Cid et clairvoyant
virginie14
Messages postés
22
Statut
Membre
-
mucho 1 Messages postés 306 Statut Membre -
mucho 1 Messages postés 306 Statut Membre -
Bonjour,
il y a quelques mois je suis arriver ame debarrasser des fenetres cid avec un lien clairvoyant loprever ( je ne suis pas sur de l'orthographe) apres avoir fait x manipulations. et voila que cela recommence mais impossible d'aller sur le lien clairvoyant. merci de m'aider pour me debarrasser de ces fenetres. merci virginie
il y a quelques mois je suis arriver ame debarrasser des fenetres cid avec un lien clairvoyant loprever ( je ne suis pas sur de l'orthographe) apres avoir fait x manipulations. et voila que cela recommence mais impossible d'aller sur le lien clairvoyant. merci de m'aider pour me debarrasser de ces fenetres. merci virginie
A voir également:
- Cid et clairvoyant
- Samy vous donne accès au fichier partagé le cid. que pouvez-vous faire avec ce document en ligne ? ✓ - Forum Réseau
- Avast a détecté JS:Decode-CID[Trj] ✓ - Forum Virus
- Enlever les pub intempestives "CiD" ✓ - Forum Réseaux sociaux
- Speedtest me donne des faux résultats... ✓ - Forum Réseaux sociaux
- Le couplage de donne ✓ - Forum Études / Formation High-Tech
25 réponses
dans VundoFix Backups
puis addmorefiles
c'est le seul fichier texte
C:\windows\system32\ddccbxu.dll
C:\windows\system32\gebyvwx.dll
C:\WINDOWS\system32\tmp3A13.tmp.dll
C:\WINDOWS\system32\tmp3A57.tmp.dll
C:\WINDOWS\tutuvw.dll
C:\WINDOWS\wvutut.ini
puis addmorefiles
c'est le seul fichier texte
C:\windows\system32\ddccbxu.dll
C:\windows\system32\gebyvwx.dll
C:\WINDOWS\system32\tmp3A13.tmp.dll
C:\WINDOWS\system32\tmp3A57.tmp.dll
C:\WINDOWS\tutuvw.dll
C:\WINDOWS\wvutut.ini
j'n ai trouver un autre
VundoFix V6.5.11
Checking Java version...
Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.
Scan started at 23:56:03 28/10/2007
Listing files found while scanning....
C:\windows\system32\ddccbxu.dll
C:\windows\system32\gebyvwx.dll
C:\WINDOWS\system32\tmp3A13.tmp.dll
C:\WINDOWS\system32\tmp3A57.tmp.dll
C:\WINDOWS\tutuvw.dll
C:\WINDOWS\wvutut.ini
Beginning removal...
Attempting to delete C:\windows\system32\ddccbxu.dll
C:\windows\system32\ddccbxu.dll Has been deleted!
Attempting to delete C:\windows\system32\gebyvwx.dll
C:\windows\system32\gebyvwx.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\tmp3A13.tmp.dll
C:\WINDOWS\system32\tmp3A13.tmp.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\tmp3A57.tmp.dll
C:\WINDOWS\system32\tmp3A57.tmp.dll Has been deleted!
Attempting to delete C:\WINDOWS\tutuvw.dll
C:\WINDOWS\tutuvw.dll Has been deleted!
Attempting to delete C:\WINDOWS\wvutut.ini
C:\WINDOWS\wvutut.ini Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.11
Checking Java version...
Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.
Scan started at 23:56:03 28/10/2007
Listing files found while scanning....
C:\windows\system32\ddccbxu.dll
C:\windows\system32\gebyvwx.dll
C:\WINDOWS\system32\tmp3A13.tmp.dll
C:\WINDOWS\system32\tmp3A57.tmp.dll
C:\WINDOWS\tutuvw.dll
C:\WINDOWS\wvutut.ini
Beginning removal...
Attempting to delete C:\windows\system32\ddccbxu.dll
C:\windows\system32\ddccbxu.dll Has been deleted!
Attempting to delete C:\windows\system32\gebyvwx.dll
C:\windows\system32\gebyvwx.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\tmp3A13.tmp.dll
C:\WINDOWS\system32\tmp3A13.tmp.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\tmp3A57.tmp.dll
C:\WINDOWS\system32\tmp3A57.tmp.dll Has been deleted!
