infection Cid +antivir impossible Maj

Question

Bonjour,
Je vien d'installer antivir mais impossible de faire une maj +j'ai une pub cid qui s'affiche
Merci de votre aide

eZula · Answer

Bonjour,

télécharge GenProc http://www.genproc.com/GenProc.exe

double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre

Raf · Answer

merci 
voila le rapport:
Rapport GenProc 2.650 [1] - 21/11/2009 à 10:27:04
@ Windows VISTA Service Pack 2 - Compaq-Presario - Mode normal
@ Mozilla Firefox 3.5.5 (fr) [Navigateur par défaut]

~~ CM DISK ERROR ~~

Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures" ; par la suite, laisse-le avec ses réglages par défaut. C'est tout. 

# Etape 1/ Télécharge :

- Lop S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 (Eric 71 & Angeldark) sur ton Bureau.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/  ; Choisis ta session courante *** Lauriane *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).


# Etape 2/ 

 Double-clique sur Lop S&D pour lancer l'installation, séléctionne la langue souhaitée, puis choisis l'Option 2 - Suppression - et patiente jusqu'à ce qu'il ait terminé.

# Etape 3/ 

 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/ 

 Redémarre normalement et poste, dans la même réponse : 

- Le contenu du rapport lopR.txt situé dans C:\ ;
- Un nouveau rapport HijackThis https://forums.cnetfrance.fr/tutoriels-securite-informatique/1549-hijackthis-comment-l-utiliser ;
- Un nouveau rapport GenProc ;

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~

 
# Détections [1] GenProc 2.650 21/11/2009 à 10:27:15 
Lop:le 21/11/2009 à 10:27:53 "C:\ProgramData\Settings axis axis.937pp"

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 10:28:14 ~~

eZula · Answer

suis la procédure ci-dessus, elle devrait résoudre le problème "CID" (qui à priori n'est pas le seul)

Raf · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:16, on 21/11/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\vVX3000.exe
C:\Windows\System32undll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Winsudate\gibusr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Lauriane\AppData\Local\Temp\Rar$EX00.168\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Lauriane\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [DPService] "C:\Program Files\HP\DVDPlay\DPService.exe"
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /F "C:\Windows\TEMP\E_SC84D.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKCU\..\Run: [Store file readme bash] "C:\ProgramData\Eq Dvd Mp3.om4rusz"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: Gestionnaire de mise à jour Winsudate (WinSvc) - Winsudate - C:\Program Files\Winsudate\gibsvc.exe

Raf · Answer

Rapport GenProc 2.650 [2] - 21/11/2009 à 11:02:23
@ Windows VISTA Service Pack 2 - Compaq-Presario - Mode normal
@ Mozilla Firefox 3.5.5 (fr) [Navigateur par défaut]

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante : 


Fais scanner le(s) fichier(s) suivant(s) sur ce site https://www.virustotal.com/gui/ :


C:\ProgramData\Eq Dvd Mp3.om4rusz"

