trojan indélogeable: PSWOnlineGaming,

Question

Bonjour,

Je viens de me faire méchamment spammer par SecuritySystem2009, que je pense avoir éradiqué. Mais AVG detecte encore un trojan PSW.OnlineGaming qu'il n'arrive pas à enlever. Je ne peux pas non plus le supprimer, même en mode sans échec. 
Pouvez-vous m'aider s'il vous plait?
Merci

Vincent

eZula · Answer

Bonjour,

télécharge GenProc http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip sur ton bureau

dézippe le dossier, double-clique sur GenProc.bat [img]http://forum.telecharger.01net.com/forum/[/img] et poste le contenu du rapport qui s'ouvre

Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html

vinzentz · Answer

Rapport GenProc 2.601 [1] - 04/07/2009 à 10:27:19 
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.0.11) [Navigateur par défaut]

 Il est impératif de désactiver le résident TeaTimer de Spybot pendant l'ensemble des manipulations qui vont suivre. Aide Tea-Timer : http://ww11.genproc.com/spybot/spybot.html

Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures" ; par la suite, laisse-le avec ses réglages par défaut. C'est tout. 

# Etape 1/ Télécharge :
 
- ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe (sUBs) sur ton Bureau.
Désactive ton antivirus, ton pare-feu et ferme tes programmes en cours. Lance combofix.exe et accepte les termes en cliquant sur OUI. Patiente. Au message "ComboFix a détecté que la 'console de récupération Windows' n'existe pas sur ce PC", clique sur oui puis sur OK, puis patiente. Valide le CLUF Microsoft. Au message "La console de récupération a été installée avec succès", clique impérativement sur NON pour quitter le programme (ferme également le rapport CF-RC.txt qui s'est ouvert)

- SmitfraudFix http://siri.urz.free.fr/Fix/SmitfraudFix.exe (S!Ri). Double-clique sur le fichier "smitfraudfix.exe" et choisis l'option 1 ; il va lister tous les éléments nuisibles dans un rapport : poste-le maintenant et passe à la suite.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/  ; Choisis ta session courante *** vincent *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).


# Etape 2/ 

 Double-clique sur le fichier "SmitfraudFix.exe" et choisis l'option 2, réponds oui à tout et laisse-le procéder. Sauvegarde le rapport sur ton bureau.

# Etape 3/ 

 Double clique sur combofix.exe et suis les instructions. Attention de ne pas utiliser ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne au risque de figer l'ordinateur.

# Etape 4/ 

 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 5/ 

 Redémarre normalement et poste, dans la même réponse : 

- Le contenu du rapport Combofix.txt situé dans D:\ ; 
- Le contenu du rapport rapport.txt situé sur le Bureau ; 
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Un nouveau rapport GenProc ;

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~


# Détections [1] GenProc 2.601 04/07/2009 à 10:27:35 
Vundo:le 04/07/2009 à 10:27:47 RegExp 
Smitfraud:le 04/07/2009 à 10:27:49 "D:\WINDOWS\System32\msxml71.dll" 

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 10:28:14 ~~

eZula · Answer

suis la procédure

vinzentz · Answer

Rapport SmithfraudFix n°1:

SmitFraudFix v2.423

Scan done at 10:50:48,10, 04/07/2009
Run from D:\Documents and Settings\vincent\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Digidesign\Drivers\MMERefresh.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgnsx.exe
D:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\Program Files\AVG\AVG8\avgcsrvx.exe
D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
D:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\OpenOffice.org 3\program\soffice.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Program Files\OpenOffice.org 3\program\soffice.bin
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\vincent\Desktop\SmitfraudFix\Policies.exe
D:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» D:\

D:\autorun.inf FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» D:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» D:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» D:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» D:\WINDOWS\system32

D:\WINDOWS\system32\msxml71.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\vincent


»»»»»»»»»»»»»»»»»»»»»»»» D:\DOCUME~1\vincent\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\vincent\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» D:\DOCUME~1\vincent\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» D:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="d:\windows\system32\dukovolo.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="d:\windows\system32\dukovolo.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="D:\WINDOWS\system32\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Neuf Box 4 (BCM USB/NDIS) - Packet Scheduler Miniport
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C5A9B668-94D8-441A-9018-F3E59061EECF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C5A9B668-94D8-441A-9018-F3E59061EECF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C5A9B668-94D8-441A-9018-F3E59061EECF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

vinzentz · Answer

Rapport ComboFix:

ComboFix 09-07-03.03 - vincent 04/07/2009 11:11.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional  5.1.2600.3.1252.33.1033.18.1791.1576 [GMT 2:00]
Lancé depuis: d:\documents and settings\vincent\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
d:\windows\Install.txt
d:\windows\msa.exe
d:\windows\system32\404Fix.exe
d:\windows\system32\Agent.OMZ.Fix.exe
d:\windows\system32\comsa32.sys
d:\windows\system32\dumphive.exe
d:\windows\system32\FInstall.sys
d:\windows\system32\IEDFix.C.exe
d:\windows\system32\IEDFix.exe
d:\windows\system32\ileheraz.ini
d:\windows\system32\Install.txt
d:\windows\system32\msncache.dll
d:\windows\system32\msvcsv60.dll
d:\windows\system32\o4Patch.exe
d:\windows\system32\Process.exe
d:\windows\system32\SrchSTS.exe
d:\windows\system32	mp.reg
d:\windows\system32	psaxyd.exe
d:\windows\system32\VACFix.exe
d:\windows\system32\VCCLSID.exe
d:\windows\system32\wiawow32.sys
d:\windows\system32\WS2Fix.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSNCACHE
-------\Service_AVPsys
-------\Service_msncache


(((((((((((((((((((((((((((((   Fichiers créés du 2009-06-04 au 2009-07-04  ))))))))))))))))))))))))))))))))))))
.