Attempting to delete C:\WINDOWS\tutuvw.dll
C:\WINDOWS\tutuvw.dll Has been deleted!
Attempting to delete C:\WINDOWS\wvutut.ini
C:\WINDOWS\wvutut.ini Has been deleted!
Performing Repairs to the registry.
Done!
maintenant Télécharge Combofix (par sUBs) sur ton Bureau.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.
Le rapport se trouve ici : C:\Combofix.txt
@+
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.
Le rapport se trouve ici : C:\Combofix.txt
@+
me revoilou et apres ca je crois que je vais aller me coucher , demain il faut aller bosser, merci pour tout je reste en ligne encore un petit peu
ComboFix 07-10-28.2 - Virginie 2007-10-29 0:40:31.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.425 [GMT 1:00]
Running from: C:\Documents and Settings\Virginie\Bureau\ComboFix.exe
* Created a new restore point
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\DOCUME~1\Virginie\APPLIC~1\macromedia\Flash Player\#SharedObjects\HVCDARNK\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\DOCUME~1\Virginie\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\DOCUME~1\Virginie\APPLIC~1\tmp1A.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp1D.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39C6.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39C7.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39CF.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39D0.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39DD.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39E1.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39EF.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A06.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A10.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A11.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A28.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A38.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A39.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A41.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A4A.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A4B.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A57.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3AD5.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3AD6.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp6.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp7.tmp.exe
C:\Documents and Settings\Virginie\Application Data\macromedia\Flash Player\#SharedObjects\HVCDARNK\iforex.com
C:\Documents and Settings\Virginie\Application Data\macromedia\Flash Player\#SharedObjects\HVCDARNK\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Virginie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Virginie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\Virginie\Application Data\tmp1A.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp1D.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39C6.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39C7.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39CF.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39D0.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39DD.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39E1.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39EF.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A06.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A10.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A11.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A28.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A38.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A39.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A41.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A4A.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A4B.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A57.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3AD5.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3AD6.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp6.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp7.tmp.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\dialerexe.ini
C:\WINDOWS\system32\gebyvwx.dll
C:\WINDOWS\system32\linkprd.exe
C:\WINDOWS\system32\nvrssk.dll
C:\WINDOWS\system32\nvrssl.dll
C:\WINDOWS\system32\tmp1E.tmp.dll
C:\WINDOWS\system32\tmp39C8.tmp.dll
C:\WINDOWS\system32\tmp39D1.tmp.dll
C:\WINDOWS\system32\tmp3A09.tmp.dll
C:\WINDOWS\system32\tmp3A28.tmp.dll
C:\WINDOWS\system32\tmp3A41.tmp.dll
C:\WINDOWS\system32\tmp8.tmp.dll
C:\WINDOWS\system32\winspool.dll
C:\WINDOWS\wr.txt
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
((((((((((((((((((((((((((((( Fichiers créés 2007-09-28 to 2007-10-28 ))))))))))))))))))))))))))))))))))))
.
2007-10-29 00:37 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-28 23:56 <REP> d-------- C:\VundoFix Backups
2007-10-28 08:47 <REP> d-------- C:\Program Files\Navilog1
2007-10-27 22:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-10-08 05:54 <REP> d-------- C:\Program Files\Peak Settings Bash
2007-10-07 20:49 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-07 12:49 26,238 --a------ C:\WINDOWS\JPGimage95.zip