"
et poste le(s) rapport(s) obtenu(s) dans ta prochaine réponse.




~~~~ INFORMATION COMPLEMENTAIRE ~~~~

 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:03:10, on 21/11/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\vVX3000.exe
C:\Windows\System32undll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Winsudate\gibusr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Lauriane\AppData\Local\Temp\Rar$EX00.168\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\GenProc\Outil\Lauriane_GenProc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [DPService] "C:\Program Files\HP\DVDPlay\DPService.exe"
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /F "C:\Windows\TEMP\E_SC84D.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKCU\..\Run: [Store file readme bash] "C:\ProgramData\Eq Dvd Mp3.om4rusz"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: Gestionnaire de mise à jour Winsudate (WinSvc) - Winsudate - C:\Program Files\Winsudate\gibsvc.exe

Raf · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Basique  ( v6.0.6002 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Phenom(tm) 8600 Triple-Core Processor )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : Lauriane ( Administrator )
   BOOT : Fail-safe boot
   C:\ (Local Disk) - NTFS - Total:453 Go (Free:332 Go)
   D:\ (Local Disk) - NTFS - Total:11 Go (Free:1 Go)
   E:\ (CD or DVD) - UDF - Total:5 Go (Free:0 Go)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 21/11/2009|10:54 )

   [ UAC => 1 ]


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\ProgramData\city about store file\About one.dat
   Supprime! - C:\ProgramData\city about store file\About one.exe
   Supprime! - C:\Users\Lauriane\AppData\Roaming\MICROS~1\Windows\Cookies\lauriane@www.adserver5[1].txt
   Supprime! - C:\ProgramData\Settings axis axis.937pp
   Supprime! - C:\ProgramData\Settings axis axis.l5odr5
   Supprime! - C:\ProgramData\city about store file
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans Local

   [20/11/2009|17:25] C:\Users\Lauriane\AppData\Local\Adobe
   [13/02/2009|15:52] C:\Users\Lauriane\AppData\Local\Apple
   [23/09/2009|15:33] C:\Users\Lauriane\AppData\Local\Apple Computer
   [13/02/2009|13:41] C:\Users\Lauriane\AppData\Local\Application Data 
   [23/05/2009|14:18] C:\Users\Lauriane\AppData\Local\d3d9caps.dat
   [04/11/2009|14:10] C:\Users\Lauriane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [05/10/2009|07:26] C:\Users\Lauriane\AppData\Local\DVDPlay
   [20/11/2009|18:16] C:\Users\Lauriane\AppData\Local\GDIPFONTCACHEV1.DAT
   [13/02/2009|16:43] C:\Users\Lauriane\AppData\Local\Hewlett-Packard
   [13/02/2009|13:41] C:\Users\Lauriane\AppData\Local\Historique 
   [21/11/2009|10:41] C:\Users\Lauriane\AppData\Local\IconCache.db
   [05/09/2009|15:47] C:\Users\Lauriane\AppData\Local\Microsoft
   [20/04/2009|14:37] C:\Users\Lauriane\AppData\Local\Microsoft Games
   [13/02/2009|17:03] C:\Users\Lauriane\AppData\Local\Microsoft Help
   [13/02/2009|14:36] C:\Users\Lauriane\AppData\Local\Mozilla
   [21/11/2009|10:54] C:\Users\Lauriane\AppData\Local\Temp
   [13/02/2009|13:41] C:\Users\Lauriane\AppData\Local\Temporary Internet Files 
   [16/04/2009|20:43] C:\Users\Lauriane\AppData\Local\VirtualStore
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [21/11/2009 09:45][--ah-----] C:\Windows	asks\User_Feed_Synchronization-{0094F739-E0A3-437E-9DCE-DDDB0951C663}.job
   [21/11/2009 10:50][--ah-----] C:\Windows	asks\SA.DAT
   [21/11/2009 10:50][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [15/03/2009|10:54] C:\ProgramData\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
   [12/05/2009|10:29] C:\ProgramData\{55A29068-F2CE-456C-9148-C869879E2357}
   [12/09/2009|09:54] C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
   [06/04/2009|21:00] C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
   [18/11/2009|17:58] C:\ProgramData\aboutthunkcity
   [20/11/2009|17:25] C:\ProgramData\Adobe
   [13/02/2009|15:51] C:\ProgramData\Apple
   [13/02/2009|15:53] C:\ProgramData\Apple Computer
   [02/11/2006|13:59] C:\ProgramData\Application Data 
   [20/11/2009|18:20] C:\ProgramData\Avira
   [13/02/2009|15:48] C:\ProgramData\Azureus
   [13/02/2009|13:41] C:\ProgramData\Bureau 
   [13/02/2009|16:52] C:\ProgramData\CyberLink
   [02/11/2006|13:59] C:\ProgramData\Desktop 
   [02/11/2006|13:59] C:\ProgramData\Documents 
   [06/11/2009|08:09] C:\ProgramData\Electronic Arts
   [06/11/2009|21:24] C:\ProgramData\Eq Dvd Mp3.om4rusz
   [13/02/2009|13:41] C:\ProgramData\Favoris 
   [02/11/2006|13:59] C:\ProgramData\Favorites 
   [08/07/2009|08:19] C:\ProgramData\Hewlett-Packard
   [03/11/2008|16:54] C:\ProgramData\HP
   [03/11/2008|16:54] C:\ProgramData\hpzinstall.log
   [24/02/2009|14:19] C:\ProgramData\InterAction studios
   [20/11/2009|18:11] C:\ProgramData\Malwarebytes
   [13/02/2009|13:41] C:\ProgramData\Menu D‚marrer 
   [20/11/2009|18:51] C:\ProgramData\Messenger Plus!
   [28/03/2009|12:56] C:\ProgramData\Microsoft
   [12/11/2009|19:37] C:\ProgramData\Microsoft Help
   [13/02/2009|13:41] C:\ProgramData\ModŠles 
   [03/11/2008|16:52] C:\ProgramData\muvee Technologies
   [06/09/2009|08:28] C:\ProgramData
tuser.pol
   [18/09/2009|08:52] C:\ProgramData\NVIDIA
   [03/11/2008|16:59] C:\ProgramData\PC-Doctor
   [03/11/2008|16:59] C:\ProgramData\PC-Doctor for Windows
   [20/11/2009|17:34] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|13:59] C:\ProgramData\Start Menu 
   [13/02/2009|14:01] C:\ProgramData\Symantec
   [25/02/2009|17:08] C:\ProgramData\TEMP
   [02/11/2006|13:59] C:\ProgramData\Templates 
   [13/02/2009|16:18] C:\ProgramData\TuneUp Software
   [21/02/2009|16:29] C:\ProgramData\WildTangent
   [13/02/2009|15:59] C:\ProgramData\WLInstaller

   --------------------\  Listing des dossiers dans C:\Program Files

   [20/11/2009|17:24] C:\Program Files\Adobe
   [28/04/2009|13:02] C:\Program Files\AGEIA Technologies
   [13/02/2009|14:39] C:\Program Files\Alwil Software
   [13/02/2009|15:52] C:\Program Files\Apple Software Update
   [20/11/2009|18:20] C:\Program Files\Avira
   [24/02/2009|16:22] C:\Program Files\bfgclient
   [16/02/2009|20:54] C:\Program Files\Bonjour
   [20/11/2009|17:13] C:\Program Files\CCleaner
   [25/02/2009|17:18] C:\Program Files\Chicken Invaders
   [20/11/2009|19:12] C:\Program Files\Chicken Invaders 2
   [22/02/2009|14:48] C:\Program Files\Chicken Invaders 3
   [24/02/2009|16:18] C:\Program Files\Chicken Invaders 3 Christmas Edition
   [04/03/2009|10:53] C:\Program Files\ChickenInvaders2_at
   [20/02/2009|20:41] C:\Program Files\ChickenInvadersROTYdemo
   [03/03/2009|16:00] C:\Program Files\ChickenInvadersTNWdemo
   [03/03/2009|16:12] C:\Program Files\ChickenInvadersTNWXmasdemo
   [20/11/2009|17:24] C:\Program Files\Common Files
   [03/11/2008|16:52] C:\Program Files\CyberLink
   [13/02/2009|14:25] C:\Program Files\DIFX
   [28/04/2009|12:43] C:\Program Files\DivX
   [27/02/2009|20:08] C:\Program Files\EA GAMES
   [03/11/2008|17:06] C:\Program Files\EasyBits For Kids
   [05/11/2009|19:34] C:\Program Files\Electronic Arts