2009-07-04 06:51 . 2009-07-04 07:07	--------	d-----w-	d:\program files\Enigma Software Group
2009-07-04 06:36 . 2009-07-04 06:36	--------	d-----w-	d:\program files\Common Files\Wise Installation Wizard
2009-07-04 06:34 . 2009-07-04 09:07	--------	d-----w-	d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-04 06:34 . 2009-07-04 06:35	--------	d-----w-	d:\program files\Spybot - Search & Destroy
2009-07-04 04:31 . 2009-07-04 07:45	--------	d--h--w-	D:\$AVG8.VAULT$
2009-07-04 04:20 . 2009-07-04 04:20	11952	----a-w-	d:\windows\system32\avgrsstx.dll
2009-07-04 04:20 . 2009-07-04 04:20	108552	----a-w-	d:\windows\system32\drivers\avgtdix.sys
2009-07-04 04:20 . 2009-07-04 04:20	335752	----a-w-	d:\windows\system32\drivers\avgldx86.sys
2009-07-04 04:20 . 2009-07-04 04:20	27784	----a-w-	d:\windows\system32\drivers\avgmfx86.sys
2009-07-04 04:20 . 2009-07-04 07:13	--------	d-----w-	d:\windows\system32\drivers\Avg
2009-07-04 04:20 . 2009-07-04 08:16	--------	d-----w-	d:\documents and settings\All Users\Application Data\avg8
2009-06-29 14:39 . 2009-06-30 06:41	--------	d-----w-	d:\documents and settings\vincent\Tracing
2009-06-29 14:38 . 2009-06-29 14:38	--------	d-----w-	d:\program files\Windows Live SkyDrive
2009-06-29 14:34 . 2009-06-29 14:34	--------	d-----w-	d:\program files\Common Files\Windows Live
2009-06-24 15:44 . 2009-06-24 15:44	--------	d-----w-	d:\program files\ASIO4ALL v2
2009-06-21 18:11 . 2009-06-21 18:11	--------	d-----w-	d:\program files\7-Zip
2009-06-17 10:55 . 2009-06-17 10:56	--------	d-----w-	d:\program files\Guitar Pro 5
2009-06-15 08:48 . 2009-06-15 08:48	--------	d--h--r-	d:\documents and settings\vincent\Application Data\SecuROM
2009-06-15 08:48 . 2009-06-15 08:48	108144	----a-w-	d:\windows\system32\CmdLineExt.dll
2009-06-15 08:36 . 2009-06-26 02:20	--------	d-----w-	d:\program files\Ubisoft
2009-06-14 22:29 . 2009-06-14 22:29	--------	d-----w-	d:\documents and settings\vincent\Application Data\Waves Preferences
2009-06-10 16:00 . 2009-06-23 16:45	--------	d-----w-	d:\windows\A3W_DATA
2009-06-10 15:56 . 1995-11-08 23:00	774960	----a-w-	d:\windows\system\IR41.DLL
2009-06-10 15:56 . 1995-10-19 23:00	151744	----a-w-	d:\windows\system\IR32.DLL
2009-06-10 15:56 . 1995-03-21 23:00	50096	----a-w-	d:\windows\system\IYVU9.DLL
2009-06-10 15:56 . 1994-09-01 23:00	65408	----a-w-	d:\windows\system\ICCVID.DRV
2009-06-10 15:56 . 1993-11-18 23:00	7168	----a-w-	d:\windows\system\DISPDIB.DLL
2009-06-10 15:56 . 1993-11-18 23:00	49616	----a-w-	d:\windows\system\MSACM.DLL
2009-06-10 15:56 . 1993-11-18 23:00	43520	----a-w-	d:\windows\system\MSVIDC.DRV
2009-06-10 15:56 . 1993-11-18 23:00	22816	----a-w-	d:\windows\system\MSACM.DRV
2009-06-10 15:56 . 1993-11-18 23:00	14208	----a-w-	d:\windows\system\CTL3D.DLL
2009-06-10 15:56 . 1993-11-18 23:00	12800	----a-w-	d:\windows\system\ACMCMPRS.DLL
2009-06-10 15:56 . 1993-11-18 23:00	11776	----a-w-	d:\windows\system\MSRLE.DRV
2009-06-10 15:55 . 1994-09-20 23:00	92208	----a-w-	d:\windows\system\WING.DLL
2009-06-10 15:55 . 1994-09-20 23:00	6736	----a-w-	d:\windows\system\WINGDIB.DRV
2009-06-10 15:55 . 1994-09-20 23:00	12800	----a-w-	d:\windows\system32\WING32.DLL
2009-06-10 15:55 . 1994-08-23 23:00	188960	----a-w-	d:\windows\system\WINGDE.DLL
2009-06-10 15:55 . 2009-06-23 16:53	--------	d-----w-	d:\program files\CIV2
2009-06-10 11:44 . 2009-06-10 11:44	--------	d-----w-	d:\documents and settings\vincent\Application Data\FabFilter
2009-06-10 11:10 . 2009-06-10 11:10	--------	d-----w-	d:\documents and settings\vincent\Application Data\One
2009-06-10 10:51 . 2009-06-10 10:51	--------	d-----w-	d:\program files\FabFilter
2009-06-10 02:38 . 2009-06-10 02:38	--------	d-----w-	d:\windows\Sun
2009-06-09 16:01 . 2009-06-09 16:01	410984	----a-w-	d:\windows\system32\deploytk.dll
2009-06-09 16:01 . 2009-06-09 16:01	--------	d-----w-	d:\program files\Java
2009-06-09 16:01 . 2009-06-09 16:01	152576	----a-w-	d:\documents and settings\vincent\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-09 13:33 . 2009-06-09 13:38	--------	d-----w-	d:\documents and settings\vincent\Application Data\Canon
2009-06-09 13:19 . 2008-04-13 22:15	15104	----a-w-	d:\windows\system32\drivers\usbscan.sys
2009-06-09 13:18 . 2002-03-06 19:25	323584	----a-w-	d:\windows\system32\N065UFW.dll
2009-06-09 13:18 . 2002-03-06 17:35	122880	----a-w-	d:\windows\system32\N065UUD.DLL
2009-06-09 13:18 . 2000-04-28 05:07	28718	----a-w-	d:\windows\system32\N065UCPL.DLL
2009-06-09 13:18 . 2000-01-06 19:05	318976	----a-w-	d:\windows\system32\UCS32P.DLL
2009-06-09 13:13 . 2009-06-09 13:13	--------	d-----w-	d:\documents and settings\vincent\Local Settings\Application Data\Help
