Sujet Précédent Sujet Suivant

Msn photos pas droles!

Kafey -  
ep44 Messages postés 7432 Statut Contributeur -
Bonjour,
J'ai cette saleté de virus MSN qui propose de telecharger des photos, mais ca devient tres handicapant : il suffit que je me mette en ligne pour qu'il envoie a tous mes contacts des telechargement, et que MSN se bloque... pas drole -_-

Voila mon rapport sur Msn fix :

MSNFix 1.596

C:\Documents and Settings\****\Bureau\Msn fix
Fix exécuté le 30/11/2007 - 21:51:34,34 By ****
mode normal

************************ Recherche les fichiers présents

... C:\DOCUME~1\*****\LOCALS~1\Temp\removalfile.bat

************************ MSNCHK ***** /!\ beta test /!\

************************ Recherche les dossiers présents

Aucun dossier trouvé

************************ Suppression des fichiers

.. OK ... C:\DOCUME~1\****\LOCALS~1\Temp\removalfile.bat

************************ Nettoyage du registre

************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[C:\mj_40en.exe] B3AA9D007AF776C43B71866DB6C1E7AA

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier [b] C:\DOCUME~1\****\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 30112007_21522446.zip

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

Et voici mon rapport hijack :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:56:11, on 30/11/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\INVISI~1\invtray.exe
C:\WINDOWS\RaUI.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\wncmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [Windows Zero Driver] wncmgr.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Invisible Secrets 4] C:\PROGRA~1\INVISI~1\invtray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: 1.txt
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\WINDOWS\RaUI.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: yayxwxy - C:\WINDOWS\SYSTEM32\yayxwxy.dll
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
A voir également:

25 réponses

  • 1
  • 2
Réponse 1 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
Bonsoir

Télécharge sur le Bureau.
http://www.atribune.org/ccount/click.php?id=4

=> Double-clic VundoFix.exe.
=> Clic OK
=> Attendre le redemarrage de Vundofix
=> Clic Scan for Vundo
=> Le scan est assez long , à la fin
=> Clic Remove Vundo
=> Puis yes
=> Le Bureau disparaît un moment lors de la suppression des fichiers.
=> Message shutdown
=> clic OK
=> Redémarrage auto
=> copier le rapport qui est dans C:vundofix.txt

Télécharge sur le bureau
[url=http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe]virtumundoBeGone[/url]

=> Double clic sur VirtumundoBeGone.exe
=> Clic Continue ==> clic Start
=> Clic Oui
=> A la fin si Vundo est présent , le PC s’éteint et redémarre
- Si Ecran bleu et message : Erreur fatale .. pas de problème
=> Poster le rapport VBG.TXT qui est sur le bureau
@+
0
Réponse 2 / 25
Kafey
 
J'ai fais la recherche de Vundo, et apparemment, il n'est pas sur mon ordi.
Je pense que c'est un autre virus : il se transmet pas msn, sous la forme d'un fichier telechargeable "uploadme.zip"
Voila, j'espere que tu pourras m'aider quand meme.
(j'ai utilisé ccleaner, et Symantec antivirus, et il ne trouve rien).

HELP ;(
0
Réponse 3 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
J'ai fais la recherche de Vundo, et apparemment, il n'est pas sur mon ordi.

as tu fait le scan avec vundofix??
si oui et qu'il n'a rien trouvé il quand même poster le rapport
pour savoir ou on va
@+
0
Réponse 4 / 25
Kafey
 
Oui oui, j'ai bien fait le scan, mais non non, je n'ai eu le droit a aucun rapport:
D'apres lui je n'ai pas Vundo, et meme si je clique sur Remove vundo, il me met qu'il n'est pas present sur l'ordi, et il me previent que Vundofix va etre fermé.
Je suis en train de scanner le fichier "upload_me.zip" sur Virutotal...
As tu d'autres trucs a me proposer ?
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 25
Kafey
 
J'ai refais un scan, voila le rapport :

VundoFix V6.6.2

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 13:07:22 01/12/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...

VundoFix V6.6.2

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Scan started at 14:15:16 01/12/2007

Listing files found while scanning....