   [20/05/2009|09:52] C:\Program Files\EPSON
   [13/02/2009|13:41] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [20/11/2009|17:15] C:\Program Files\FileHippo.com
   [19/10/2009|18:44] C:\Program Files\Hewlett-Packard
   [03/11/2008|16:55] C:\Program Files\HP
   [03/11/2008|17:05] C:\Program Files\HP Games
   [20/11/2009|18:13] C:\Program Files\InstallShield Installation Information
   [16/10/2009|07:05] C:\Program Files\Internet Explorer
   [01/11/2009|18:09] C:\Program Files\iPod
   [12/09/2009|09:53] C:\Program Files\iPod(78)
   [01/11/2009|18:10] C:\Program Files\iTunes
   [12/09/2009|09:54] C:\Program Files\iTunes(79)
   [13/02/2009|16:12] C:\Program Files\Java
   [28/04/2009|12:46] C:\Program Files\K-Lite Codec Pack
   [07/07/2009|14:53] C:\Program Files\LETMIN
   [06/07/2009|12:32] C:\Program Files\LG Electronics
   [06/07/2009|12:59] C:\Program Files\LG PC Suite II
   [11/06/2009|17:38] C:\Program Files\LGInternetKit
   [12/08/2009|10:35] C:\Program Files\LimeWire
   [20/11/2009|18:11] C:\Program Files\Malwarebytes' Anti-Malware
   [20/11/2009|17:17] C:\Program Files\Messenger Plus! Live
   [28/03/2009|12:57] C:\Program Files\Microsoft
   [02/11/2006|13:35] C:\Program Files\Microsoft Games
   [05/05/2009|12:57] C:\Program Files\Microsoft LifeCam
   [13/02/2009|17:07] C:\Program Files\Microsoft Office
   [05/09/2009|20:22] C:\Program Files\Microsoft Office Outlook Connector
   [10/09/2009|07:07] C:\Program Files\Microsoft Silverlight
   [28/03/2009|12:55] C:\Program Files\Microsoft SQL Server Compact Edition
   [28/03/2009|12:56] C:\Program Files\Microsoft Sync Framework
   [13/02/2009|17:07] C:\Program Files\Microsoft Visual Studio
   [13/02/2009|17:04] C:\Program Files\Microsoft Visual Studio 8
   [11/06/2009|06:10] C:\Program Files\Microsoft Works
   [05/11/2009|19:27] C:\Program Files\Microsoft WSE
   [13/02/2009|17:06] C:\Program Files\Microsoft.NET
   [17/09/2009|19:51] C:\Program Files\Movie Maker
   [21/11/2009|10:53] C:\Program Files\Mozilla Firefox
   [13/02/2009|17:08] C:\Program Files\MSBuild
   [13/02/2009|14:39] C:\Program Files\MSXML 4.0
   [19/10/2009|18:45] C:\Program Files\Online Services
   [03/11/2008|16:59] C:\Program Files\PC-Doctor for Windows
   [21/03/2009|19:00] C:\Program Files\PhotoFiltre
   [14/09/2009|19:33] C:\Program Files\QuickTime
   [12/09/2009|09:51] C:\Program Files\QuickTime(88)
   [03/11/2008|16:41] C:\Program Files\Realtek
   [02/11/2006|13:35] C:\Program Files\Reference Assemblies
   [22/02/2009|14:48] C:\Program Files\ReflexiveArcade
   [14/11/2009|19:19] C:\Program Files\Spybot - Search & Destroy
   [13/02/2009|16:10] C:\Program Files\SystemRequirementsLab
   [18/11/2009|17:34] C:\Program Files\TuneUp Utilities 2009
   [02/11/2006|13:58] C:\Program Files\Uninstall Information
   [14/09/2009|19:37] C:\Program Files\Utilitaire de configuration iPhone
   [12/05/2009|10:26] C:\Program Files\Vuze
   [17/09/2009|19:51] C:\Program Files\Windows Calendar
   [17/09/2009|19:51] C:\Program Files\Windows Collaboration
   [17/09/2009|19:51] C:\Program Files\Windows Defender
   [20/11/2009|17:08] C:\Program Files\Windows Live
   [28/03/2009|12:53] C:\Program Files\Windows Live SkyDrive
   [17/09/2009|19:51] C:\Program Files\Windows Mail
   [17/09/2009|19:51] C:\Program Files\Windows Media Player
   [13/02/2009|13:41] C:\Program Files\Windows NT
   [17/09/2009|19:51] C:\Program Files\Windows Photo Gallery
   [17/09/2009|19:51] C:\Program Files\Windows Sidebar
   [07/07/2009|08:35] C:\Program Files\Winletmin
   [13/02/2009|16:48] C:\Program Files\WinRAR
   [01/08/2009|15:00] C:\Program Files\Winsudate

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [20/11/2009|17:25] C:\Program Files\Common Files\Adobe
   [01/11/2009|18:09] C:\Program Files\Common Files\Apple
   [13/02/2009|17:07] C:\Program Files\Common Files\DESIGNER
   [03/11/2008|16:54] C:\Program Files\Common Files\HP
   [03/11/2008|16:44] C:\Program Files\Common Files\InstallShield
   [03/11/2008|16:55] C:\Program Files\Common Files\Java
   [01/08/2009|19:05] C:\Program Files\Common Files\LightScribe
   [03/11/2008|16:52] C:\Program Files\Common Files\LS Getting Started
   [12/07/2009|17:51] C:\Program Files\Common Files\microsoft shared
   [24/02/2009|13:52] C:\Program Files\Common Files\PX Storage Engine
   [02/11/2006|12:18] C:\Program Files\Common Files\Services
   [02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [13/02/2009|14:03] C:\Program Files\Common Files\Symantec Shared
   [17/09/2009|19:51] C:\Program Files\Common Files\System
   [28/03/2009|12:38] C:\Program Files\Common Files\Windows Live
   [13/02/2009|16:00] C:\Program Files\Common Files\WindowsLiveInstaller
   [28/04/2009|13:02] C:\Program Files\Common Files\Wise Installation Wizard

   --------------------\  Process

   ( 21 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-11-21 10:54:35
   Windows 6.0.6002 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 103
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:9][D:8]-> C:\Users\Lauriane\AppData\Local\Temp
   [F:42][D:1]-> C:\Users\Lauriane\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:251][D:4]-> C:\Users\Lauriane\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:6][D:7]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 21/11/2009|10:55 - Option : [2]

   --------------------\  Fin du rapport a 10:55:28
   [ UAC => 1 ]

Raf · Answer

et voila juste un soucis que j'avais lorsque je lance lop S&D y avais le choix entre suppression Host+ ou Host- j'ai fait le HOSt+
merci

eZula · Answer

Un bon début, mais ça ne suffira pas pour être tranquille.

Télécharge combofix (sUBs) http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton Bureau
Double clique combofix.exe et suis les instructions.
Installe la console de récupération si proposé et continue.
Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Raf · Answer

Ok antivir à detecté 3 virus que doist-je faire

eZula · Answer

C:\Combofix.txt

raf · Answer

ben je peut pas le lancer lorsque je le lance antir m'affiche 3 virus

raf · Answer

enfin non il me dit forcelibrary.dll  contient cheval de troie

eZula · Answer

tu dois désactiver ton antivirus pour le laisser tourner

Raf · Answer

ComboFix 09-11-20.02 - Lauriane 21/11/2009 11:33.1.3 - x86
Microsoft® Windows Vista™ Édition Familiale Basique   6.0.6002.2.1252.33.1036.18.2942.1855 [GMT 1:00]
Lancé depuis: c:\users\Lauriane\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2735200289-1753316297-3505708831-500
c:\$recycle.bin\S-1-5-21-3213520390-330048417-2416552161-500
c:\$recycle.bin\S-1-5-21-379578684-575248035-2863804450-1000
c:\windows\system32\drivers\pciide.sys

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-10-21 au 2009-11-21  ))))))))))))))))))))))))))))))))))))
.

2009-11-21 10:29 . 2009-11-21 10:30	49152	d-----w-	C:\32788R22FWJFW.2.tmp
2009-11-21 10:24 . 2009-11-21 10:24	--------	d-----w-	C:\32788R22FWJFW.1.tmp
2009-11-21 09:53 . 2009-11-21 09:55	8192	d-----w-	C:\Lop SD
2009-11-21 09:27 . 2009-11-21 10:02	4096	d-----w-	C:\GenProc
