 09:36 --------- d-----w c:\program files\IKEA HomePlanner
2009-01-31 09:36 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2009-01-29 05:26 2,157 --sh--w c:\windows\system32\dobazusi.exe
2009-01-28 10:34 --------- d-----w c:\program files\Reference Assemblies
2009-01-28 10:34 --------- d-----w c:\program files\MSBuild
2009-01-28 10:08 3,140 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-01-28 01:44 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-01-28 01:26 --------- d-----w c:\program files\iSkysoft
2009-01-28 01:23 --------- d-----w c:\program files\Aglare DVD to AVI WMV MP4 MPEG Converter
2009-01-28 01:17 --------- d-----w c:\program files\Fichiers communs\Nero
2009-01-27 23:43 --------- d-----w c:\documents and settings\cunnigganh\Application Data\Ulead Systems
2009-01-27 22:44 --------- d-----w c:\documents and settings\cunnigganh\Application Data\Corel
2009-01-27 22:33 --------- d-----w c:\program files\InterVideo
2009-01-27 22:30 --------- d-----w c:\program files\Fichiers communs\InterVideo
2009-01-27 22:30 --------- d-----w c:\documents and settings\All Users\Application Data\Ulead Systems
2009-01-27 22:29 10,368 ----a-w c:\windows\system32\drivers\iviaspi.sys
2009-01-27 22:28 --------- d-----w c:\program files\Fichiers communs\Ulead Systems
2009-01-27 22:28 --------- d-----w c:\program files\Fichiers communs\Protexis
2009-01-27 17:04 --------- d-----w c:\program files\Winamp
2009-01-27 10:29 --------- d-----w c:\program files\Wanadoo
2009-01-09 23:43 1,245,184 ----a-w c:\windows\system32\ejavuvis.tmp
2009-01-03 08:07 81,920 ----a-w c:\windows\system32\frapsvid.dll
2007-04-25 08:49 328 ------w c:\program files\GuideMenuSetup.iss
2007-04-06 03:28 1,237 ------w c:\program files\WinDVDSetup.iss
2006-06-11 12:14 278,528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
2004-06-14 15:04 954,123 -c--a-w c:\documents and settings\cunnigganh\ChankastUtilv02a3.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-09-28 185632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"nwiz"="nwiz.exe" [2008-05-03 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.l3acm"= L3codecp.acm
"VIDC.X264"= x264vfw.dll
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\vio\dvacm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashMute]
--a------ 2006-03-11 20:49 221184 c:\program files\FlashMute\flashmute.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a--c--- 2004-08-03 22:32 208952 c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-08-19 16:10 1667584 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2002-09-18 16:21 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-05-03 05:46 13529088 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-05-03 05:46 86016 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2002-09-18 16:21 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2002-09-18 16:21 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
--a------ 2004-01-26 10:38 866816 c:\program files\Thomson\SpeedTouch USB\dragdiag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-06-14 17:32 132760 c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-09-28 22:40 185632 c:\program files\Fichiers communs\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
--a--c--- 2006-04-29 14:21 94208 c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
--------- 2004-08-23 13:49 20480 c:\progra~1\Wanadoo\Watch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-05-03 05:46 1630208 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2006-11-17 04:42 577536 c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"StyleXPService"=2 (0x2)
"rpcapd"=3 (0x3)
"iPod Service"=3 (0x3)
"gusvc"=2 (0x2)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"IDriverT"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"AVG Anti-Spyware Guard"=2 (0x2)
"FTRTSVC"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Warcraft III\\Frozen Throne.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cmg5dr\\counter-strike source\\hl2.exe"=
"c:\\WINDOWS\\system32\\imapi.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\guard.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\astropop deluxe\\WinAP.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\peggle extreme\\PeggleExtreme.exe"=
"c:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