2009-06-09 13:08 . 1998-01-23 11:20	305664	----a-w-	d:\windows\IsUn040c.exe
2009-06-09 13:08 . 2009-06-09 13:08	--------	d-----w-	d:\documents and settings\vincent\WINDOWS
2009-06-09 12:53 . 2009-06-09 13:21	--------	d-----w-	d:\program files\Canon
2009-06-09 12:52 . 2009-06-09 12:52	--------	d-----w-	d:\program files\canonscan
2009-06-07 11:28 . 2009-06-07 11:28	--------	d-----w-	d:\documents and settings\vincent\Application Data\Apple Computer
2009-06-04 18:17 . 2003-09-08 09:49	14604	----a-w-	d:\windows\system32\drivers\pfc.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-04 09:23 . 2009-07-04 09:23	--------	d-----w-	d:\program files\microsoft frontpage
2009-07-04 02:05 . 2009-06-03 14:08	1	----a-w-	d:\documents and settings\vincent\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-07-03 19:22 . 2009-05-28 23:35	--------	d-----w-	d:\documents and settings\vincent\Application Data\uTorrent
2009-07-03 10:28 . 2009-05-28 01:11	32	----a-w-	d:\windows\msocreg32.dat
2009-07-02 19:52 . 2009-05-30 02:00	--------	d-----w-	d:\documents and settings\vincent\Application Data\dvdcss
2009-06-30 17:04 . 2009-05-26 20:54	--------	d-----w-	d:\documents and settings\vincent\Application Data\GigaTribe
2009-06-29 15:11 . 2009-05-26 19:26	51400	----a-w-	d:\documents and settings\vincent\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 23:25 . 2009-05-26 17:12	--------	d--h--w-	d:\program files\InstallShield Installation Information
2009-06-21 23:07 . 2009-05-27 10:33	--------	d-----w-	d:\documents and settings\vincent\Application Data\Steinberg
2009-06-21 22:57 . 2009-05-27 10:20	--------	d-----w-	d:\program files\Syncrosoft
2009-06-14 22:28 . 2009-05-27 17:20	--------	d-----w-	d:\program files\Waves
2009-06-05 00:10 . 2009-06-01 17:47	--------	d-----w-	d:\documents and settings\vincent\Application Data\Digidesign
2009-06-04 18:42 . 2009-05-27 11:08	--------	d-----w-	d:\program files\Common Files\Adobe
2009-06-03 17:16 . 2009-05-29 15:50	--------	d-----w-	d:\program files\GForce
2009-06-03 17:01 . 2009-05-28 01:03	--------	d-----w-	d:\program files\Native Instruments
2009-06-03 17:00 . 2009-06-03 17:00	--------	d-----w-	d:\program files\Common Files\Native Instruments
2009-06-03 16:04 . 2009-05-28 01:10	--------	d-----w-	d:\program files\IK Multimedia
2009-06-03 14:08 . 2009-06-03 14:08	--------	d-----w-	d:\documents and settings\vincent\Application Data\OpenOffice.org
2009-06-03 13:53 . 2009-06-03 13:53	--------	d-----w-	d:\program files\OpenOffice.org 3
2009-06-02 07:01 . 2009-05-27 11:13	--------	d-----w-	d:\documents and settings\vincent\Application Data\Autodesk
2009-06-01 19:33 . 2009-06-01 19:33	--------	d-----w-	d:\documents and settings\vincent\Application Data\Trillium Lane
2009-06-01 17:38 . 2009-06-01 17:38	--------	d-----w-	d:\program files\Common Files\Voce Spin
2009-06-01 17:29 . 2009-06-01 17:29	--------	d-----w-	d:\program files\Common Files\Trillium Lane
2009-06-01 17:29 . 2009-05-29 16:52	--------	d-----w-	d:\program files\Digidesign
2009-06-01 17:17 . 2009-05-29 15:50	--------	d-----w-	d:\program files\Common Files\Digidesign
2009-06-01 17:06 . 2009-06-01 17:06	--------	d-----w-	d:\program files\InterLok
2009-06-01 16:31 . 2009-06-01 16:31	--------	d-----w-	d:\documents and settings\vincent\Application Data\PACE Anti-Piracy
2009-06-01 16:31 . 2009-06-01 16:31	--------	d-----w-	d:\documents and settings\All Users\Application Data\PACE Anti-Piracy
2009-06-01 16:31 . 2009-06-01 16:31	--------	d-----w-	d:\program files\Common Files\PACE Anti-Piracy
2009-06-01 16:17 . 2009-06-01 16:16	--------	d-----w-	d:\program files\QuickTime
2009-06-01 16:16 . 2009-06-01 16:16	--------	d-----w-	d:\documents and settings\All Users\Application Data\Apple Computer
2009-06-01 16:16 . 2009-06-01 16:16	--------	d-----w-	d:\program files\Apple Software Update
2009-06-01 16:16 . 2009-06-01 16:16	--------	d-----w-	d:\documents and settings\All Users\Application Data\Apple
2009-05-31 04:07 . 2009-05-31 04:05	--------	d-----w-	d:\program files\FLAC
2009-05-31 04:00 . 2009-05-30 01:13	--------	d-----w-	d:\documents and settings\vincent\Application Data\COWON
2009-05-29 16:52 . 2009-05-29 16:51	--------	d-----w-	d:\program files\Arturia
2009-05-28 23:35 . 2009-05-28 23:35	--------	d-----w-	d:\program files\uTorrent
2009-05-28 19:44 . 2009-05-28 19:26	--------	d-----w-	d:\program files\Audio Ease
2009-05-28 19:37 . 2009-05-28 19:26	--------	d-----w-	d:\documents and settings\All Users\Application Data\Audio Ease
