Win32:Kavos [Trj]

Bonjour,

############################## | UsbFix V3.034 |

# User : Administrateur (Administrateurs) # TITANIUM
# Update on 29/06/09 by Chiquitine29 & C_XX
# Start at: 07:51:26 | 30/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

# AMD Athlon(tm) XP Processor 3000+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090629-0] 4.8.1335 [ Enabled | Updated ]

# C:\ # Disque fixe local # 37,25 Go (9,69 Go free) # NTFS
# D:\ # Disque CD-ROM # 245,11 Mo (0 Mo free) [SoftwareSuite] # CDFS

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Registre Startup |

HKCU_Main: "Start Page"="https://www.google.fr/?gws_rd=ssl"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Administrateur"
HKLM_logon: "AltDefaultUserName"="Administrateur"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: NVMixerTray="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
HKLM_Run: iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKLM_Run: NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM_Run: nwiz=nwiz.exe /install
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader

9.0\Reader\Reader_sl.exe"
HKLM_Run: SearchSettings=C:\Program Files\pdfforge Toolbar\SearchSettings.exe
HKLM_Run: Nikon Transfer Monitor=C:\Program Files\Fichiers

communs\Nikon\Monitor\NkMonitor.exe
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM_Run: avast!="C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
HKLM_Run:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
HKCU_Run: BitTorrent DNA="C:\Program Files\DNA\btdna.exe"
HKCU_Run: cdoosoft=C:\WINDOWS\system32\olhrwef.exe

################## | Fichiers # Dossiers infectieux |

Présent ! C:\WINDOWS\system32\nmdfgds0.dll
Présent ! C:\WINDOWS\system32\olhrwef.exe
Présent ! C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IS12.tmp\install.exe
C:\autorun.inf # -> fichier appelé : "C:\gclwpivc.cmd" ( Présent ! )
Présent ! C:\gclwpivc.cmd
Présent ! C:\q9.cmd
Présent ! C:\install\install.exe
Présent ! C:\autorun.inf
Présent ! D:\welcome.exe
Présent ! D:\autorun.inf

################## | Registre # Clés Run infectieuses |

Présent ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
Présent !

HKU\S-1-5-21-1292428093-602162358-1177238915-500\SOFTWARE\Microsoft\Windows\CurrentVersion\R

un "cdoosoft"

################## | Registre # Mountpoints2 |

HKCU\...\Explorer\MountPoints2\{12bfc536-d820-11dd-870c-000fb00f0ac7}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{12bfc536-d820-11dd-870c-000fb00f0ac7}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{12bfc536-d820-11dd-870c-000fb00f0ac7}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{2fc74904-4afa-11de-874f-000fb00f0ac7}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{2fc74904-4afa-11de-874f-000fb00f0ac7}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{6403c3ee-3c0b-11de-8744-000fb00f0ac7}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{6403c3ee-3c0b-11de-8744-000fb00f0ac7}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{6403c3ee-3c0b-11de-8744-000fb00f0ac7}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{75954b6e-eef9-11dd-8726-000fb00f0ac7}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{75954b6e-eef9-11dd-8726-000fb00f0ac7}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{97668faa-634d-11de-876a-000fb00f0ac7}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{97668faa-634d-11de-876a-000fb00f0ac7}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{c748edc2-d523-11dd-9877-806d6172696f}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ec4df4d3-d51e-11dd-aa6b-806d6172696f}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ec4df4d3-d51e-11dd-aa6b-806d6172696f}\Shell\open\Command

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# (!) wuauserv -> Start = 4 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | Cracks / Keygens / Serials |

################## | ! Fin du rapport # UsbFix V3.034 ! |