Trojan (aidez- moi svp) - Page 2

Précédent
  • 1
  • 2
  1. philae83 Messages postés 12854 Statut Contributeur sécurité 206
     
    le rapport que tu m'as mis c'est l'ancien, j'ai pas la dernière partie de maintenant

    reposte la totalité du rapport de vundofix stp

    0
    1. Arnaud
       
      He bien c'est celui la ... bizarre

      Tu sais koi je le supprime dasn c:/

      Et je refais l'etape avec la suppression des trois que tu ma donné
      0
  2. philae83 Messages postés 12854 Statut Contributeur sécurité 206
     
    oui c'est mieux ainsi, je préfère vérifier

    merci
    0
  3. Arnaud
     
    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\beikpkyg.dll
    C:\WINDOWS\system32\beikpkyg.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mljgg.dll
    C:\WINDOWS\system32\mljgg.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\opnkkih.dll
    C:\WINDOWS\system32\opnkkih.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\mljgg.dll
    C:\WINDOWS\system32\mljgg.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\opnkkih.dll
    C:\WINDOWS\system32\opnkkih.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!
    0
  4. philae83 Messages postés 12854 Statut Contributeur sécurité 206
     
    ok, bon il en reste 2 encore....

    reposte un nouveau rapport hijackthis stp
    0
    1. Arnaud
       
      Et bien et bien tu crois k'on y arrivera cette nuit ? ^^

      Logfile of HijackThis v1.99.1
      Scan saved at 23:28:00, on 13/09/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16512)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\WINDOWS\system32\hkcmd.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\WINDOWS\sm56hlpr.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
      C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
      C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
      C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
      C:\Program Files\F-Secure\FSGUI\fsguidll.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
      C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Program Files\MSN Messenger\usnsvc.exe
      C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/webhp?gws_rd=ssl
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
      O2 - BHO: (no name) - {890CFBF0-10D5-43D3-ABFD-206F7C4A2699} - C:\WINDOWS\system32\opnkkih.dll
      O2 - BHO: (no name) - {F58BE427-D142-4560-A4C2-A65E01D9851D} - C:\WINDOWS\system32\mljgg.dll
      O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
      O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
      O4 - HKLM\..\Run: [\\DOMINIQUE\EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P38 "\\DOMINIQUE\EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
      O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
      O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll
      O20 - Winlogon Notify: opnkkih - C:\WINDOWS\SYSTEM32\opnkkih.dll
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
      O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. philae83 Messages postés 12854 Statut Contributeur sécurité 206
     
    je ne suis sûre de rien, mais on devrait y arriver tout de même si ce n'est cette nuit, ce sera demain soir :)

    * Télécharge combofix.exe (par sUBs) sur ton Bureau
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    * Double clique combofix.exe.

    * Tape sur la touche Y (Yes) pour démarrer le scan.

    * Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse

    NOTE : Le rapport se trouve également ici : C:\Combofix.txt

    ainsi qu'un nouveau rapport hijackthis stp
    0
    1. Arnaud
       
      ComboFix 07-09-13.3 - "Arnaud" 2007-09-13 23:33:36.1 - NTFSx86
      Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.450 [GMT 2:00]
      * Created a new restore point
      .

      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\WINDOWS\cookies.ini
      C:\WINDOWS\system32\aenboqxn.ini
      C:\WINDOWS\system32\ggjlm.bak1
      C:\WINDOWS\system32\ggjlm.bak2
      C:\WINDOWS\system32\ggjlm.ini
      C:\WINDOWS\system32\mljgg.dll
      C:\WINDOWS\system32\nxqobnea.dll
      C:\WINDOWS\system32\opnkkih.dll
      C:\WINDOWS\system32\rqstv.bak1
      C:\WINDOWS\system32\rqstv.bak2
      C:\WINDOWS\system32\rqstv.ini

      .
      ((((((((((((((((((((((((( Files Created from 2007-08-13 to 2007-09-13 )))))))))))))))))))))))))))))))
      .

      2007-09-13 23:31 51,200 --a------ C:\WINDOWS\NirCmd.exe
      2007-09-13 19:22 <REP> d-------- C:\VundoFix Backups
      2007-09-12 21:25 <REP> d-------- C:\WINDOWS\ERUNT
      2007-09-11 22:06 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
      2007-09-11 21:28 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
      2007-09-07 19:53 <REP> d-------- C:\Program Files\EPSON
      2007-09-05 15:40 <REP> d-------- C:\Program Files\DivX
      2007-08-22 22:11 <REP> d-------- C:\Program Files\Photofltre
      2007-08-16 22:00 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
      2007-08-16 22:00 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
      2007-08-16 15:37 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
      2007-08-15 17:54 756,736 --------- C:\WINDOWS\system32\ir41_32.dll

      .
      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2007-08-27 20:54 --------- d--h----- C:\Program Files\InstallShield Installation Information
      2007-08-20 18:04 --------- d-------- C:\Program Files\Call of Duty
      2007-08-16 21:43 --------- d-------- C:\Program Files\Sony Ericsson
      2007-08-15 17:53 --------- d-------- C:\Program Files\Microsoft Games
      2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
      2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
      2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
      2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
      2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
      2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
      2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
      2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
      2007-07-29 11:33 126016 --a------ C:\WINDOWS\system32\amienxuk.dll
      2007-07-25 20:57 --------- d-------- C:\Program Files\MSXML 4.0
      2007-07-23 16:01 --------- d-------- C:\Program Files\EA GAMES
      2007-07-20 00:57 267112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
      2007-07-20 00:54 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
      2007-07-19 18:14 444776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
      2007-07-19 18:14 3727720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
      2007-07-19 18:14 1358192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
      2007-07-16 00:02 --------- d-------- C:\Program Files\Wolfenstein - Enemy Territory
      2007-06-26 08:09 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
      2007-06-20 20:46 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
      2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll
      2007-06-13 15:22 1037312 --a------ C:\WINDOWS\explorer.exe
      --------- C:\Program Files\Hijackthis Version Française
      .