Et voila le second rapport :

[12/01/2007, 14:18:15] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Ouissem\Bureau\VirtumundoBeGone.exe" )
[12/01/2007, 14:18:20] - Detected System Information:
[12/01/2007, 14:18:20] - Windows Version: 5.1.2600, Service Pack 1
[12/01/2007, 14:18:20] - Current Username: Ouissem (Admin)
[12/01/2007, 14:18:20] - Windows is in NORMAL mode.
[12/01/2007, 14:18:20] - Searching for Browser Helper Objects:
[12/01/2007, 14:18:20] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[12/01/2007, 14:18:20] - BHO 2: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)
[12/01/2007, 14:18:20] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/01/2007, 14:18:20] - BHO 4: {8E3FBDE2-7DBD-4040-85D9-29BBC559C129} ()
[12/01/2007, 14:18:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/01/2007, 14:18:20] - Checking for HKLM\...\Winlogon\Notify\yayxwxy
[12/01/2007, 14:18:20] - Found: HKLM\...\Winlogon\Notify\yayxwxy - This is probably Virtumundo.
[12/01/2007, 14:18:20] - Assigning {8E3FBDE2-7DBD-4040-85D9-29BBC559C129} MSEvents Object
[12/01/2007, 14:18:20] - BHO list has been changed! Starting over...
[12/01/2007, 14:18:20] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[12/01/2007, 14:18:20] - BHO 2: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)
[12/01/2007, 14:18:20] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/01/2007, 14:18:20] - BHO 4: {8E3FBDE2-7DBD-4040-85D9-29BBC559C129} (MSEvents Object)
[12/01/2007, 14:18:20] - ALERT: Found MSEvents Object!
[12/01/2007, 14:18:20] - BHO 5: {9DB055A7-9A02-4662-98AD-5353F3A470F3} ()
[12/01/2007, 14:18:20] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/01/2007, 14:18:20] - Checking for HKLM\...\Winlogon\Notify\gebyv
[12/01/2007, 14:18:20] - Key not found: HKLM\...\Winlogon\Notify\gebyv, continuing.
[12/01/2007, 14:18:20] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/01/2007, 14:18:20] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[12/01/2007, 14:18:20] - Finished Searching Browser Helper Objects
[12/01/2007, 14:18:20] - *** Detected MSEvents Object
[12/01/2007, 14:18:20] - Trying to remove MSEvents Object...
[12/01/2007, 14:18:21] - Terminating Process: IEXPLORE.EXE
[12/01/2007, 14:18:22] - Terminating Process: RUNDLL32.EXE
[12/01/2007, 14:18:22] - Disabling Automatic Shell Restart
[12/01/2007, 14:18:22] - Terminating Process: EXPLORER.EXE
[12/01/2007, 14:18:22] - Suspending the NT Session Manager System Service
[12/01/2007, 14:18:22] - Terminating Windows NT Logon/Logoff Manager
[12/01/2007, 14:18:23] - Re-enabling Automatic Shell Restart
[12/01/2007, 14:18:23] - File to disable: C:\WINDOWS\System32\yayxwxy.dll
[12/01/2007, 14:18:23] - Renaming C:\WINDOWS\System32\yayxwxy.dll -> C:\WINDOWS\System32\yayxwxy.dll.vir
[12/01/2007, 14:18:23] - File successfully renamed!
[12/01/2007, 14:18:23] - Removing HKLM\...\Browser Helper Objects\{8E3FBDE2-7DBD-4040-85D9-29BBC559C129}
[12/01/2007, 14:18:23] - Removing HKCR\CLSID\{8E3FBDE2-7DBD-4040-85D9-29BBC559C129}
[12/01/2007, 14:18:23] - Adding Kill Bit for ActiveX for GUID: {8E3FBDE2-7DBD-4040-85D9-29BBC559C129}
[12/01/2007, 14:18:23] - Deleting ATLEvents/MSEvents Registry entries
[12/01/2007, 14:18:23] - Removing HKLM\...\Winlogon\Notify\yayxwxy
[12/01/2007, 14:18:23] - Searching for Browser Helper Objects:
[12/01/2007, 14:18:23] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[12/01/2007, 14:18:23] - BHO 2: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)
[12/01/2007, 14:18:23] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[12/01/2007, 14:18:23] - BHO 4: {9DB055A7-9A02-4662-98AD-5353F3A470F3} ()
[12/01/2007, 14:18:23] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/01/2007, 14:18:23] - Checking for HKLM\...\Winlogon\Notify\gebyv
[12/01/2007, 14:18:23] - Key not found: HKLM\...\Winlogon\Notify\gebyv, continuing.
[12/01/2007, 14:18:23] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/01/2007, 14:18:23] - BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[12/01/2007, 14:18:23] - Finished Searching Browser Helper Objects
[12/01/2007, 14:18:23] - Finishing up...
[12/01/2007, 14:18:23] - A restart is needed.
[12/01/2007, 14:18:27] - Attempting to Restart via STOP error (Blue Screen!)

