Detection Trojan TR/Crypt.XPACK.Gen et plus - Page 4

Mon 08/10/2009 ---- 16:19:15.12

----------------------------------
§§§§§§ [Mindjet] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete

********************
[Registre]
********************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\MindManager 7\\"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\"="1"

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="mindjet"

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604]
"000"="mindjet"

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe"="PrnInstaller"

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe"="Uninstaller"

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet]

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager]

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7]

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps]

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Collections]

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Collections\My Projects]

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Folders]

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver]
"JobsPath"="C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\pdfSaver\\Jobs"

*******************
[Fichier]
*******************

*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté

Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

▶ Double clic sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:reg

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\MindManager 7\\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\"=-

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"=""

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604]
"000"=""

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe"=-

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe"=-

[-HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet]

[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver]
"JobsPath"=""

:commands
[emptytemp]
[start explorer]
[reboot]


▶ Clique sur RunFix pour lancer la suppression.

▶ Poste le rapport.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
Process firefox.exe killed successfully!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\\Program Files\\Mindjet\\MindManager 7\\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\\Program Files\\Mindjet\\ not found.
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603\\"000"|"" /E!
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604\\"000"|"" /E!
Registry value HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe not found.
Registry value HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe not found.
Registry key HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\ deleted successfully.
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver\\"JobsPath"|"" /E!
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Administrator.NC-M2105
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 3232284 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: EndUser
->Temp folder emptied: 59324739 bytes
->Temporary Internet Files folder emptied: 9231648 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 60856226 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 482153 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2142714 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 49152 bytes
RecycleBin emptied: 1144168 bytes

Total Files Cleaned = 130.21 mb

OTL by OldTimer - Version 3.0.10.5 log created on 08102009_183109

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

ok bien

mets Malwarebytes à jour et fais un scan complet

Bonjour gen-hackman,

Vundo (ou le noms que vous voulez) n est pas mort!!! Les alertes d'Avira on recomence'! Et depuis la derniere operation mon pc est devenu super lent, ca prend une heure pour faire ce qui lui prend normalment 1 minutes!! Si bien que j ai renonce' a l'utiliser pour le moment, enfin, j suis qd meme entrain de faire le scan avec Malwarebite, j'en suis a la 30eme minute et la fenetre du programme est tjrs pas apparue encore.... J'ai peur pour mon pc...

hello essaie de le passerr en rapide alors déjà

7hrs de scan! Bon j vais essayer d etre plus rapide maintenant l'ordi va mieux...

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2626
Windows 5.1.2600 Service Pack 2

8/15/2009 9:34:50 PM
mbam-log-2009-08-15 (21-34-38).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 142856
Temps écoulé: 7 hour(s), 16 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

télécharge ceci , fais un scan avec en desactivant le guard d'antivir et ton parefeu (si présent)

et poste le contenu du rapport qui va s'ouvrir à la fin

http://sd-1.archive-host.com/membres/up/829108531491024/Listem.exe

Voici :

List'em by g3n-h@ckm@n 1.0.2.0

update on 16.08.2009 ::::: 16.00

Microsoft Windows XP [Version 5.1.2600]

Sun 08/16/2009 18:20:53.28

Infections possibles :
=================

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

¤¤¤¤¤¤¤¤¤¤ Windows\Prefetch :

C:\WINDOWS\Prefetch\ALG.EXE-0F138680.pf
C:\WINDOWS\Prefetch\APPLEMOBILEDEVICEHELPER.EXE-2864A39D.pf
C:\WINDOWS\Prefetch\ASPNET_REGIIS.EXE-009D6E80.pf
C:\WINDOWS\Prefetch\AVCENTER.EXE-1A970FA0.pf
C:\WINDOWS\Prefetch\AVWSC.EXE-0283F9DD.pf
C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf
C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf
C:\WINDOWS\Prefetch\DISTNOTED.EXE-036B52B9.pf
C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf
C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf
C:\WINDOWS\Prefetch\GUARDGUI.EXE-00ECD849.pf
C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf
C:\WINDOWS\Prefetch\HOTFIXINSTALLER.EXE-065AB2A1.pf
C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf
C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf
C:\WINDOWS\Prefetch\ITUNES.EXE-1A268432.pf
C:\WINDOWS\Prefetch\JQSNOTIFY.EXE-24AE4A36.pf
C:\WINDOWS\Prefetch\Layout.ini
C:\WINDOWS\Prefetch\LISTEM.EXE-2C0EFD91.pf
C:\WINDOWS\Prefetch\LODCTR.EXE-1009C3B4.pf
C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf
C:\WINDOWS\Prefetch\MBAM.EXE-0BEE0439.pf
C:\WINDOWS\Prefetch\MODE.COM-31685BAE.pf
C:\WINDOWS\Prefetch\MOFCOMP.EXE-01718E95.pf
C:\WINDOWS\Prefetch\MSCORSVW.EXE-1BF30400.pf
C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
C:\WINDOWS\Prefetch\MSNMSGR.EXE-030AB647.pf
C:\WINDOWS\Prefetch\NDP35SP1-KB963707-X86.EXE-0A1DC737.pf
C:\WINDOWS\Prefetch\NGEN.EXE-38021CCC.pf
C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf
C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
C:\WINDOWS\Prefetch\REG.EXE-0D2A95F7.pf
C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf
C:\WINDOWS\Prefetch\REGSVCS.EXE-11A17120.pf
C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf
C:\WINDOWS\Prefetch\REGTLIBV12.EXE-0E2FA54B.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf
C:\WINDOWS\Prefetch\SKYPE.EXE-30AE1A60.pf
C:\WINDOWS\Prefetch\SKYPEPM.EXE-2BC7DD5C.pf
C:\WINDOWS\Prefetch\SNDVOL32.EXE-383480B7.pf
C:\WINDOWS\Prefetch\SPUPDSVC.EXE-21B36524.pf
C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-04FFAD65.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-32ED1DE4.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-37F3C0F9.pf
C:\WINDOWS\Prefetch\WLCOMM.EXE-04AE9009.pf
C:\WINDOWS\Prefetch\WMIADAP.EXE-2DF425B2.pf
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf
C:\WINDOWS\Prefetch\WSCNTFY.EXE-1B24F5EB.pf
C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf

--------EOF------------

▶ Double clic sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous Customs Scans/Fixes :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:files
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

:commands
[emptytemp]
[reboot]


▶ Clique sur RunFix pour lancer la suppression.

▶ Poste le rapport.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== FILES ==========
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Administrator.NC-M2105
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: EndUser
->Temp folder emptied: 3006757 bytes
->Temporary Internet Files folder emptied: 40184740 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 42522446 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 16395915 bytes
RecycleBin emptied: 6649 bytes

Total Files Cleaned = 97.48 mb

OTL by OldTimer - Version 3.0.10.5 log created on 08162009_184322

Files\Folders moved on Reboot...
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot...

c'est marrant tu es dans le meme cas que moi^^

essaie de les virer à la main

ah bon? C tres rassurant lol. Je vire C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
et C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.

ca marche pas...

salut DLLD

combofix supprime ces deux fichiers qrm.dat

ensuite :

post 56 :

Supprime ces deux fichiers manuellement , puis :

▶ Télécharge Dr Web CureIt sur ton Bureau :

▶ redemarre en mode sans échec