Un spyware me rend fou et bloque mon pc - Page 2

et sdfix

desole

[b]SDFix: Version 1.240 [/b]
Run by Admin on 20/07/2009 at 19:51

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

No Trojan Files Found

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-20 20:14:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:66,d4,1a,bb,67,5e,3a,28,cd,17,94,51,8c,1a,60,95,b5,05,d8,47,e5,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:66,d4,1a,bb,67,5e,3a,28,cd,17,94,51,8c,1a,60,95,b5,05,d8,47,e5,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Disabled:eMule"
"C:\\Program Files\\Black Isle\\Icewind Dale\\IDMain.exe"="C:\\Program Files\\Black Isle\\Icewind Dale\\IDMain.exe:*:Disabled:Icewind Dale"
"C:\\Documents and Settings\\Admin\\Mes documents\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Admin\\Mes documents\\LimeWire\\LimeWire.exe:*:Disabled:LimeWire"
"C:\\WINDOWS\\system32\\mqsvc.exe"="C:\\WINDOWS\\system32\\mqsvc.exe:*:Disabled:Message Queuing"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Disabled:Microsoft DirectPlay Helper"
"C:\\Program Files\\Morpheus\\Morpheus.exe"="C:\\Program Files\\Morpheus\\Morpheus.exe:*:Disabled:Morpheus"
"C:\\Documents and Settings\\Admin\\Bureau\\Second Life 1-18-2-0 Setup.exe"="C:\\Documents and Settings\\Admin\\Bureau\\Second Life 1-18-2-0 Setup.exe:*:Disabled:Second Life 1-18-2-0 Setup.exe"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"="C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"="C:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\mqsvc.exe"="C:\\WINDOWS\\system32\\mqsvc.exe:*:Enabled:Message Queuing"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"="C:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 7 Jul 2008 2,156,368 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Mon 30 Jul 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 14 Mar 2005 299,008 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe"
Mon 25 Apr 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll"
Fri 5 Oct 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26af86f6ad0e8bce8602fa2f7f40dc60\BIT3E.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\28a907440e5ea2fca0c1590527cad528\BIT30.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\299d8333b0b5f75c41264b2d951282b6\BIT33.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3122aad9cdf04a0b04178159cb27b809\BIT37.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5c60d643ef361a79420736911635d9e1\BIT38.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\737a354f6deb276722e82e7e1bb13a74\BIT31.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\800e225ef14ffcb7ee95ba8e4215a02c\BIT3A.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8555785d6d7391a10fedf8aee75facbe\BIT3D.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\970b25bd9abe5b9eafbdc8cb8fbcc203\BIT34.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b3db340ba82b0524bdd39d62ec542f47\BIT3B.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c527566621ad682d4f92b9ccc134df41\BIT2A.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d89c5894d473de63eac0dab287488942\BIT36.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\dde27dd63b3a3adfae1dd87da72f2143\BIT27.tmp"
Mon 20 Jul 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ed00b6dff65a76bca397d5eac9c44a2e\BIT3C.tmp"
Thu 20 Dec 2007 4,386,816 A.SH. --- "C:\Documents and Settings\Mes Documents\Mes images\foto\poster\SIV8.tmp"
Fri 8 May 2009 4,710,400 A.SH. --- "C:\Documents and Settings\Mes Documents\Mes images\foto\phototrip\trip\SIV2F.tmp"

[b]Finished![/b]

alors? ké passa?

je viens de netooyer quelques fichiers infectés mais bon....

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1134
Windows 5.1.2600 Service Pack 2

20/07/2009 22:14:05
mbam-log-2009-07-20 (22-14-05).txt

Type de recherche: Examen complet (C:\|J:\|K:\|Z:\|)
Eléments examinés: 144598
Temps écoulé: 35 minute(s), 22 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\14087034 (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\amoumain (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\14087034\14087034.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\amoumain.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

relance genproc, poste et suit ces manips

bé jveux bien mais sa fait deja deux fois que je fais toutes les manip... Alors une troisieme fois ça va changer quoi? sa va etre pareil non??

poste le rapport

Bon,
pour l'instant ça marche, même quand je redémarre le pc!
Si sa recommence, je recommencerai ta manip
Merci pour tes tuyaux!
psico