Voila, ce que ca donne...
0
Réponse 6 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
refais hijck stp
0
Réponse 7 / 25
Kafey
 
Voila :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:36:39, on 01/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\INVISI~1\invtray.exe
C:\WINDOWS\System32\wncmgr.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\RaUI.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [Windows Zero Driver] wncmgr.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Invisible Secrets 4] C:\PROGRA~1\INVISI~1\invtray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: 1.txt
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\WINDOWS\RaUI.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 8 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
Télécharge Combofix sUBs : http://www.pc-xpress.ca/download/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix,
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
0
Réponse 9 / 25
Kafey
 
Voila le rapport :

ComboFix 07-08-09.3 - "Ouissem" 2007-12-01 14:49:23.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.91 [GMT 1:00]
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\gebyv.dll
C:\WINDOWS\system32\vybeg.ini
C:\WINDOWS\system32\vybeg.ini2
C:\WINDOWS\system32\winsys.exe

((((((((((((((((((((((((( Files Created from 2007-11-01 to 2007-12-01 )))))))))))))))))))))))))))))))

2007-12-01 14:48 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-12-01 13:07 <REP> d-------- C:\WINDOWS\system32\bits
2007-12-01 13:07 <REP> d-------- C:\VundoFix Backups
2007-12-01 13:06 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-01 13:06 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-12-01 13:06 <REP> d-------- C:\WINDOWS\system32\PreInstall
2007-12-01 00:33 7,680 -----c--- C:\WINDOWS\system32\dllcache\bitsprx2.dll
2007-12-01 00:33 7,680 --------- C:\WINDOWS\system32\bitsprx2.dll
2007-12-01 00:33 7,168 -----c--- C:\WINDOWS\system32\dllcache\bitsprx3.dll
2007-12-01 00:33 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2007-12-01 00:33 360,960 --a--c--- C:\WINDOWS\system32\dllcache\qmgr.dll
2007-12-01 00:33 331,776 --a--c--- C:\WINDOWS\system32\dllcache\winhttp.dll
2007-12-01 00:33 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2007-12-01 00:33 17,408 --a--c--- C:\WINDOWS\system32\dllcache\qmgrprxy.dll
2007-12-01 00:33 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-12-01 00:24 <REP> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-12-01 00:23 <REP> d-------- C:\WINDOWS\SoftwareDistribution
2007-12-01 00:22 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-12-01 00:22 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-12-01 00:22 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-12-01 00:22 203,096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-12-01 00:22 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-12-01 00:22 170,776 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-11-30 21:55 <REP> d-------- C:\Program Files\Trend Micro
2007-11-30 21:27 37,376 --a------ C:\WINDOWS\system32\efcbbyx.dll
2007-11-30 20:47 37,376 --a------ C:\WINDOWS\system32\khfeccc.dll
2007-11-30 20:21 37,376 --a------ C:\WINDOWS\system32\efcyxxu.dll
2007-11-30 19:46 38,400 -r-hs---- C:\WINDOWS\system32\wncmgr.exe
2007-11-30 19:46 37,376 --a------ C:\WINDOWS\system32\yayxwxy.dll.vir
2007-11-30 19:46 <REP> d-------- C:\DOCUME~1\Ouissem\APPLIC~1\Help
2007-11-25 12:58 <REP> d-------- C:\Program Files\Zylom Games
2007-11-25 12:58 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom
2007-11-13 14:42 <REP> d-------- C:\Program Files\Gimp Pack Mode
2007-11-13 14:42 <REP> d-------- C:\DOCUME~1\Ouissem\.gimp-2.2
2007-11-11 13:36 <REP> d---s---- C:\DOCUME~1\Siham\UserData
2007-11-11 13:30 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-11-11 13:29 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-11-07 15:16 <REP> d-------- C:\DOCUME~1\Ouissem\APPLIC~1\gtk-2.0
2007-11-07 15:16 <REP> d-------- C:\DOCUME~1\Ouissem\.thumbnails
2007-11-07 15:15 <REP> d-------- C:\DOCUME~1\Ouissem\.gimp-2.4
2007-11-06 23:09 <REP> d---s---- C:\DOCUME~1\Ouissem\UserData
2007-11-05 21:58 <REP> d-------- C:\Program Files\Invisible Secrets 4
2007-11-04 21:30 <REP> d-------- C:\Program Files\Macrogaming
2007-11-01 20:11 <REP> d-------- C:\DOCUME~1\Ouissem\APPLIC~1\CyberLink