2007-10-07 12:49 26,238 --a------ C:\WINDOWS\JPGimage80.zip
2007-10-07 12:49 26,232 --a------ C:\WINDOWS\files52.zip
2007-10-07 12:49 26,232 --a------ C:\WINDOWS\files28.zip
2007-10-07 12:49 26,230 --a------ C:\WINDOWS\look96.zip
2007-10-07 12:49 26,230 --a------ C:\WINDOWS\file19.zip
2007-10-07 12:48 26,238 --a------ C:\WINDOWS\JPGimage86.zip
2007-10-07 12:48 26,238 --a------ C:\WINDOWS\JPGimage77.zip
2007-10-07 12:48 26,238 --a------ C:\WINDOWS\JPGimage47.zip
2007-10-07 12:48 26,238 --a------ C:\WINDOWS\JPGimage29.zip
2007-10-07 12:48 26,230 --a------ C:\WINDOWS\news98.zip
2007-10-07 12:48 26,230 --a------ C:\WINDOWS\news65.zip
2007-10-07 12:48 26,230 --a------ C:\WINDOWS\file58.zip
2007-10-07 12:48 26,228 --a------ C:\WINDOWS\news8.zip
2007-10-07 12:47 26,240 --a------ C:\WINDOWS\downloadme0.zip
2007-10-07 12:47 26,230 --a------ C:\WINDOWS\look66.zip
2007-10-07 12:47 26,112 --a------ C:\WINDOWS\system32\directfxd.exe
2007-10-02 18:05 131,500 --a------ C:\WINDOWS\efcbxy.dll
2007-10-01 20:00 131,441 --a------ C:\WINDOWS\bywtur.dll
2007-10-01 16:20 131,441 --a------ C:\WINDOWS\jkkjji.dll
2007-10-01 15:57 131,441 --a------ C:\WINDOWS\urrsqn.dll
2007-10-01 05:21 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\axis wait the bone
2007-09-29 16:12 <REP> d-------- C:\Program Files\RamBoost XP
2007-09-29 15:43 <REP> d-------- C:\WINDOWS\system32\NtmsData
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-28 18:37 --------- d-----w C:\Program Files\Steam
2007-10-28 09:13 --------- d-----w C:\Program Files\eMule
2007-10-28 07:23 --------- d-----w C:\Program Files\Trend Micro
2007-10-27 13:44 10,752 ----a-w C:\WINDOWS\DCEBoot.exe
2007-10-08 04:55 --------- d-----w C:\Documents and Settings\Virginie\Application Data\Peak Settings Bash
2007-10-08 04:55 --------- d-----w C:\DOCUME~1\Virginie\APPLIC~1\Peak Settings Bash
2007-10-06 08:10 --------- d-----w C:\Documents and Settings\manu\Application Data\Peak Settings Bash
2007-10-05 15:13 --------- d-----w C:\Documents and Settings\simon\Application Data\Peak Settings Bash
2007-10-05 15:13 --------- d-----w C:\Documents and Settings\maeva\Application Data\Peak Settings Bash
2007-10-05 15:12 --------- d-----w C:\Documents and Settings\maeva\Application Data\Meal Keep Up
2007-10-01 04:24 --------- d-----w C:\Documents and Settings\simon\Application Data\Meal Keep Up
2007-09-20 10:14 131,452 ----a-w C:\WINDOWS\ssqopq.dll
2007-09-14 15:38 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2007-05-18 04:14 8,536 -c-h--w C:\Documents and Settings\maeva\hpothb07.dat
2007-04-17 06:34 327 -c-ha-w C:\Documents and Settings\Virginie\hpothb07.dat
2007-04-17 05:24 3,563 ---ha-w C:\Program Files\hpothb07.tif
2007-04-17 05:24 1,066 ---ha-w C:\Program Files\hpothb07.dat
2007-02-21 21:53 133,856 ----a-w C:\Documents and Settings\Virginie\Application Data\GDIPFONTCACHEV1.DAT
2007-02-21 21:53 133,856 ----a-w C:\DOCUME~1\Virginie\APPLIC~1\GDIPFONTCACHEV1.DAT
2006-02-16 08:39 133,464 ------w C:\Documents and Settings\manu\Application Data\GDIPFONTCACHEV1.DAT
2005-12-15 07:34 0 -c--a-w C:\Program Files\temp3.exe.txt
2005-12-15 07:34 0 -c--a-w C:\Program Files\temp2.exe.txt
2005-12-15 07:34 0 -c--a-w C:\Program Files\temp1.exe.txt
2005-11-19 13:39 114,160 -c----w C:\Documents and Settings\maeva\Application Data\GDIPFONTCACHEV1.DAT
2005-08-06 20:31 4,577,316 ----a-w C:\Program Files\eMule0.46c-Installer.exe
2005-04-12 21:33 486 -c--a-w C:\Program Files\Netlor StudioStyleView.sps
2005-03-23 06:46 16,384 -c--a-w C:\Program Files\try.wps
2005-03-04 21:33 793 ----a-w C:\Program Files\Netlor Studiopreview.html
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0453ed44-5298-4918-9301-0b109c04a3d5}]
C:\WINDOWS\system32\lfplnr.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA312E65-4B90-38A5-598C-401DE2D39FD0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-19 16:21]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-09-13 10:51]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 02:06]
"nwiz"="nwiz.exe" [2005-12-10 02:06 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 02:06]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-03-08 00:34]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 17:38]
"size option"="C:\DOCUME~1\Virginie\APPLIC~1\PEAKSE~1\BoobAmen.exe" [2007-10-08 05:54]
"RamBoostXp"="C:\Program Files\RamBoost XP\rambxpfr.exe" [2004-03-09 21:48]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\CMD13n]
CMD13n.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\comntz]
comntz.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\conree]
conree.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\evenl32]
evenl32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fsusGen]
fsusGen.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\immota]
immota.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jgawial]
jgawial.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lfplnr]
lfplnr.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MFClm5]
MFClm5.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msadp32]
msadp32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msfs11]
msfs11.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\chic jugs once ace]