2009-11-20 17:20 . 2009-03-30 09:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-11-20 17:20 . 2009-03-24 15:07	55640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-11-20 17:20 . 2009-11-20 17:20	--------	d-----w-	c:\program files\Avira
2009-11-20 17:11 . 2009-09-10 13:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-20 17:11 . 2009-11-20 17:11	4096	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-11-20 17:11 . 2009-09-10 13:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-11-20 16:24 . 2009-11-20 16:25	--------	d-----w-	c:\program files\Common Files\Adobe
2009-11-20 16:15 . 2009-11-20 16:15	--------	d-----w-	c:\program files\FileHippo.com
2009-11-20 16:13 . 2009-11-20 16:13	--------	d-----w-	c:\program files\CCleaner
2009-11-18 16:34 . 2009-11-18 16:34	604488	----a-w-	c:\windows\system32\TUProgSt.exe
2009-11-18 16:34 . 2009-11-18 16:34	361288	----a-w-	c:\windows\system32\TuneUpDefragService.exe
2009-11-18 16:34 . 2009-07-15 09:48	17224	----a-w-	c:\windows\system32\authuitu.dll
2009-11-18 16:34 . 2009-07-15 09:48	29000	----a-w-	c:\windows\system32\uxtuneup.dll
2009-11-14 12:07 . 2009-08-05 21:48	54632	----a-w-	c:\windows\system32\drivers\fssfltr.sys
2009-11-11 09:24 . 2009-08-14 13:27	2036736	----a-w-	c:\windows\system32\win32k.sys
2009-11-11 09:24 . 2009-08-10 12:35	355328	----a-w-	c:\windows\system32\WSDApi.dll
2009-11-05 18:27 . 2009-11-05 18:27	--------	d-----w-	c:\program files\Microsoft WSE
2009-11-05 18:27 . 2006-09-28 15:05	2414360	----a-w-	c:\windows\system32\d3dx9_31.dll
2009-11-05 18:15 . 2009-11-05 18:34	--------	d-----w-	c:\program files\Electronic Arts
2009-11-01 17:09 . 2009-11-01 17:09	--------	d-----w-	c:\program files\iPod
2009-11-01 17:09 . 2009-11-01 17:10	4096	d-----w-	c:\program files\iTunes

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-21 10:33 . 2008-11-04 00:06	672084	----a-w-	c:\windows\system32\perfh00C.dat
2009-11-21 10:33 . 2008-11-04 00:06	124228	----a-w-	c:\windows\system32\perfc00C.dat
2009-11-21 10:26 . 2009-06-14 19:01	12	----a-w-	c:\windows\bthservsdp.dat
2009-11-20 18:12 . 2009-02-24 15:25	8192	d-----w-	c:\program files\Chicken Invaders 2
2009-11-20 17:13 . 2008-11-03 15:41	4096	d--h--w-	c:\program files\InstallShield Installation Information
2009-11-20 16:30 . 2009-02-13 15:13	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-11-20 16:17 . 2009-02-13 15:05	4096	d-----w-	c:\program files\Messenger Plus! Live
2009-11-20 16:08 . 2009-02-13 13:42	4096	d-----w-	c:\program files\Windows Live
2009-11-18 16:34 . 2009-02-13 15:18	49152	d-----w-	c:\program files\TuneUp Utilities 2009
2009-11-14 18:19 . 2009-02-13 15:16	8192	d-----w-	c:\program files\Spybot - Search & Destroy
2009-11-02 19:42 . 2009-10-02 17:03	195456	------w-	c:\windows\system32\MpSigStub.exe
2009-11-01 17:09 . 2009-02-13 14:51	4096	d-----w-	c:\program files\Common Files\Apple
2009-10-19 17:44 . 2008-11-03 15:43	4096	d-----w-	c:\program files\Hewlett-Packard
2009-09-17 18:50 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2009-09-14 09:29 . 2009-10-15 17:06	144896	----a-w-	c:\windows\system32\drivers\srv2.sys
2009-09-10 16:48 . 2009-10-15 17:08	218624	----a-w-	c:\windows\system32\msv1_0.dll
2009-09-04 11:41 . 2009-10-15 17:06	60928	----a-w-	c:\windows\system32\msasn1.dll
2009-08-28 17:42 . 2009-08-28 17:42	40448	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2009-08-28 17:42 . 2009-08-28 17:42	2065696	----a-w-	c:\windows\system32\usbaaplrc.dll
2009-08-27 05:22 . 2009-10-15 17:08	916480	----a-w-	c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-15 17:08	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-08-27 05:17 . 2009-10-15 17:08	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-08-27 03:42 . 2009-10-15 17:08	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-05-15 11:08 . 2009-05-15 11:08	22	--sha-w-	c:\windows\SMINST\HPCD.sys
2008-11-04 00:20 . 2008-11-04 00:20	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Store file readme bash"="c:\programdata\Eq Dvd Mp3.om4rusz" [X]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"WinUsr"="c:\program files\Winsudate\gibusr.exe" [2009-08-01 88304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-06-11 90112]
"VX3000"="c:\windows\vVX3000.exe" [2008-08-04 721936]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2008-08-04 160800]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-20 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-]
"HP Health Check Scheduler"=c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):ce,d1,93,03,35,38,ca,01

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [20/11/2009 18:20 108289]
R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21/01/2008 03:33 21504]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [18/11/2009 17:34 604488]
R2 WinSvc;Gestionnaire de mise à jour Winsudate;c:\program files\Winsudate\gibsvc.exe [07/07/2009 08:35 70896]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\System32\drivers\sis163u.sys [05/09/2009 13:17 218112]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [14/11/2009 13:07 54632]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
bthsvcs	REG_MULTI_SZ   	BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
ezSharedSvc
.
Contenu du dossier 'Tâches planifiées'

2009-11-21 c:\windows\Tasks\User_Feed_Synchronization-{0094F739-E0A3-437E-9DCE-DDDB0951C663}.job
- c:\windows\system32\msfeedssync.exe [2009-10-15 03:41]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=84&bd=Presario&pf=cndt
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\users\Lauriane\AppData\Roaming\Mozilla\Firefox\Profiles\mxa2ywfb.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - plugin: c:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-21 11:43
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-11-21 11:46
ComboFix-quarantined-files.txt  2009-11-21 10:46

Avant-CF: 356 557 070 336 octets libres
Après-CF: 356 484 710 400 octets libres

- - End Of File - - 0D3E73EBDB5DD1E22C6733253AE11BC2

Raf · Answer

voilou

Raf · Answer

ezula..:((

eZula · Answer

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Driver::
WinSvc

File::
C:\ProgramData\Eq Dvd Mp3.om4rusz
C:\32788R22FWJFW.2.tmp
C:\32788R22FWJFW.1.tmp 
c:\program files\Winsudate\gibusr.exe

Folder::
C:\ProgramData\aboutthunkcity
c:\program files\Winsudate

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Store file readme bash"=-
"WinUsr"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000

Enregistre ce fichier sous le nom CFScript

[*]Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture [img]http://apu.mabul.org/up/apu/2008/08/12/img-191202xzrpd.gif[/img]
[*]Une fenêtre bleue va apparaître : au message "Type 1 to continue, or 2 to abort", tape 1 puis valide.
[*]Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal.
Ne touche à rien tant que le scan n'est pas terminé.
[*]Une fois le scan achevé, un rapport va s'afficher : poste son contenu.
[*]Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

raf · Answer

ComboFix 09-11-20.02 - Lauriane 21/11/2009 12:09.2.3 - x86