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-12-01 14:53 --------- d-------- C:\Program Files\Symantec AntiVirus
2007-12-01 00:23 --------- d--h----- C:\Program Files\WindowsUpdate
2007-11-30 21:47 --------- d-------- C:\Program Files\mIRC
2007-11-30 20:04 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\mIRC
2007-11-07 14:14 --------- d-------- C:\Program Files\Winamp
2007-11-01 20:16 --------- d-------- C:\Program Files\CCleaner
2007-11-01 20:00 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-11-01 19:59 --------- d-------- C:\Program Files\CyberLink
2007-10-30 20:02 --------- d-------- C:\Program Files\Audacity
2007-10-30 10:44 --------- d-------- C:\Program Files\MSN Messenger
2007-10-28 11:54 48856 --a------ C:\WINDOWS\system32\perfc00C.dat
2007-10-28 11:54 368076 --a------ C:\WINDOWS\system32\perfh00C.dat
2007-10-24 22:21 384 --a------ C:\Program Files\Raccourci vers Program Files.lnk
2007-10-22 16:06 1822 --a------ C:\WINDOWS\mozver.dat
2007-10-22 16:06 --------- d-------- C:\Program Files\DivX
2007-10-21 14:39 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\U3
2007-10-19 13:49 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\AdobeUM
2007-10-14 14:58 8176 --ah----- C:\WINDOWS\system32\mlfcache.dat
2007-10-13 16:52 --------- d-------- C:\Program Files\DS-3200 Wireless Optical Slimline Deskset
2007-10-13 16:51 --------- d-------- C:\Program Files\Fichiers communs\InstallShield
2007-10-13 15:35 --------- d-------- C:\Program Files\Google
2007-10-13 15:06 --------- d-------- C:\Program Files\Free Audio Pack
2007-10-13 14:33 --------- d-------- C:\Program Files\Movie Maker
2007-10-13 14:32 63504 --a------ C:\WINDOWS\BricoPackUninst.cmd
2007-10-13 14:32 6114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-10-13 14:11 --------- d-------- C:\Program Files\Sporever
2007-10-13 14:11 --------- d-------- C:\Program Files\Fichiers communs\Nosibay
2007-10-13 13:38 --------- d-------- C:\Program Files\BSplayer_WhenUSave_Installer
2007-10-13 13:35 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-10-13 13:32 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\Real
2007-10-13 13:31 --------- d-------- C:\Program Files\Real
2007-10-13 13:31 --------- d-------- C:\Program Files\Fichiers communs\xing shared
2007-10-13 13:31 --------- d-------- C:\Program Files\Fichiers communs\Real
2007-10-13 13:23 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\Google
2007-10-13 13:19 --------- d-------- C:\Program Files\Webteh
2007-10-13 13:19 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\BSplayer
2007-10-13 13:17 --------- d-------- C:\Program Files\Lavasoft
2007-10-13 13:16 --------- d-------- C:\Program Files\Symantec
2007-10-13 13:16 --------- d-------- C:\Program Files\Fichiers communs\Symantec Shared
2007-10-13 13:14 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\Apple Computer
2007-10-13 13:13 --------- d-------- C:\Program Files\QuickTime
2007-10-13 13:13 --------- d-------- C:\Program Files\iTunes
2007-10-13 13:13 --------- d-------- C:\Program Files\iPod
2007-10-13 13:13 --------- d-------- C:\Program Files\Apple Software Update
2007-10-13 12:23 --------- d-------- C:\Program Files\IVT Corporation
2007-10-13 12:19 20747 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2007-10-13 12:18 --------- d-------- C:\Program Files\RALINK
2007-10-13 12:15 --------- d-------- C:\Program Files\Fichiers communs\Nero
2007-10-13 12:14 --------- d-------- C:\Program Files\Ahead
2007-10-13 12:13 --------- d-------- C:\Program Files\Fichiers communs\Ahead
2007-10-13 12:10 204288 --a--c--- C:\WINDOWS\system32\dllcache\uxtheme.dll
2007-10-13 12:10 204288 --a------ C:\WINDOWS\system32\uxtheme.dll
2007-10-13 12:07 0 --a------ C:\WINDOWS\nsreg.dat
2007-10-13 11:59 --------- d-------- C:\Program Files\AMD
2007-10-13 11:58 --------- d-------- C:\Program Files\Realtek AC97
2007-10-13 11:50 --------- d-------- C:\Program Files\Fichiers communs\SpeechEngines
2007-10-13 11:50 --------- d-------- C:\Program Files\Fichiers communs\ODBC
2007-10-13 11:00 --------- d-------- C:\Program Files\microsoft frontpage
2007-10-13 10:59 0 -rahs---- C:\MSDOS.SYS
2007-10-13 10:59 0 -rahs---- C:\IO.SYS
2007-10-13 10:59 0 --a------ C:\CONFIG.SYS
2007-10-13 10:59 0 --a------ C:\AUTOEXEC.BAT
2007-10-13 10:58 --------- d-------- C:\Program Files\Services en ligne
2007-10-13 10:57 21892 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-10-13 10:57 --------- d-------- C:\Program Files\Fichiers communs\MSSoap
2007-10-13 10:56 --------- d-------- C:\Program Files\Windows NT
2007-10-13 10:56 --------- d-------- C:\Program Files\MSN Gaming Zone
2007-10-13 10:56 --------- d-------- C:\Program Files\Messenger