C:\Documents and Settings\All Users\Application Data\flagviewchicjugs\bin program.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\size option]
C:\DOCUME~1\Virginie\APPLIC~1\PEAKSE~1\BoobAmen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\the bone download 1]
C:\Documents and Settings\All Users\Application Data\axis wait the bone\Active info.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"CCALib8"=2 (0x2)
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys
R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys
R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S3 gkmixern;gkmixern;\??\C:\DOCUME~1\simon\LOCALS~1\Temp\gkmixern.sys
S3 USTOR;U-Storage Controller;C:\WINDOWS\system32\DRIVERS\UStork.sys
S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys
.
**************************************************************************
catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-29 00:52:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2007-10-29 0:58:02 - machine was rebooted
.
--- E O F ---
ComboFix 07-10-28.2 - Virginie 2007-10-29 0:40:31.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.425 [GMT 1:00]
Running from: C:\Documents and Settings\Virginie\Bureau\ComboFix.exe
* Created a new restore point
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\DOCUME~1\Virginie\APPLIC~1\macromedia\Flash Player\#SharedObjects\HVCDARNK\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\DOCUME~1\Virginie\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\DOCUME~1\Virginie\APPLIC~1\tmp1A.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp1D.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39C6.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39C7.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39CF.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39D0.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39DD.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39E1.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp39EF.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A06.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A10.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A11.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A28.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A38.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A39.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A41.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A4A.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A4B.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3A57.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3AD5.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp3AD6.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp6.tmp.exe
C:\DOCUME~1\Virginie\APPLIC~1\tmp7.tmp.exe
C:\Documents and Settings\Virginie\Application Data\macromedia\Flash Player\#SharedObjects\HVCDARNK\iforex.com
C:\Documents and Settings\Virginie\Application Data\macromedia\Flash Player\#SharedObjects\HVCDARNK\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Virginie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Virginie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\Virginie\Application Data\tmp1A.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp1D.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39C6.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39C7.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39CF.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39D0.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39DD.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39E1.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp39EF.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A06.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A10.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A11.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A28.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A38.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A39.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A41.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A4A.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A4B.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3A57.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3AD5.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp3AD6.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp6.tmp.exe
C:\Documents and Settings\Virginie\Application Data\tmp7.tmp.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\dialerexe.ini
C:\WINDOWS\system32\gebyvwx.dll
C:\WINDOWS\system32\linkprd.exe
C:\WINDOWS\system32\nvrssk.dll
C:\WINDOWS\system32\nvrssl.dll
C:\WINDOWS\system32\tmp1E.tmp.dll
C:\WINDOWS\system32\tmp39C8.tmp.dll
C:\WINDOWS\system32\tmp39D1.tmp.dll
C:\WINDOWS\system32\tmp3A09.tmp.dll
C:\WINDOWS\system32\tmp3A28.tmp.dll
C:\WINDOWS\system32\tmp3A41.tmp.dll
C:\WINDOWS\system32\tmp8.tmp.dll
C:\WINDOWS\system32\winspool.dll
C:\WINDOWS\wr.txt
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
((((((((((((((((((((((((((((( Fichiers créés 2007-09-28 to 2007-10-28 ))))))))))))))))))))))))))))))))))))
.