Microsoft® Windows Vista™ Édition Familiale Basique   6.0.6002.2.1252.33.1036.18.2942.1845 [GMT 1:00]
Lancé depuis: c:\users\Lauriane\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Lauriane\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"C:\32788R22FWJFW.1.tmp"
"C:\32788R22FWJFW.2.tmp"
"c:\program files\Winsudate\gibusr.exe"
"c:\programdata\Eq Dvd Mp3.om4rusz"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Winsudate
c:\program files\Winsudate\gibcom.dll
c:\program files\Winsudate\gibidl.dll
c:\program files\Winsudate\gibsvc.exe
c:\program files\Winsudate\gibupt.exe
c:\program files\Winsudate\gibusr.exe
c:\programdata\aboutthunkcity
c:\programdata\aboutthunkcity\Blue long view bend.exe
c:\programdata\aboutthunkcity\smusaogz.exe
c:\programdata\Eq Dvd Mp3.om4rusz

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_WinSvc


(((((((((((((((((((((((((((((   Fichiers créés du 2009-10-21 au 2009-11-21  ))))))))))))))))))))))))))))))))))))
.

2009-11-21 20:21 . 2009-04-11 06:32	14312	----a-w-	c:\windows\system32\drivers\pciide.sys
2009-11-21 10:29 . 2009-11-21 10:30	49152	d-----w-	C:\32788R22FWJFW.2.tmp
2009-11-21 10:24 . 2009-11-21 10:24	--------	d-----w-	C:\32788R22FWJFW.1.tmp
2009-11-21 09:53 . 2009-11-21 09:55	--------	d-----w-	C:\Lop SD
2009-11-21 09:27 . 2009-11-21 10:02	4096	d-----w-	C:\GenProc
2009-11-20 17:20 . 2009-03-30 09:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-11-20 17:20 . 2009-03-24 15:07	55640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-11-20 17:20 . 2009-11-20 17:20	--------	d-----w-	c:\program files\Avira
2009-11-20 17:11 . 2009-09-10 13:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-20 17:11 . 2009-11-20 17:11	4096	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-11-20 17:11 . 2009-09-10 13:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-11-20 16:24 . 2009-11-20 16:25	--------	d-----w-	c:\program files\Common Files\Adobe
2009-11-20 16:15 . 2009-11-20 16:15	--------	d-----w-	c:\program files\FileHippo.com
2009-11-20 16:13 . 2009-11-20 16:13	--------	d-----w-	c:\program files\CCleaner
2009-11-18 16:34 . 2009-11-18 16:34	604488	----a-w-	c:\windows\system32\TUProgSt.exe
2009-11-18 16:34 . 2009-11-18 16:34	361288	----a-w-	c:\windows\system32\TuneUpDefragService.exe
2009-11-18 16:34 . 2009-07-15 09:48	17224	----a-w-	c:\windows\system32\authuitu.dll
2009-11-18 16:34 . 2009-07-15 09:48	29000	----a-w-	c:\windows\system32\uxtuneup.dll
2009-11-14 12:07 . 2009-08-05 21:48	54632	----a-w-	c:\windows\system32\drivers\fssfltr.sys
2009-11-11 09:24 . 2009-08-14 13:27	2036736	----a-w-	c:\windows\system32\win32k.sys
2009-11-11 09:24 . 2009-08-10 12:35	355328	----a-w-	c:\windows\system32\WSDApi.dll
2009-11-05 18:27 . 2009-11-05 18:27	--------	d-----w-	c:\program files\Microsoft WSE
2009-11-05 18:27 . 2006-09-28 15:05	2414360	----a-w-	c:\windows\system32\d3dx9_31.dll
2009-11-05 18:15 . 2009-11-05 18:34	--------	d-----w-	c:\program files\Electronic Arts
2009-11-01 17:09 . 2009-11-01 17:09	--------	d-----w-	c:\program files\iPod
2009-11-01 17:09 . 2009-11-01 17:10	4096	d-----w-	c:\program files\iTunes

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-21 11:19 . 2009-06-14 19:01	12	----a-w-	c:\windows\bthservsdp.dat
2009-11-21 10:33 . 2008-11-04 00:06	672084	----a-w-	c:\windows\system32\perfh00C.dat
2009-11-21 10:33 . 2008-11-04 00:06	124228	----a-w-	c:\windows\system32\perfc00C.dat
2009-11-20 18:12 . 2009-02-24 15:25	8192	d-----w-	c:\program files\Chicken Invaders 2
2009-11-20 17:13 . 2008-11-03 15:41	4096	d--h--w-	c:\program files\InstallShield Installation Information
2009-11-20 16:30 . 2009-02-13 15:13	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-11-20 16:17 . 2009-02-13 15:05	4096	d-----w-	c:\program files\Messenger Plus! Live
2009-11-20 16:08 . 2009-02-13 13:42	4096	d-----w-	c:\program files\Windows Live
2009-11-18 16:34 . 2009-02-13 15:18	49152	d-----w-	c:\program files\TuneUp Utilities 2009
2009-11-14 18:19 . 2009-02-13 15:16	8192	d-----w-	c:\program files\Spybot - Search & Destroy
2009-11-02 19:42 . 2009-10-02 17:03	195456	------w-	c:\windows\system32\MpSigStub.exe
2009-11-01 17:09 . 2009-02-13 14:51	4096	d-----w-	c:\program files\Common Files\Apple
2009-10-19 17:44 . 2008-11-03 15:43	4096	d-----w-	c:\program files\Hewlett-Packard
2009-09-17 18:50 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2009-09-14 09:29 . 2009-10-15 17:06	144896	----a-w-	c:\windows\system32\drivers\srv2.sys
2009-09-10 16:48 . 2009-10-15 17:08	218624	----a-w-	c:\windows\system32\msv1_0.dll
2009-09-04 11:41 . 2009-10-15 17:06	60928	----a-w-	c:\windows\system32\msasn1.dll
2009-08-28 17:42 . 2009-08-28 17:42	40448	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2009-08-28 17:42 . 2009-08-28 17:42	2065696	----a-w-	c:\windows\system32\usbaaplrc.dll
2009-08-27 05:22 . 2009-10-15 17:08	916480	----a-w-	c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-15 17:08	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-08-27 05:17 . 2009-10-15 17:08	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-08-27 03:42 . 2009-10-15 17:08	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-05-15 11:08 . 2009-05-15 11:08	22	--sha-w-	c:\windows\SMINST\HPCD.sys
2008-11-04 00:20 . 2008-11-04 00:20	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-06-11 90112]
"VX3000"="c:\windows\vVX3000.exe" [2008-08-04 721936]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2008-08-04 160800]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-20 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-]
"HP Health Check Scheduler"=c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):ce,d1,93,03,35,38,ca,01

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [20/11/2009 18:20 108289]
R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21/01/2008 03:33 21504]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [18/11/2009 17:34 604488]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\System32\drivers\sis163u.sys [05/09/2009 13:17 218112]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [14/11/2009 13:07 54632]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
bthsvcs	REG_MULTI_SZ   	BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
ezSharedSvc
.
Contenu du dossier 'Tâches planifiées'

2009-11-21 c:\windows\Tasks\User_Feed_Synchronization-{0094F739-E0A3-437E-9DCE-DDDB0951C663}.job
- c:\windows\system32\msfeedssync.exe [2009-10-15 03:41]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=84&bd=Presario&pf=cndt
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\users\Lauriane\AppData\Roaming\Mozilla\Firefox\Profiles\mxa2ywfb.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - plugin: c:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-21 12:24
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(3888)
c:\windows\system32
vcpl.dll
c:\windows\system32
vapi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32
vvsvc.exe
c:\windows\system32undll32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\WUDFHost.exe