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-22 03:54]
"nwiz"="nwiz.exe" [2005-04-22 03:54 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\System32\sw20.exe" [2005-06-30 07:03]
"SW24"="C:\WINDOWS\System32\sw24.exe" [2005-07-04 06:29]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-22 03:54]
"SoundMan"="SOUNDMAN.EXE" [2005-11-11 07:07 C:\WINDOWS\soundman.exe]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2004-08-20 15:09]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-11-24 10:27]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-08 23:02]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-10-13 13:31]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-10-14 18:09]
"Windows Zero Driver"="wncmgr.exe" [2007-11-30 18:40 C:\WINDOWS\system32\wncmgr.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-16 20:35]
"msnmsgr"="~C:\Program Files\MSN Messenger\msnmsgr.exe" []
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-10-14 18:09]
"Invisible Secrets 4"="C:\PROGRA~1\INVISI~1\invtray.exe" [2007-07-18 13:22]

C:\Documents and Settings\Ouissem\Menu D‚marrer\Programmes\D‚marrage\
1.txt [2007-10-25 18:23:46]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Ralink Wireless Utility.lnk - C:\WINDOWS\RaUI.exe [2007-10-13 12:19:27]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\System32\gebyv.dll

R1 AmdK8;Pilote de processeur AMD;C:\WINDOWS\System32\DRIVERS\AmdK8.sys
R3 irsir;Pilote série infrarouge Microsoft;C:\WINDOWS\System32\DRIVERS\irsir.sys
S3 GMSIPCI;GMSIPCI;\??\G:\INSTALL\GMSIPCI.SYS
S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\System32\DRIVERS\KS-959.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\System32\DRIVERS\MSIRCOMM.sys
S3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\System32\DRIVERS\point32.sys

Contents of the 'Scheduled Tasks' folder
2007-10-13 12:13:13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-01 14:52:54
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-12-01 14:55:06 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-12-01 14:54

--- E O F ---
0
Réponse 10 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
selectionne ceci



File::

C:\WINDOWS\system32\efcyxxu.dll
C:\WINDOWS\system32\khfeccc.dll
C:\WINDOWS\system32\efcbbyx.dll
C:\WINDOWS\system32\wncmgr.exe

* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
* Colle le texte copié dans ce bloc-notes (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt
* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe
* Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
@+
0
Réponse 11 / 25
Kafey
 
Re voila :

ComboFix 07-08-09.3 - "Ouissem" 2007-12-01 15:23:17.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.126 [GMT 1:00]
Command switches used :: C:\Documents and Settings\Ouissem\Bureau\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\efcyxxu.dll
C:\WINDOWS\system32\khfeccc.dll
C:\WINDOWS\system32\efcbbyx.dll
C:\WINDOWS\system32\wncmgr.exe