2007-10-29 00:37 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-28 23:56 <REP> d-------- C:\VundoFix Backups
2007-10-28 08:47 <REP> d-------- C:\Program Files\Navilog1
2007-10-27 22:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-10-08 05:54 <REP> d-------- C:\Program Files\Peak Settings Bash
2007-10-07 20:49 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-07 12:49 26,238 --a------ C:\WINDOWS\JPGimage95.zip
2007-10-07 12:49 26,238 --a------ C:\WINDOWS\JPGimage80.zip
2007-10-07 12:49 26,232 --a------ C:\WINDOWS\files52.zip
2007-10-07 12:49 26,232 --a------ C:\WINDOWS\files28.zip
2007-10-07 12:49 26,230 --a------ C:\WINDOWS\look96.zip
2007-10-07 12:49 26,230 --a------ C:\WINDOWS\file19.zip
2007-10-07 12:48 26,238 --a------ C:\WINDOWS\JPGimage86.zip
2007-10-07 12:48 26,238 --a------ C:\WINDOWS\JPGimage77.zip
2007-10-07 12:48 26,238 --a------ C:\WINDOWS\JPGimage47.zip
2007-10-07 12:48 26,238 --a------ C:\WINDOWS\JPGimage29.zip
2007-10-07 12:48 26,230 --a------ C:\WINDOWS\news98.zip
2007-10-07 12:48 26,230 --a------ C:\WINDOWS\news65.zip
2007-10-07 12:48 26,230 --a------ C:\WINDOWS\file58.zip
2007-10-07 12:48 26,228 --a------ C:\WINDOWS\news8.zip
2007-10-07 12:47 26,240 --a------ C:\WINDOWS\downloadme0.zip
2007-10-07 12:47 26,230 --a------ C:\WINDOWS\look66.zip
2007-10-07 12:47 26,112 --a------ C:\WINDOWS\system32\directfxd.exe
2007-10-02 18:05 131,500 --a------ C:\WINDOWS\efcbxy.dll
2007-10-01 20:00 131,441 --a------ C:\WINDOWS\bywtur.dll
2007-10-01 16:20 131,441 --a------ C:\WINDOWS\jkkjji.dll
2007-10-01 15:57 131,441 --a------ C:\WINDOWS\urrsqn.dll
2007-10-01 05:21 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\axis wait the bone
2007-09-29 16:12 <REP> d-------- C:\Program Files\RamBoost XP
2007-09-29 15:43 <REP> d-------- C:\WINDOWS\system32\NtmsData
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-28 18:37 --------- d-----w C:\Program Files\Steam
2007-10-28 09:13 --------- d-----w C:\Program Files\eMule
2007-10-28 07:23 --------- d-----w C:\Program Files\Trend Micro
2007-10-27 13:44 10,752 ----a-w C:\WINDOWS\DCEBoot.exe
2007-10-08 04:55 --------- d-----w C:\Documents and Settings\Virginie\Application Data\Peak Settings Bash
2007-10-08 04:55 --------- d-----w C:\DOCUME~1\Virginie\APPLIC~1\Peak Settings Bash
2007-10-06 08:10 --------- d-----w C:\Documents and Settings\manu\Application Data\Peak Settings Bash
2007-10-05 15:13 --------- d-----w C:\Documents and Settings\simon\Application Data\Peak Settings Bash
2007-10-05 15:13 --------- d-----w C:\Documents and Settings\maeva\Application Data\Peak Settings Bash
2007-10-05 15:12 --------- d-----w C:\Documents and Settings\maeva\Application Data\Meal Keep Up
2007-10-01 04:24 --------- d-----w C:\Documents and Settings\simon\Application Data\Meal Keep Up
2007-09-20 10:14 131,452 ----a-w C:\WINDOWS\ssqopq.dll
2007-09-14 15:38 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2007-05-18 04:14 8,536 -c-h--w C:\Documents and Settings\maeva\hpothb07.dat
2007-04-17 06:34 327 -c-ha-w C:\Documents and Settings\Virginie\hpothb07.dat
2007-04-17 05:24 3,563 ---ha-w C:\Program Files\hpothb07.tif
2007-04-17 05:24 1,066 ---ha-w C:\Program Files\hpothb07.dat
2007-02-21 21:53 133,856 ----a-w C:\Documents and Settings\Virginie\Application Data\GDIPFONTCACHEV1.DAT
2007-02-21 21:53 133,856 ----a-w C:\DOCUME~1\Virginie\APPLIC~1\GDIPFONTCACHEV1.DAT
2006-02-16 08:39 133,464 ------w C:\Documents and Settings\manu\Application Data\GDIPFONTCACHEV1.DAT
2005-12-15 07:34 0 -c--a-w C:\Program Files\temp3.exe.txt
2005-12-15 07:34 0 -c--a-w C:\Program Files\temp2.exe.txt
2005-12-15 07:34 0 -c--a-w C:\Program Files\temp1.exe.txt
2005-11-19 13:39 114,160 -c----w C:\Documents and Settings\maeva\Application Data\GDIPFONTCACHEV1.DAT
2005-08-06 20:31 4,577,316 ----a-w C:\Program Files\eMule0.46c-Installer.exe
2005-04-12 21:33 486 -c--a-w C:\Program Files\Netlor StudioStyleView.sps
2005-03-23 06:46 16,384 -c--a-w C:\Program Files\try.wps
2005-03-04 21:33 793 ----a-w C:\Program Files\Netlor Studiopreview.html