c:\windows\System32undll32.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\program files\iPod\bin\iPodService.exe
c:\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Heure de fin: 2009-11-21 12:28 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-11-21 11:28
ComboFix2.txt  2009-11-21 10:46

Avant-CF: 356 526 825 472 octets libres
Après-CF: 356 269 633 536 octets libres

- - End Of File - - 93A60958F0B68D97F66D9005513600E8

raf · Answer

depuis cette manip le pc est super lent il bug

eZula · Answer

ça me semble pas trop mal. Juste, une vérification sur ces deux fichiers

C:\32788R22FWJFW.2.tmp
C:\32788R22FWJFW.1.tmp 

peux-tu les scanner sur le site virustotal et poster les deux rapports ?

raf · Answer

c'est 2 dossier l'un ya rien et l'autre  plein de .dll impossible a scanner

raf · Answer

et avira ne demarre pas

eZula · Answer

compresse ces deux dossiers dans une archive zip et envoie-les moi à ce mail qlcslora@trashmail.net

raf · Answer

c fait

eZula · Answer

lol quel con que je suis, il s'agit de ComboFix ;)

Es-tu d'accord avec l'idée que ton problème est résolu ?

ne pars pas trop vite, il reste juste une ou deux petites manips avant de finir

raf · Answer

mon Pc est t'il totallement desinfecté? parce que antivir ne veux pas se mettre a jour sinon je le reinstalle?

eZula · Answer

Fais ce scan vite fait https://forums.commentcamarche.net/forum/affich-14542335-virus-total-security-encore-desole#16

raf · Answer

SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************
******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \??\C:\Users\Lauriane\Desktop\SysProt\SysProtDrv.sys
Service Name: SysProtDrv.sys
Module Base: 9C9EF000
Module End: 9C9FA000
Hidden: No

Module Name: C:\Windows\system32
tkrnlpa.exe
Service Name: ---
Module Base: 81E48000
Module End: 82201000
Hidden: No

Module Name: C:\Windows\system32\hal.dll
Service Name: ---
Module Base: 81E15000
Module End: 81E48000
Hidden: No

Module Name: C:\Windows\system32\kdcom.dll
Service Name: ---
Module Base: 80408000
Module End: 8040F000
Hidden: No

Module Name: C:\Windows\system32\PSHED.dll
Service Name: ---
Module Base: 8040F000
Module End: 80420000
Hidden: No

Module Name: C:\Windows\system32\BOOTVID.dll
Service Name: ---
Module Base: 80420000
Module End: 80428000
Hidden: No

Module Name: C:\Windows\system32\CLFS.SYS
Service Name: CLFS
Module Base: 80428000
Module End: 80469000
Hidden: No

Module Name: C:\Windows\system32\CI.dll
Service Name: ---
Module Base: 80469000
Module End: 80549000
Hidden: No

Module Name: C:\Windows\system32\drivers\Wdf01000.sys
Service Name: Wdf01000
Module Base: 80549000
Module End: 805C5000
Hidden: No

Module Name: C:\Windows\system32\drivers\WDFLDR.SYS
Service Name: ---
Module Base: 805C5000
Module End: 805D2000
Hidden: No

Module Name: C:\Windows\system32\drivers\acpi.sys
Service Name: ACPI
Module Base: 80600000
Module End: 80646000
Hidden: No

Module Name: C:\Windows\system32\drivers\WMILIB.SYS
Service Name: ---
Module Base: 80646000
Module End: 8064F000
Hidden: No

Module Name: C:\Windows\system32\drivers\msisadrv.sys
Service Name: msisadrv
Module Base: 8064F000
Module End: 80657000
Hidden: No

Module Name: C:\Windows\system32\drivers\pci.sys
Service Name: pci
Module Base: 80657000
Module End: 8067E000
Hidden: No

Module Name: C:\Windows\System32\drivers\partmgr.sys
Service Name: partmgr
Module Base: 8067E000
Module End: 8068D000
Hidden: No

Module Name: C:\Windows\system32\drivers\volmgr.sys
Service Name: volmgr
Module Base: 8068D000
Module End: 8069C000
Hidden: No

Module Name: C:\Windows\System32\drivers\volmgrx.sys
Service Name: volmgrx
Module Base: 8069C000
Module End: 806E6000
Hidden: No

Module Name: C:\Windows\system32\drivers\pciide.sys
Service Name: pciide
Module Base: 806E6000
Module End: 806ED000
Hidden: No

Module Name: C:\Windows\system32\drivers\PCIIDEX.SYS
Service Name: ---
Module Base: 806ED000
Module End: 806FB000
Hidden: No

Module Name: C:\Windows\System32\drivers\mountmgr.sys
Service Name: MountMgr
Module Base: 806FB000
Module End: 8070B000
Hidden: No

Module Name: C:\Windows\system32\drivers
vraid.sys
Service Name: nvraid
Module Base: 8070B000
Module End: 80726000
Hidden: No

Module Name: C:\Windows\system32\drivers\CLASSPNP.SYS
Service Name: ---
Module Base: 80726000
Module End: 80747000
Hidden: No

Module Name: C:\Windows\system32\drivers\atapi.sys
Service Name: atapi
Module Base: 80747000
Module End: 8074F000
Hidden: No

Module Name: C:\Windows\system32\drivers\ataport.SYS
Service Name: ---
Module Base: 8074F000
Module End: 8076D000
Hidden: No

Module Name: C:\Windows\system32\drivers
vstor32.sys
Service Name: nvstor32
Module Base: 8076D000
Module End: 80792000
Hidden: No

Module Name: C:\Windows\system32\drivers\storport.sys
Service Name: ---
Module Base: 80792000
Module End: 807D3000
Hidden: No

Module Name: C:\Windows\system32\drivers\fltmgr.sys
Service Name: FltMgr
Module Base: 89801000
Module End: 89833000
Hidden: No

Module Name: C:\Windows\system32\drivers\fileinfo.sys
Service Name: FileInfo
Module Base: 89833000
Module End: 89843000
Hidden: No

Module Name: C:\Windows\System32\Drivers\ksecdd.sys
Service Name: KSecDD
Module Base: 89843000
Module End: 898B4000
Hidden: No

Module Name: C:\Windows\system32\drivers
dis.sys
Service Name: NDIS
Module Base: 898B4000
Module End: 899BF000
Hidden: No

Module Name: C:\Windows\system32\drivers\msrpc.sys
Service Name: MsRPC
Module Base: 899BF000
Module End: 899EA000
Hidden: No

Module Name: C:\Windows\system32\drivers\NETIO.SYS
Service Name: ---
Module Base: 89A0E000
Module End: 89A49000
Hidden: No

Module Name: C:\Windows\System32\drivers	cpip.sys
Service Name: Tcpip
Module Base: 89A49000
Module End: 89B33000
Hidden: No

Module Name: C:\Windows\System32\drivers\fwpkclnt.sys
Service Name: ---
Module Base: 89B33000
Module End: 89B4E000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Ntfs.sys
Service Name: Ntfs
Module Base: 89C05000
Module End: 89D15000
Hidden: No

Module Name: C:\Windows\system32\drivers\volsnap.sys
Service Name: volsnap
Module Base: 89D15000
Module End: 89D4E000
Hidden: No

Module Name: C:\Windows\System32\Drivers\spldr.sys
Service Name: spldr
Module Base: 89D4E000
Module End: 89D56000
Hidden: No

Module Name: C:\Windows\System32\Drivers\mup.sys
Service Name: Mup
Module Base: 89D56000
Module End: 89D65000
Hidden: No

Module Name: C:\Windows\System32\drivers\ecache.sys
Service Name: Ecache
Module Base: 89D65000
Module End: 89D8C000
Hidden: No

Module Name: C:\Windows\system32\drivers\disk.sys
Service Name: disk
Module Base: 89D8C000
Module End: 89D9D000
Hidden: No

Module Name: C:\Windows\system32\drivers\crcdisk.sys
Service Name: crcdisk
Module Base: 89D9D000
Module End: 89DA6000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS	unnel.sys
Service Name: tunnel
Module Base: 89DE2000
Module End: 89DED000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS	unmp.sys
Service Name: tunmp
Module Base: 89DED000
Module End: 89DF6000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\processr.sys
Service Name: Processor
Module Base: 89B4E000
