Cheval de troie et drive cleaner - Page 3

rapport combofix
bah le fichier qui revenait tjrs sur vundo est parti le souci c que souvent mon pc je l'allume et deux min après il s'éteind tout seul
sinon qd j'ai fait combo fix je savais pas comment faire, car bitdefender m'a dit que bcp de choses voulaient être changés concernant mon pad, logiciel webcam j'ia mis non sauf pr cmd.exe qui concernait le combo fix en cours

"Loreleichen" - 2007-07-16 18:42:46 - ComboFix 07-07-14.6 - Service Pack 2 NTFS

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_DOMAINSERVICE

((((((((((((((((((((((((( Files Created from 2007-06-16 to 2007-07-16 )))))))))))))))))))))))))))))))

2007-07-16 18:41 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-13 21:52 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2007-07-13 02:06 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-07-10 18:44 9,091 --a------ C:\dnsbak.reg
2007-07-10 12:08 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-07-10 12:07 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-07-10 12:00 <REP> d-------- C:\WINDOWS\Internet Logs
2007-07-08 10:52 <REP> d-------- C:\VundoFix Backups
2007-07-08 09:11 6,012 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-08 09:10 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-07-08 09:10 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-07-08 09:10 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-07-07 20:47 <REP> d-------- C:\DOCUME~1\Autre\APPLIC~1\Bitdefender
2007-07-07 15:41 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-07 11:01 <REP> d-------- C:\Program Files\Windows Live
2007-07-07 11:01 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
2007-07-07 11:01 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
2007-07-07 08:39 <REP> d-------- C:\DOCUME~1\LORELE~1\APPLIC~1\Bitdefender
2007-07-07 08:18 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
2007-07-07 08:06 <REP> d-------- C:\Program Files\CCleaner
2007-07-06 21:25 <REP> d-------- C:\Program Files\RegClean
2007-07-06 21:00 <REP> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-06 20:59 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2007-07-06 20:59 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2007-07-06 20:59 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2007-07-06 20:59 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2007-07-06 20:59 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2007-07-06 20:59 <REP> d-------- C:\Program Files\Trojan Remover
2007-07-06 20:59 <REP> d-------- C:\DOCUME~1\LORELE~1\APPLIC~1\Simply Super Software
2007-07-06 20:59 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Simply Super Software
2007-07-04 13:58 <REP> d-------- C:\Program Files\Lavasoft
2007-07-04 13:58 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-04 13:56 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-07-03 22:03 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-03 22:01 5,037,072 --a------ C:\Program Files\spybotsd14.exe
2007-07-03 22:01 17,222,416 --a------ C:\Program Files\antivir_workstation_win7u_de_h.exe
2007-07-03 20:42 <REP> d-------- C:\Program Files\Navilog1
2007-07-03 09:04 946,639 --a------ C:\WINDOWS\system32\ccbeg.ini2.ren
2007-07-03 08:49 933,044 --a------ C:\WINDOWS\system32\ccbeg.bak2.ren
2007-07-03 08:47 955,164 --a------ C:\WINDOWS\system32\ccbeg.ini.ren
2007-07-03 08:45 200 --a------ C:\winbbs.exe
2007-07-03 01:36 936,785 --a------ C:\WINDOWS\system32\ccbeg.tmp.ren
2007-07-03 01:35 934,855 --a------ C:\WINDOWS\system32\ccbeg.bak1.ren

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-15 22:23:06 -------- d-----w C:\DOCUME~1\LORELE~1\APPLIC~1\Skype
2007-07-12 07:08:18 76,582 ----a-w C:\WINDOWS\system32\perfc00C.dat
2007-07-12 07:08:18 471,484 ----a-w C:\WINDOWS\system32\perfh00C.dat
2007-07-08 06:40:37 -------- d-----w C:\Program Files\Google
2007-06-04 13:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 13:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 13:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-03 08:58:51 -------- d-----w C:\Program Files\Skype
2007-06-03 08:58:51 -------- d-----w C:\Program Files\Fichiers communs\Skype
2007-06-02 07:48:33 -------- d-----w C:\Program Files\Borland
2007-06-01 06:20:30 51,568 ----a-w C:\WINDOWS\system32\sirenacm.dll
2007-06-01 05:39:01 21,648 ----a-w C:\WINDOWS\CTL3DV2.DLL
2007-05-16 15:13:53 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-04-25 14:22:35 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-21 19:28:27 2,368 ----a-w C:\WINDOWS\system32\STEC3.sys
2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2006-07-01 23:03:45 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-05-07 14:58:23 837,803 ----a-w C:\Program Files\7z440.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{225FED2A-9771-49D9-88CD-65423F96441A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2005-01-14 01:05 118842 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5C2A2C2-85CF-4ED0-AECE-667DC70D63BA}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F17A53CE-E542-4A7C-B6AA-64E050C36A79}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4002052-AB29-4B33-8C8D-0E99084564EC}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 21:05]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]
"Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [2005-04-05 16:25]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 15:23 C:\WINDOWS\agrsmmsg.exe]
"NDSTray.exe"="NDSTray.exe" []
"TFncKy"="TFncKy.exe" []
"HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-12-24 10:07]
"SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [2005-02-26 07:59]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" []
"@"="" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 16:08]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 12:00]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 14:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxwuvt]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebcc]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c59f08d-dda2-11da-81d1-00166f3b4dbe}]
AutoRun\command- F:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d63a79e9-16eb-11db-8263-00166f3b4dbe}]
Auto\command- E:\AdobeR.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-16 18:54:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-16 18:58:36
C:\ComboFix-quarantined-files.txt ... 2007-07-16 18:58