2009-05-28 19:37 . 2009-05-28 19:26	--------	d-----w-	d:\documents and settings\vincent\Application Data\Audio Ease
2009-05-28 01:00 . 2009-05-28 01:00	--------	d-----w-	d:\program files\AAS
2009-05-28 01:00 . 2009-05-28 01:00	--------	d-----w-	d:\documents and settings\vincent\Application Data\Applied Acoustics Systems
2009-05-27 17:21 . 2009-05-27 17:21	--------	d-----w-	d:\documents and settings\vincent\Application Data\Waves Audio
2009-05-27 13:06 . 2009-05-27 13:06	--------	d-----w-	d:\documents and settings\All Users\Application Data\FLEXnet
2009-05-27 13:02 . 2009-05-27 13:02	--------	d-----w-	d:\program files\Bonjour
2009-05-27 12:57 . 2009-05-27 12:57	--------	d-----w-	d:\program files\Common Files\Macrovision Shared
2009-05-27 11:15 . 2009-05-27 11:13	--------	d-----w-	d:\documents and settings\All Users\Application Data\Autodesk
2009-05-27 11:14 . 2009-05-27 11:12	--------	d-----w-	d:\program files\Common Files\Autodesk Shared
2009-05-27 11:14 . 2009-05-27 11:13	--------	d-----w-	d:\program files\AutoCAD 2008
2009-05-27 11:12 . 2009-05-26 17:12	--------	d-----w-	d:\program files\Common Files\InstallShield
2009-05-27 11:12 . 2009-05-27 11:12	--------	d-----w-	d:\program files\Autodesk
2009-05-27 10:56 . 2009-05-27 10:21	--------	d-----w-	d:\program files\Steinberg
2009-05-27 10:47 . 2009-05-27 10:47	--------	d-----w-	d:\program files\G-Sonique
2009-05-27 10:45 . 2009-05-27 10:44	--------	d-----w-	d:\program files\PSPaudioware
2009-05-27 10:40 . 2009-05-27 10:40	--------	d-----w-	d:\program files\Flux
2009-05-27 10:21 . 2009-05-27 10:21	--------	d-----w-	d:\program files\Pinnacle
2009-05-27 10:20 . 2009-05-27 10:20	--------	d-----w-	d:\documents and settings\All Users\Application Data\Pinnacle
2009-05-27 10:19 . 2009-05-27 10:19	--------	d-----w-	d:\documents and settings\vincent\Application Data\vlc
2009-05-27 10:17 . 2009-05-27 10:17	--------	d-----w-	d:\program files\VideoLAN
2009-05-27 00:13 . 2009-05-27 00:13	--------	d-----w-	d:\program files\IZArc
2009-05-26 23:02 . 2009-05-26 16:53	86327	----a-w-	d:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-26 20:54 . 2009-05-26 20:54	--------	d-----w-	d:\program files\GigaTribe
2009-05-26 20:22 . 2009-05-26 20:22	--------	d-----w-	d:\program files\Alcohol Soft
2009-05-26 20:16 . 2009-05-26 20:16	721904	----a-w-	d:\windows\system32\drivers\sptd.sys
2009-05-26 19:45 . 2009-05-26 19:45	--------	d-----w-	d:\program files\CCleaner
2009-05-26 19:36 . 2009-05-26 19:34	--------	d-----w-	d:\program files\M-Audio
2009-05-26 19:36 . 2009-05-26 19:36	--------	d-----w-	d:\documents and settings\vincent\Application Data\InstallShield
2009-05-26 19:32 . 2009-05-26 16:53	--------	d-----w-	d:\program files\Windows Media Connect 2
2009-05-26 19:26 . 2009-05-26 19:26	--------	d-----w-	d:\documents and settings\vincent\Application Data\ATI
2009-05-26 18:52 . 2009-05-26 18:52	--------	d-----w-	d:\program files\AVG
2009-05-26 18:50 . 2009-05-26 18:50	12328	----a-w-	d:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-26 18:50 . 2009-05-26 18:50	--------	d-----w-	d:\documents and settings\All Users\Application Data\ATI
2009-05-26 18:50 . 2009-05-26 18:50	--------	d-----w-	d:\documents and settings\Administrator\Application Data\ATI
2009-05-26 18:39 . 2009-05-26 17:11	--------	d-----w-	d:\program files\ATI
2009-05-26 17:14 . 2009-05-26 17:14	0	----a-w-	d:\windows\ativpsrm.bin
2009-05-26 17:13 . 2009-05-26 17:12	--------	d-----w-	d:\program files\ATI Technologies
2009-05-26 17:11 . 2009-05-26 17:11	--------	d-----w-	d:\program files\Neuf
2009-05-26 17:00 . 2009-05-26 17:00	0	----a-w-	d:\windows
sreg.dat
2009-05-26 16:51 . 2009-05-26 16:51	21640	----a-w-	d:\windows\system32\emptyregdb.dat
2009-05-26 16:50 . 2009-05-26 16:50	--------	d-----w-	d:\program files\Microsoft Silverlight
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"AlcoholAutomount"="d:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2009-04-24 203416]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="d:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"M-Audio Taskbar Icon"="d:\windows\System32\M-AudioTaskBarIcon.exe" [2008-05-15 356864]
"H2O"="d:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 385024]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"DigidesignMMERefresh"="d:\program files\Digidesign\Drivers\MMERefresh.exe" [2007-10-30 77824]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-06-09 148888]
"AVG8_TRAY"="d:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-04 1948440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" - d:\windows\system32\advpack.dll [2009-02-13 124928]