Module End: 89B5D000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\i8042prt.sys
Service Name: i8042prt
Module Base: 89B5D000
Module End: 89B70000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mouclass.sys
Service Name: mouclass
Module Base: 89B70000
Module End: 89B7B000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\kbdclass.sys
Service Name: kbdclass
Module Base: 89B7B000
Module End: 89B86000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\usbohci.sys
Service Name: usbohci
Module Base: 89DF6000
Module End: 89E00000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\USBPORT.SYS
Service Name: ---
Module Base: 89B86000
Module End: 89BC4000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\usbehci.sys
Service Name: usbehci
Module Base: 89BC4000
Module End: 89BD3000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ohci1394.sys
Service Name: ohci1394
Module Base: 89BD3000
Module End: 89BE3000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\1394BUS.SYS
Service Name: ---
Module Base: 89BE3000
Module End: 89BF1000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\HDAudBus.sys
Service Name: HDAudBus
Module Base: 8D404000
Module End: 8D491000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS
vmfdx32.sys
Service Name: NVENETFD
Module Base: 8D491000
Module End: 8D590000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\cdrom.sys
Service Name: cdrom
Module Base: 8D590000
Module End: 8D5A8000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
Service Name: GEARAspiWDM
Module Base: 8D5A8000
Module End: 8D5AE000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS
vlddmkm.sys
Service Name: nvlddmkm
Module Base: 8D808000
Module End: 8DF6A000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS
vBridge.kmd
Service Name: ---
Module Base: 8DF6A000
Module End: 8DF6C000
Hidden: No

Module Name: C:\Windows\System32\drivers\dxgkrnl.sys
Service Name: DXGKrnl
Module Base: 8E207000
Module End: 8E2A6000
Hidden: No

Module Name: C:\Windows\System32\drivers\watchdog.sys
Service Name: ---
Module Base: 8E2A6000
Module End: 8E2B2000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\msiscsi.sys
Service Name: iScsiPrt
Module Base: 8E2B2000
Module End: 8E2E1000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\TDI.SYS
Service Name: ---
Module Base: 8E2E1000
Module End: 8E2EC000
Hidden: No

Module Name: C:\Windows\system32\DRIVERSasl2tp.sys
Service Name: Rasl2tp
Module Base: 8E2EC000
Module End: 8E303000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS
distapi.sys
Service Name: NdisTapi
Module Base: 8E303000
Module End: 8E30E000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS
diswan.sys
Service Name: NdisWan
Module Base: 8E30E000
Module End: 8E331000
Hidden: No

Module Name: C:\Windows\system32\DRIVERSaspppoe.sys
Service Name: RasPppoe
Module Base: 8E331000
Module End: 8E340000
Hidden: No

Module Name: C:\Windows\system32\DRIVERSaspptp.sys
Service Name: PptpMiniport
Module Base: 8E340000
Module End: 8E354000
Hidden: No

Module Name: C:\Windows\system32\DRIVERSassstp.sys
Service Name: RasSstp
Module Base: 8E354000
Module End: 8E369000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS	ermdd.sys
Service Name: TermDD
Module Base: 8E369000
Module End: 8E379000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\swenum.sys
Service Name: swenum
Module Base: 8E379000
Module End: 8E37B000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ks.sys
Service Name: ---
Module Base: 8E37B000
Module End: 8E3A5000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mssmbios.sys
Service Name: mssmbios
Module Base: 8E3A5000
Module End: 8E3AF000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\umbus.sys
Service Name: umbus
Module Base: 8E3AF000
Module End: 8E3BC000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\usbhub.sys
Service Name: usbhub
Module Base: 8E3BC000
Module End: 8E3F1000
Hidden: No

Module Name: C:\Windows\System32\Drivers\NDProxy.SYS
Service Name: NDProxy
Module Base: 8DF6C000
Module End: 8DF7D000
Hidden: No

Module Name: C:\Windows\system32\drivers\RTKVHDA.sys
Service Name: IntcAzAudAddService
Module Base: 8E60F000
Module End: 8E81C000
Hidden: No

Module Name: C:\Windows\system32\drivers\portcls.sys
Service Name: ---
Module Base: 8E81C000
Module End: 8E849000
Hidden: No

Module Name: C:\Windows\system32\drivers\drmk.sys
Service Name: ---
Module Base: 8E849000
Module End: 8E86E000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Fs_Rec.SYS
Service Name: Fs_Rec
Module Base: 8E86E000
Module End: 8E877000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Null.SYS
Service Name: Null
Module Base: 8E877000
Module End: 8E87E000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Beep.SYS
Service Name: Beep
Module Base: 8E87E000
Module End: 8E885000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
Service Name: ---
Module Base: 8E88E000
Module End: 8E895000
Hidden: No

Module Name: C:\Windows\System32\drivers\vga.sys
Service Name: vga
Module Base: 8E895000
Module End: 8E8A1000
Hidden: No

Module Name: C:\Windows\System32\drivers\VIDEOPRT.SYS
Service Name: ---
Module Base: 8E8A1000
Module End: 8E8C2000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\RDPCDD.sys
Service Name: RDPCDD
Module Base: 8E8C2000
Module End: 8E8CA000
Hidden: No

Module Name: C:\Windows\system32\driversdpencdd.sys
Service Name: RDPENCDD
Module Base: 8E8CA000
Module End: 8E8D2000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Msfs.SYS
Service Name: Msfs
Module Base: 8E8D2000
Module End: 8E8DD000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Npfs.SYS
Service Name: Npfs
Module Base: 8E8DD000
Module End: 8E8EB000
Hidden: No

Module Name: C:\Windows\System32\DRIVERSasacd.sys
Service Name: RasAcd
Module Base: 8E8EB000
Module End: 8E8F4000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS	dx.sys
Service Name: tdx
Module Base: 8E8F4000
Module End: 8E90A000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\smb.sys
Service Name: Smb
Module Base: 8E90A000
Module End: 8E91E000
Hidden: No

Module Name: C:\Windows\system32\drivers\afd.sys
Service Name: AFD
Module Base: 8E91E000
Module End: 8E966000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS
etbt.sys
Service Name: netbt
Module Base: 8E966000
Module End: 8E998000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\pacer.sys
Service Name: PSched
Module Base: 8E998000
Module End: 8E9AE000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS
etbios.sys
Service Name: NetBIOS
Module Base: 8E9AE000
Module End: 8E9BC000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\wanarp.sys
Service Name: Wanarp
Module Base: 8E9BC000
Module End: 8E9CF000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ssmdrv.sys
Service Name: ssmdrv
Module Base: 8E9CF000
Module End: 8E9D5000
Hidden: No

Module Name: C:\Windows\system32\DRIVERSdbss.sys
Service Name: rdbss
Module Base: 8DF7D000
Module End: 8DFB9000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\sis163u.sys
Service Name: SIS163u
Module Base: 8DFB9000