--- E O F ---

si t' as pas de parefeu installe KERIO ou JETICO ou ZONE ALARM en complement de avast

https://www.zebulon.fr/telechargements/securite/firewalls/kerio.html

https://www.01net.com/telecharger/windows/Securite/firewall/fiches/31528.html

----------------

mets a jour windows dans DEMARRER puis WINDOWS UPDATE
dis si des pb persistent et lequels

colle un rapport hijackthis

pour la mise à jour windows m'a dit qu'il n'y avait rien à updater.
sinon j'ai installé Kério mais ce qui est bizarre c qu'il arrête pas de bloquer qq chose ds le C: fichiers communs /logitech, qui est mon logiciel pr la webcam...elle n'est pas branchée mais par contre qd je la mets elle me plante internet et msn/skype continuent de fonctionner

voilà le rapport de sdfix

SDFix: Version 1.92

Run by Loreleichen on 19/07/2007 at 21:00

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\LORELE~1\Bureau\ANTIVI~1\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service
Restoring Missing SharedAccess Service

Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

Files with Hidden Attributes:

C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\ardancanile49@hotmail.fr\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\basmarie7688@hotmail.fr\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\christophzilz@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\clairoubs@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\diloe2@wanadoo.fr\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\flechette11@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\frenchclem17@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\hushpuppy1997@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\lucile.levesque@laposte.net\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\mathieu_gouard@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\michele.clau@hotmail.fr\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\michele.clau@hotmail.fr\Bodensee\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\michele.clau@hotmail.fr\Concours Terre Sauvage\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\michele.clau@hotmail.fr\Photos de ta fifiiiiiiiiille\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\pfewpfew@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\ptitpierre03@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\sissics@hotmail.fr\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\stefydenis@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\timotheelambert@hotmail.com\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\timotheelambert@hotmail.com\Jardinerie\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\timotheelambert@hotmail.com\Nouveau dossier\Thumbs.db
C:\Documents and Settings\Loreleichen\Local Settings\Application Data\Microsoft\Messenger\laurska@hotmail.com\Sharing Folders\timotheelambert@hotmail.com\Serres\Thumbs.db
C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll
C:\Program Files\Canon\Canon Setup Utility 2.0\uinstrsc.dll
C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe
C:\Program Files\Canon\Canon Setup Utility 2.0\Maint.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\Documents and Settings\Loreleichen\Mes documents\ENIHP4 Landschaftsarchitektur Freising !\Englisch\~WRL2815.tmp

Finished

mon gros souci actuellement c que je pense que ya plus de virus mais le truc c que mon pc s'éteind 2 min après que je l'ai allumé et me dit qu'il vide la mémoire physique...et ça me faisait pas ça avant
en plus internet buge 4 ou 5 fois avant que je puisse m'en servir...je sais pas torp comment faire.
MERCI DAVANCE

cela peut venir du parefeu essaye zone alamr ou jetico apres avoir enlevé kerio (et bien sur desactivé celui de windows dans le centre de secutité situé dans le panneau de configuration

JETICO ou ZONE ALARM (mettre que le parefeu gratuit)
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
zonealarm

non ça ne vient pas du pare feu, je ne l'ai installé que ya qq jours et j'avais ce pb avant
zone alarm je veux pas l'installer, je l'ai fait deux fois et à chaque fois je pouvais plus me servir d'internet alors je l'ai désinstallé....

essaye de reparer windows avec le cd

https://www.pcastuces.com/pratique/windows/xp/default.htm

http://www.informatruc.com/reparer-windows-xp/