d:\documents and settings\vincent\Start Menu\Programs\Startup\
GigaTribe.lnk - d:\program files\GigaTribe\gigatribe.exe [2009-5-26 1071616]
OpenOffice.org 3.1.lnk - d:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]
2009-07-04 04:20	11952	----a-w-	d:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"="0x00000000"
"AntiVirusDisableNotify"="0x00000000"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"%windir%\system32\sessmgr.exe"=
"d:\Program Files\GigaTribe\gigatribe.exe"=
"d:\Program Files\Mozilla Firefox\firefox.exe"=
"d:\Program Files\Bonjour\mDNSResponder.exe"=
"d:\Program Files\uTorrent\uTorrent.exe"=

R0 amdide1;amdide1;d:\windows\system32\drivers\amdide1.sys [13/02/2009 08:40 9096]
R0 DigiFilter;DigiFilter;d:\windows\system32\drivers\DigiFilt.sys [01/06/2009 19:19 16384]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;d:\windows\system32\drivers\avgldx86.sys [04/07/2009 06:20 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;d:\windows\system32\drivers\avgtdix.sys [04/07/2009 06:20 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;d:\progra~1\AVG\AVG8\avgemc.exe [04/07/2009 06:20 907032]
R2 avg8wd;AVG Free8 WatchDog;d:\progra~1\AVG\AVG8\avgwdsvc.exe [04/07/2009 06:20 298776]
R3 CLEDX;Team H2O CLEDX service;d:\windows\system32\drivers\cledx.sys [27/05/2009 12:27 33792]
R3 MAUSBFTP;Service for M-Audio Fast Track Pro (WDM);d:\windows\system32\drivers\mausb.sys [26/05/2009 21:37 143624]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{B74E1FFB-7290-4B2B-BA3C-AD30ED7CD617} - (no file)
BHO-{f7cf2a2a-72d1-4580-8598-6e658b7a4b3f} - (no file)
SharedTaskScheduler-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)