S0 amsmem;amsmem;c:\windows\system32\drivers\ltrp.sys --> c:\windows\system32\drivers\ltrp.sys [?]
S3 ATMEL FVNETusb (AR)(R);ATMEL FVNETusb (AR)(R) Service for WLAN USB Adaptor (AR);c:\windows\system32\DRIVERS\vnetusbr.sys --> c:\windows\system32\DRIVERS\vnetusbr.sys [?]
S3 Camdrv30;Philips ToUcam XS;c:\windows\system32\drivers\camdrv30.sys [2006-02-04 171264]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-08-02 32512]
S3 scsiprnt;Classe d'imprimantes générique Microsoft SCSI/1394;c:\windows\system32\drivers\scsiprnt.sys [2007-01-24 11648]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-07-01 356920]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [2005-06-20 215040]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\Installer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\jm3cx96.bat
\Shell\open\Command - H:\jm3cx96.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7fc2a1c-0a6c-11de-b089-00073a2b52a3}]
\Shell\AutoRun\command - I:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7fc2a1d-0a6c-11de-b089-00073a2b52a3}]
\Shell\AutoRun\command - J:\m9ma.exe
\Shell\explore\Command - J:\m9ma.exe
\Shell\open\Command - J:\m9ma.exe
.
Contenu du dossier 'Tâches planifiées'

2009-03-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.dufpy.com
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
IE: { - c:\program files\Messenger\MSMSGS.EXE
TCP: {4075533F-30F6-4641-BB38-093E5D55B094} = 192.168.1.1
FF - ProfilePath - c:\documents and settings\cunnigganh\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Torrent Scan
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-22 21:22:33
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-03-22 21:24:41
ComboFix-quarantined-files.txt 2009-03-22 20:24:21
ComboFix2.txt 2009-03-21 21:58:22

Avant-CF: 50 452 221 952 octets libres
Après-CF: 50,463,752,192 octets libres

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
241

Ok ,tres bien maintenant on va faire le point ,recolle moi un nouveau rapport RSIT .

Dis moi comment va ton pc ?

Voila voila!

Logfile of random's system information tool 1.05 (written by random/random)
Run by cunnigganh at 2009-03-23 14:14:16
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 48 GB (20%) free of 238 GB
Total RAM: 767 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:14:23, on 23/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Protexis\License Service\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\cunnigganh\Bureau\Vaincre ou mourir\RSIT.exe
C:\Program Files\trend micro\cunnigganh.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://dufpy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4075533F-30F6-4641-BB38-093E5D55B094}: NameServer = 192.168.1.1
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Fichiers communs\Protexis\License Service\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Il y a encore des cochonneries sur ton pc .....Mouarff !

Télécharge RAV ANTIVIRUS par Evosla
:
http://ww25.evosla.com/compteur.php?soft=rav_antivirus

--- Décompresse-le (clic droit >> Extraire ici) et double cliquer sur le fichier RAV.exe

--- Branche tes disques amovibles (clef usb,stick memoire,disque externe,............);

--- une fois RAV ANTIVIRUS lancé laisse le réagir , il scanne automatiquement tous les lecteurs (Disques fixes et amovibles).

--- si un virus est trouvé, un log s'établira, sinon rien ne va se passer et le soft affichera "Votre Ordinateur est Sain".

--- Retire les disques amovible et redémarrez l'ordinateur.

===========================
Télécharge OTMoveIt3 de OldTimer sur ton Bureau en cliquant sur ce lien :

http://oldtimer.geekstogo.com/OTMoveIt3.exe

Double-clique sur OTMoveIt3.exe pour le lancer.

Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.

Copie la liste qui se trouve en gras ci-dessous,

et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".

:processes
explorer.exe

:Reg

:files
c:\windows\system32\olhrwef.exe
C:\WINDOWS\system32\nmdfgds1.dll
C:\WINDOWS\system32\nmdfgds0.dll
j:\m9ma.exe
C:\Documents and Settings\All Users\Application Data\godidusa
C:\Documents and Settings\All Users\Application Data\dawusere
C:\Documents and Settings\All Users\Application Data\tenugizu
C:\Documents and Settings\All Users\Application Data\gulidowu
C:\Documents and Settings\All Users\Application Data\bufezeza
:services

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]


Clique sur "MoveIt!" pour lancer la suppression.

Le résultat apparaitra dans le cadre "Results".

Clique sur "Exit" pour fermer.

Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .

Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

désolé pour cette longue attente JFK...

J'execute le scan RAV, mais il me dit periodiquement "votre ordinateur est sain" puis "votre ordinateur est infecté", en supprimant toujours les mêmes virus.

Faut-il attendre très longtemps?