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\efcbbyx.dll
C:\WINDOWS\system32\efcyxxu.dll
C:\WINDOWS\system32\khfeccc.dll
C:\WINDOWS\system32\wncmgr.exe

((((((((((((((((((((((((( Files Created from 2007-11-01 to 2007-12-01 )))))))))))))))))))))))))))))))

2007-12-01 14:48 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-12-01 13:07 <REP> d-------- C:\WINDOWS\system32\bits
2007-12-01 13:07 <REP> d-------- C:\VundoFix Backups
2007-12-01 13:06 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-01 13:06 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-12-01 13:06 <REP> d-------- C:\WINDOWS\system32\PreInstall
2007-12-01 00:33 7,680 -----c--- C:\WINDOWS\system32\dllcache\bitsprx2.dll
2007-12-01 00:33 7,680 --------- C:\WINDOWS\system32\bitsprx2.dll
2007-12-01 00:33 7,168 -----c--- C:\WINDOWS\system32\dllcache\bitsprx3.dll
2007-12-01 00:33 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2007-12-01 00:33 360,960 --a--c--- C:\WINDOWS\system32\dllcache\qmgr.dll
2007-12-01 00:33 331,776 --a--c--- C:\WINDOWS\system32\dllcache\winhttp.dll
2007-12-01 00:33 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2007-12-01 00:33 17,408 --a--c--- C:\WINDOWS\system32\dllcache\qmgrprxy.dll
2007-12-01 00:33 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-12-01 00:24 <REP> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-12-01 00:23 <REP> d-------- C:\WINDOWS\SoftwareDistribution
2007-12-01 00:22 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-12-01 00:22 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-12-01 00:22 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-12-01 00:22 203,096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-12-01 00:22 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-12-01 00:22 170,776 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-11-30 21:55 <REP> d-------- C:\Program Files\Trend Micro
2007-11-30 19:46 37,376 --a------ C:\WINDOWS\system32\yayxwxy.dll.vir
2007-11-30 19:46 <REP> d-------- C:\DOCUME~1\Ouissem\APPLIC~1\Help
2007-11-25 12:58 <REP> d-------- C:\Program Files\Zylom Games
2007-11-25 12:58 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom
2007-11-13 14:42 <REP> d-------- C:\Program Files\Gimp Pack Mode
2007-11-13 14:42 <REP> d-------- C:\DOCUME~1\Ouissem\.gimp-2.2
2007-11-11 13:36 <REP> d---s---- C:\DOCUME~1\Siham\UserData
2007-11-11 13:30 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-11-11 13:29 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-11-07 15:16 <REP> d-------- C:\DOCUME~1\Ouissem\APPLIC~1\gtk-2.0
2007-11-07 15:16 <REP> d-------- C:\DOCUME~1\Ouissem\.thumbnails
2007-11-07 15:15 <REP> d-------- C:\DOCUME~1\Ouissem\.gimp-2.4
2007-11-06 23:09 <REP> d---s---- C:\DOCUME~1\Ouissem\UserData
2007-11-05 21:58 <REP> d-------- C:\Program Files\Invisible Secrets 4
2007-11-04 21:30 <REP> d-------- C:\Program Files\Macrogaming
2007-11-01 20:11 <REP> d-------- C:\DOCUME~1\Ouissem\APPLIC~1\CyberLink