      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
      .

      *Note* empty entries & legit default entries are not shown

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-07-19 11:06]
      "Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 17:07 C:\WINDOWS\system32\HdAShCut.exe]
      "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-04-15 08:48]
      "SoundMan"="SOUNDMAN.EXE" [2005-09-21 10:24 C:\WINDOWS\SoundMan.exe]
      "AlcWzrd"="ALCWZRD.EXE" [2005-09-21 15:32 C:\WINDOWS\alcwzrd.exe]
      "SMSERIAL"="sm56hlpr.exe" [2005-08-12 11:09 C:\WINDOWS\sm56hlpr.exe]
      "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-06-03 00:37]
      "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 10:57]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
      "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
      "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-04-27 11:25]
      "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
      "\\DOMINIQUE\EPSON Stylus DX3800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.exe" [2005-02-08 06:00]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09]
      "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2006-04-21 17:03]

      C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
      Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-08-16 21:58:30]
      F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2007-06-05 21:45:52]

      R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys
      R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      R2 F-Secure Filter;F-Secure File System Filter;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys
      R2 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys
      R2 F-Secure Recognizer;F-Secure File System Recognizer;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys


      [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{969B3B70-8765-11D5-9809-0050BACBF861}]
      rundll32.exe advpack.dll,LaunchINFSection C:\Program Files\CyberLink\MP3PowerEncoder\Cyber.inf,PerUserStub
      .
      **************************************************************************

      catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2007-09-13 23:40:10
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "\\\\DOMINIQUE\\EPSON Stylus DX3800 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIACE.EXE /P38 \"\\\\DOMINIQUE\\EPSON Stylus DX3800 Series\" /O6 \"USB001\" /M \"Stylus DX3800\""
      .
      Completion time: 2007-09-13 23:42:19 - machine was rebooted
      C:\ComboFix-quarantined-files.txt ... 2007-09-13 23:42
      .
      --- E O F ---









      ET hijackthis


      Logfile of HijackThis v1.99.1
      Scan saved at 23:45:16, on 13/09/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16512)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
      C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\WINDOWS\system32\hkcmd.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\WINDOWS\sm56hlpr.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
      C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
      C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
      C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
      C:\Program Files\F-Secure\FSGUI\fsguidll.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
      C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
      C:\WINDOWS\system32\notepad.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/webhp?gws_rd=ssl
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
      O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
      O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
      O4 - HKLM\..\Run: [\\DOMINIQUE\EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P38 "\\DOMINIQUE\EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
      O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
      O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
      O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
      O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      0
  8. philae83 Messages postés 12854 Statut Contributeur sécurité 206
     
    oui effectivement il l'est, mais bon dans la mesure du possible j'évite d'utiliser combofix sans raison valable.

    bon maintenant où en es tu de tes problèmes ? ton pc respire t il mieux ?
    0
    1. Arnaud
       
      Heu ben on véra si pas d'alerte tant mieux et si pas de page publicitaires tant mieux aussi :D

      Alors c'est fini ?

      Ben si c'est le cas je sais pas quoi dire je vous remercie toi et raleuboleu

      C'est vraiment gentil de votre part d'aider des gars comme moi
      0
  9. philae83 Messages postés 12854 Statut Contributeur sécurité 206
     
    ok, c'est parfait, mais si tu pouvais faire ou refaire je sais plus si cela a été fait et j'ai pas pris le tps de vérifier, je suis crevée, et je vais "dodo", un scan antivirus en ligne, tu posteras le rapport ici ensuite

    bonne fin de soirée
    et pour moi bonne nuit

    * Fait un scan antivirus en ligne ICI
    https://www.bitdefender.fr/
    et copie colle le résultat ici
    * En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
    * Dans la nouvelle fenêtre, clique sur I agree
    * La fenêtre change encore, clique sur Click here to scan
    * Les signatures se chargent, etc.

    tuto en image

    http://pageperso.aol.fr/rginformatique/mapage/defender.htm

    0
    1. Arnaud
       
      Je ferais le scan ce soir, ... Comment on fais pour enlever combofix de son pc
      0
  10. philae83 Messages postés 12854 Statut Contributeur sécurité 206
     
    bonsoir,

    Télécharge OTMoveIt (de Old_Timer) sur ton Bureau.
    http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

    * Lance OTmoveIT en double cliquant dessus
    * Clique sur CleanUp! (le programme va télécharger un fichier texte qui servira a nettoyer les programmes que l'on a téléchargé).
    NOTE : Normalement, ton firewall (parefeu) devrait te demander si OTmoveIT peut accéder a internet, Autorise le.
    * Une liste apparait dans la partie gauche d'OTmoveIT.
    * Un message apparait pour confirmer le nettoyage. Confirme.
    0
Précédent
  • 1
  • 2

Discussions similaires

Aide pour un virus
cerise92700 -
MisteryBean -

41 réponses
Trojan impossible à supprimer!
Gridouu -
Malekal_morte- -

12 réponses
Comment supprimer le virus Trojan
vitsou -
vitsou -

18 réponses
Menace détectée TrojanSMS-PA sur Google Huawei/Android
Outmost -
bazfile -

6 réponses
Que pensez-vous de Trojan Remover ?
patmoss -
DOUBLON -

10 réponses