Voila le rapport de OTMoveIt3

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
========== FILES ==========
c:\windows\system32\olhrwef.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\nmdfgds1.dll
C:\WINDOWS\system32\nmdfgds1.dll NOT unregistered.
C:\WINDOWS\system32\nmdfgds1.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\nmdfgds0.dll
C:\WINDOWS\system32\nmdfgds0.dll NOT unregistered.
C:\WINDOWS\system32\nmdfgds0.dll moved successfully.
File/Folder j:\m9ma.exe not found.
C:\Documents and Settings\All Users\Application Data\godidusa moved successfully.
C:\Documents and Settings\All Users\Application Data\dawusere moved successfully.
C:\Documents and Settings\All Users\Application Data\tenugizu moved successfully.
C:\Documents and Settings\All Users\Application Data\gulidowu moved successfully.
C:\Documents and Settings\All Users\Application Data\bufezeza moved successfully.
========== SERVICES/DRIVERS ==========
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\etilqs_REpU6OEmoNvh1m0nDNIB scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\~DFCB83.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\~DFCB8F.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\~DFD6FD.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\~DFD70C.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03282009_120433

Files moved on Reboot...
File C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\etilqs_REpU6OEmoNvh1m0nDNIB not found!
File C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\~DFCB83.tmp not found!
File C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\~DFCB8F.tmp not found!
File C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\~DFD6FD.tmp not found!
File C:\DOCUME~1\CUNNIG~1\LOCALS~1\Temp\~DFD70C.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\cunnigganh\Local Settings\Application Data\Mozilla\Firefox\Profiles\b1iw9h02.default\urlclassifier3.sqlite moved successfully.

Salut ;

Peux tu me recoller un nouveau rapport RSIT pour voir ou on en est .

Le voila, et je précise que mon frère est encore allé sur des sites douteux, mais que ca ne se reproduira plus.

Logfile of random's system information tool 1.05 (written by random/random)
Run by cunnigganh at 2009-03-28 12:21:59
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 47 GB (20%) free of 238 GB
Total RAM: 767 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:06, on 28/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\Protexis\License Service\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\cunnigganh\Bureau\Vaincre ou mourir\RSIT.exe
C:\Program Files\trend micro\cunnigganh.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://dufpy.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4075533F-30F6-4641-BB38-093E5D55B094}: NameServer = 192.168.1.1
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Fichiers communs\Protexis\License Service\PSIService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Tu m'as posté un ancien log ==>Run by cunnigganh at 2009-03-23 14:14:16

J'en veux un nouveau .

Le lecteur J:\ est une clé USB ?

c'était le Ipod d'un ami que j'ai laissé branché, mais je doute fort que le virus vienne de là!

Voila JFK!:

29/03/2009 ---- 13:27:31,04

----------------------------------
§§§§§§ [olhrwef] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete

********************
[Registre]
********************

Aucune entrée détectée

*******************
[Fichier]
*******************

*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté

Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

OAD ne trouve aucunes traces ??!

Télécharge Dr.Web CureIt sur ton Bureau:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

* Démarre en mode sans échec.
* Double clique drweb-cureit.exe et ensuite clique sur Analyse ;
* Clique Ok à l'invite de l'analyse rapide. Ce scan permet l'analyse des processus chargés en mémoire ; s'il trouve des processus infectés, clique le bouton Oui pour tout à l'invite.
**Note : une fenêtre s'ouvrira avec options pour "Commander" ou "50% de réduction" ; vous pouvez quitter en cliquant le "X"
* Lorsque le scan rapide est terminé, Clique sur le menu Options >> Changer la configuration;
* Choisis l'onglet "Scanner", et décoche "Analyse heuristique". Clique "Ok"
* De retour à la fenêtre principale : clique pour activer "Analyse complète";
* Clique le bouton avec flèche verte sur la droite, et le scan débutera.
* Clique Oui pour tout à l'invite "Désinfecter ?" lorsqu'un fichier est détecté, et ensuite clique "Désinfecter".
* Lorsque le scan sera complété, regarde si tu peux cliquer sur cet icône, adjacent aux fichiers détectés :
* Si oui, alors clique dessus et ensuite clique sur l'icône "Suivant", au dessous, et choisis Déplacer en quarantaine l'objet indésirable
* Du menu principal de l'outil, au haut à gauche, clique sur le menu Fichier et choisis Enregistrer le rapport
* Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv
* Ferme Dr.Web Cureit
* Redémarre ton ordi (*très important*), car certains fichiers peuvent être déplacés/réparés au redémarrage.
* Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.