.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - d:\documents and settings\vincent\Application Data\Mozilla\Firefox\Profiles\gus0zs0b.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: d:\program files\AVG\AVG8\Firefox\components\avgssff.dll

---- PARAMETRES FIREFOX ----
d:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
d:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
d:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
d:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
d:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
d:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
d:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
d:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-04 11:23
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(872)
d:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2164)
d:\windows\system32\msi.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\ati2evxx.exe
d:\windows\system32\ati2evxx.exe
d:\program files\Bonjour\mDNSResponder.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
d:\program files\AVG\AVG8\avgrsx.exe
d:\progra~1\AVG\AVG8\avgnsx.exe
d:\program files\AVG\AVG8\avgcsrvx.exe
d:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
d:\program files\OpenOffice.org 3\program\soffice.exe
d:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
d:\program files\OpenOffice.org 3\program\soffice.bin
d:\windows\system32	askmgr.exe
.
**************************************************************************
.
Heure de fin: 2009-07-04 11:26 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-07-04 09:26

Avant-CF: 204 193 730 560 bytes free
Après-CF: 204 132 184 064 bytes free

293

vinzentz · Answer

Rapport SmithFraudFix n°2:

SmitFraudFix v2.423

Scan done at 11:02:33,89, 04/07/2009
Run from D:\Documents and Settings\vincent\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="d:\windows\system32\dukovolo.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="d:\windows\system32\dukovolo.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 	localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

D:\autorun.inf Deleted
D:\WINDOWS\system32\msxml71.dll Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C5A9B668-94D8-441A-9018-F3E59061EECF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C5A9B668-94D8-441A-9018-F3E59061EECF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C5A9B668-94D8-441A-9018-F3E59061EECF}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK.2



»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
 
Registry Cleaning done. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"="STS"

[HKEY_CLASSES_ROOT\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="d:\windows\system32\dukovolo.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InProcServer32]
@="d:\windows\system32\dukovolo.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End

vinzentz · Answer

Rapport HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:41:45, on 04/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20978)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Digidesign\Drivers\MMERefresh.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
D:\WINDOWS\system32\svchost.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgnsx.exe
D:\Program Files\AVG\AVG8\avgcsrvx.exe
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
D:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\OpenOffice.org 3\program\soffice.exe
D:\Program Files\OpenOffice.org 3\program\soffice.bin
D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B74E1FFB-7290-4B2B-BA3C-AD30ED7CD617} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {f7cf2a2a-72d1-4580-8598-6e658b7a4b3f} - (no file)
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] D:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [H2O] D:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DigidesignMMERefresh] D:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKUS\S-1-5-21-1801674531-1229272821-2146553785-500\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: GigaTribe.lnk = D:\Program Files\GigaTribe\gigatribe.exe
O4 - Startup: OpenOffice.org 3.1.lnk = D:\Program Files\OpenOffice.org 3\program\quickstart.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O13 - Gopher Prefix: 
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - D:\WINDOWS\SYSTEM32\avgrsstx.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - D:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - D:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - D:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

eZula · Answer

poursuis avec le scan nod32

vinzentz · Answer

J'ai scanné avec nod32, je n'ai pas trouvé le rapport txt, mais il dit: "no threat found"

eZula · Answer

Affiche les fichiers cachés et système, et dis moi si tu vois ce fichier d:\windows\system32\dukovolo.dll

vinzentz · Answer

Non, je ne le vois pas.

eZula · Answer

Et où en sont tes problèmes ?

vinzentz · Answer

Tout a l'air rentré dans l'ordre sauf que le PC est "un peu" lent pour le démarrage des applications. Peut être que ça ira mieux quand j'aurai enlevé les programme de détection? ..... 
Merci beaucoup en tout cas!

eZula · Answer

* Pour terminer, utilise ToolsCleaner! (de A.Rothstein et Dj Quiou) http://pc-system.fr/ pour nettoyer les utilitaires téléchargés,
* Désactive la restauration système, redémarre l'ordinateur, puis réactive-la, en procédant comme indiqué ici  http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924

* Installe IE8

* Lance le nettoyage avec CCleaner régulièrement

* Visite régulièrement le site http://www.update.microsoft.com/windowsupdate/v6/default.aspx afin d'avoir un système toujours actualisé.
* Utilise hebdomadairement ce petit programme http://alt-shift-return.org/Info/Update_Checker.html pour effectuer tes mises à jour logicielles.
* N'installe jamais un programme sans avoir entièrement lu et compris les termes de son contrat d'utilisation, ou sans être définitivement certain qu'il n'installe pas discrètement un logiciel publicitaire (renseigne-toi sur Google ou sur les forums)

* A ce moment là, tu pourras marquer ton sujet "résolu" si tu estimes que c'est le cas 

* Note importante : il est fortement conseillé d'utiliser un compte limité pour une utilisation classique d'un ordinateur afin de minimiser très siginificativement les risques d'infection.
Mode d'emploi : https://www.microsoft.com/de-ch

à+

Trojan indélogeable: PSWOnlineGaming,

14 réponses

Votre réponse

Discussions similaires

Newsletters