Module End: 8DFEF000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\USBD.SYS
Service Name: ---
Module Base: 8E9D5000
Module End: 8E9D7000
Hidden: No

Module Name: C:\Windows\system32\drivers
siproxy.sys
Service Name: nsiproxy
Module Base: 8E9D7000
Module End: 8E9E1000
Hidden: No

Module Name: C:\Windows\System32\Drivers\dfsc.sys
Service Name: DfsC
Module Base: 8E9E1000
Module End: 8E9F8000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\avipbb.sys
Service Name: avipbb
Module Base: 8D5AE000
Module End: 8D5CA000
Hidden: No

Module Name: \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
Service Name: avgio
Module Base: 8E9F8000
Module End: 8E9FA000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\udfs.sys
Service Name: udfs
Module Base: 89DA6000
Module End: 89DE1000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\usbccgp.sys
Service Name: usbccgp
Module Base: 8D5CA000
Module End: 8D5E1000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\VX3000.sys
Service Name: VX3000
Module Base: 8F801000
Module End: 8F9DF000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\STREAM.SYS
Service Name: ---
Module Base: 8F9DF000
Module End: 8F9EC000
Hidden: No

Module Name: C:\Windows\system32\drivers\usbaudio.sys
Service Name: usbaudio
Module Base: 8F9EC000
Module End: 8F9FE000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Service Name: USBSTOR
Module Base: 8D5E1000
Module End: 8D5F6000
Hidden: No

Module Name: C:\Windows\System32\Drivers\crashdmp.sys
Service Name: ---
Module Base: 8E600000
Module End: 8E60D000
Hidden: No

Module Name: \SystemRoot\System32\Drivers\dump_diskdump.sys
Service Name: ---
Module Base: 8E3F1000
Module End: 8E3FB000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_nvstor32.sys
Service Name: ---
Module Base: 807D3000
Module End: 807F8000
Hidden: Yes

Module Name: C:\Windows\System32\drivers\Dxapi.sys
Service Name: ---
Module Base: 8DFEF000
Module End: 8DFF9000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\monitor.sys
Service Name: monitor
Module Base: 89BF1000
Module End: 89C00000
Hidden: No

Module Name: C:\Windows\system32\drivers\luafv.sys
Service Name: luafv
Module Base: 805D2000
Module End: 805ED000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\avgntflt.sys
Service Name: avgntflt
Module Base: 899EA000
Module End: 899FE000
Hidden: No

Module Name: C:\Windows\system32\drivers\spsys.sys
Service Name: ---
Module Base: 9B409000
Module End: 9B4B9000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\lltdio.sys
Service Name: lltdio
Module Base: 9B4B9000
Module End: 9B4C9000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS
wifi.sys
Service Name: NativeWifiP
Module Base: 9B4C9000
Module End: 9B4F3000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS
disuio.sys
Service Name: Ndisuio
Module Base: 9B4F3000
Module End: 9B4FD000
Hidden: No

Module Name: C:\Windows\system32\DRIVERSspndr.sys
Service Name: rspndr
Module Base: 9B4FD000
Module End: 9B510000
Hidden: No

Module Name: C:\Windows\system32\drivers\HTTP.sys
Service Name: HTTP
Module Base: 9B510000
Module End: 9B57B000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\srvnet.sys
Service Name: srvnet
Module Base: 9B57B000
Module End: 9B598000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\bowser.sys
Service Name: bowser
Module Base: 9B598000
Module End: 9B5B1000
Hidden: No

Module Name: C:\Windows\System32\drivers\mpsdrv.sys
Service Name: mpsdrv
Module Base: 9B5B1000
Module End: 9B5C6000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mrxsmb.sys
Service Name: mrxsmb
Module Base: 9B5C6000
Module End: 9B5E5000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mrxsmb10.sys
Service Name: mrxsmb10
Module Base: 9C800000
Module End: 9C839000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mrxsmb20.sys
Service Name: mrxsmb20
Module Base: 9C839000
Module End: 9C851000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\srv2.sys
Service Name: srv2
Module Base: 9C851000
Module End: 9C878000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\srv.sys
Service Name: srv
Module Base: 9C878000
Module End: 9C8C4000
Hidden: No

Module Name: C:\Windows\system32\drivers\peauth.sys
Service Name: PEAUTH
Module Base: 9C8C4000
Module End: 9C9A2000
Hidden: No

Module Name: C:\Windows\System32\Drivers\secdrv.SYS
Service Name: secdrv
Module Base: 9C9A2000
Module End: 9C9AC000
Hidden: No

Module Name: C:\Windows\System32\drivers	cpipreg.sys
Service Name: tcpipreg
Module Base: 9C9AC000
Module End: 9C9B8000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\WUDFRd.sys
Service Name: WUDFRd
Module Base: 9C9B8000
Module End: 9C9CD000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\WUDFPf.sys
Service Name: ---
Module Base: 9C9CD000
Module End: 9C9DF000
Hidden: No

Module Name: \??\C:\ComboFix\catchme.sys
Service Name: catchme
Module Base: 9C9E5000
Module End: 9C9ED000
Hidden: Yes

Module Name: \??\C:\Windows\system32\Drivers\PROCEXP113.SYS
Service Name: ---
Module Base: 9C9ED000
Module End: 9C9EF000
Hidden: Yes

raf · Answer

Ezula?

eZula · Answer

Bon. Et si tu réinstalles antivir ? les mises à jour ça marche vraiment pas du tout ou très lentement mais quand même ?

raf · Answer

salut,
c'est bon antivir tourne par contre j'ai fais un scan malware et il m'a detecté 4 infections je les ai supprimer mais ma soeur dit que le pc est devenus lent donc je sais pas trop si c'est ok?
merci de votre aide

eZula · Answer

salut

tu as le rapport de l'infection ?

raf · Answer

salut,
je t'envoi ca cet aprem

Raf · Answer

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3213
Windows 6.0.6002 Service Pack 2

22/11/2009 17:18:38
mbam-log-2009-11-22 (17-18-38).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 271824
Temps écoulé: 4 hour(s), 48 minute(s), 37 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\Program Files\Winsudate\gibcom.dll.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Winsudate\gibidl.dll.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Winsudate\gibsvc.exe.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Winsudate\gibupt.exe.vir (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FN6PRNSO\gibsvc[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LEH9W4OY\gibcom[1].dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LEH9W4OY\gibidl[1].dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TJMGJQKO\gibupt[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.

Raf · Answer

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3217
Windows 6.0.6002 Service Pack 2

23/11/2009 17:04:23
mbam-log-2009-11-23 (17-04-23).txt

Type de recherche: Examen rapide
Eléments examinés: 91594
Temps écoulé: 4 minute(s), 19 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

eZula · Answer

il faudrait que tu laisses passer un ou deux jours, en utilisant ton ordinateur normalement
A l'issue de cette période, refais un scan MBAM et tiens moi au courant des résultats dans tous les cas.

Raf2 · Answer

ok ezula je te remercie

Infection Cid +antivir impossible Maj

37 réponses

Votre réponse

Discussions similaires

Newsletters