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0453ed44-5298-4918-9301-0b109c04a3d5}]
C:\WINDOWS\system32\lfplnr.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA312E65-4B90-38A5-598C-401DE2D39FD0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-19 16:21]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2004-09-13 10:51]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 02:06]
"nwiz"="nwiz.exe" [2005-12-10 02:06 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 02:06]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-03-08 00:34]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 17:38]
"size option"="C:\DOCUME~1\Virginie\APPLIC~1\PEAKSE~1\BoobAmen.exe" [2007-10-08 05:54]
"RamBoostXp"="C:\Program Files\RamBoost XP\rambxpfr.exe" [2004-03-09 21:48]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\CMD13n]
CMD13n.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\comntz]
comntz.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\conree]
conree.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\evenl32]
evenl32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fsusGen]
fsusGen.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\immota]
immota.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jgawial]
jgawial.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lfplnr]
lfplnr.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MFClm5]
MFClm5.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msadp32]
msadp32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msfs11]
msfs11.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\chic jugs once ace]
C:\Documents and Settings\All Users\Application Data\flagviewchicjugs\bin program.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\size option]
C:\DOCUME~1\Virginie\APPLIC~1\PEAKSE~1\BoobAmen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\the bone download 1]
C:\Documents and Settings\All Users\Application Data\axis wait the bone\Active info.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"CCALib8"=2 (0x2)
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys
R3 BENDER;Pinnacle AV/DV2 Capture;C:\WINDOWS\system32\drivers\bender.sys
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys
R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S3 gkmixern;gkmixern;\??\C:\DOCUME~1\simon\LOCALS~1\Temp\gkmixern.sys
S3 USTOR;U-Storage Controller;C:\WINDOWS\system32\DRIVERS\UStork.sys
S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys
.
**************************************************************************
catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-29 00:52:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2007-10-29 0:58:02 - machine was rebooted
.
--- E O F ---
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
tu es infecté de partout
Téléchargez MSNFix.zip (de !aur3n7) sur votre bureau:
http://sosvirus.changelog.fr/MSNFix.zip
Décompresse-le sur ton bureau (Clique-Droit/Extraire tout).
Ouvre le dossier MSNFix puis double-clique sur MSNFix.bat.
- Exécutez l'option R.
-- Si tu est infecté tu aura un message qui te l'indiquera et il suffira de presser une touche pour lancer le nettoyage
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations.
Dans ce cas il suffit de redémarrer l'ordinateur manuellement.
Poste le rapport situé dans le dossier MSNFix.
Le nom du rapport correspond au moment de sa création : date_heure.log
Téléchargez MSNFix.zip (de !aur3n7) sur votre bureau:
http://sosvirus.changelog.fr/MSNFix.zip
Décompresse-le sur ton bureau (Clique-Droit/Extraire tout).
Ouvre le dossier MSNFix puis double-clique sur MSNFix.bat.
- Exécutez l'option R.
-- Si tu est infecté tu aura un message qui te l'indiquera et il suffira de presser une touche pour lancer le nettoyage
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations.
Dans ce cas il suffit de redémarrer l'ordinateur manuellement.
Poste le rapport situé dans le dossier MSNFix.
Le nom du rapport correspond au moment de sa création : date_heure.log