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-12-01 15:27 --------- d-------- C:\Program Files\Symantec AntiVirus
2007-12-01 14:54 48856 --a------ C:\WINDOWS\system32\perfc00C.dat
2007-12-01 14:54 368076 --a------ C:\WINDOWS\system32\perfh00C.dat
2007-12-01 00:23 --------- d--h----- C:\Program Files\WindowsUpdate
2007-11-30 21:47 --------- d-------- C:\Program Files\mIRC
2007-11-30 20:04 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\mIRC
2007-11-07 14:14 --------- d-------- C:\Program Files\Winamp
2007-11-01 20:16 --------- d-------- C:\Program Files\CCleaner
2007-11-01 20:00 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-11-01 19:59 --------- d-------- C:\Program Files\CyberLink
2007-10-30 20:02 --------- d-------- C:\Program Files\Audacity
2007-10-30 10:44 --------- d-------- C:\Program Files\MSN Messenger
2007-10-24 22:21 384 --a------ C:\Program Files\Raccourci vers Program Files.lnk
2007-10-22 16:06 1822 --a------ C:\WINDOWS\mozver.dat
2007-10-22 16:06 --------- d-------- C:\Program Files\DivX
2007-10-21 14:39 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\U3
2007-10-19 13:49 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\AdobeUM
2007-10-14 14:58 8176 --ah----- C:\WINDOWS\system32\mlfcache.dat
2007-10-13 16:52 --------- d-------- C:\Program Files\DS-3200 Wireless Optical Slimline Deskset
2007-10-13 16:51 --------- d-------- C:\Program Files\Fichiers communs\InstallShield
2007-10-13 15:35 --------- d-------- C:\Program Files\Google
2007-10-13 15:06 --------- d-------- C:\Program Files\Free Audio Pack
2007-10-13 14:33 --------- d-------- C:\Program Files\Movie Maker
2007-10-13 14:32 63504 --a------ C:\WINDOWS\BricoPackUninst.cmd
2007-10-13 14:32 6114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-10-13 14:11 --------- d-------- C:\Program Files\Sporever
2007-10-13 14:11 --------- d-------- C:\Program Files\Fichiers communs\Nosibay
2007-10-13 13:38 --------- d-------- C:\Program Files\BSplayer_WhenUSave_Installer
2007-10-13 13:35 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-10-13 13:32 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\Real
2007-10-13 13:31 --------- d-------- C:\Program Files\Real
2007-10-13 13:31 --------- d-------- C:\Program Files\Fichiers communs\xing shared
2007-10-13 13:31 --------- d-------- C:\Program Files\Fichiers communs\Real
2007-10-13 13:23 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\Google
2007-10-13 13:19 --------- d-------- C:\Program Files\Webteh
2007-10-13 13:19 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\BSplayer
2007-10-13 13:17 --------- d-------- C:\Program Files\Lavasoft
2007-10-13 13:16 --------- d-------- C:\Program Files\Symantec
2007-10-13 13:16 --------- d-------- C:\Program Files\Fichiers communs\Symantec Shared
2007-10-13 13:14 --------- d-------- C:\DOCUME~1\Ouissem\APPLIC~1\Apple Computer
2007-10-13 13:13 --------- d-------- C:\Program Files\QuickTime
2007-10-13 13:13 --------- d-------- C:\Program Files\iTunes
2007-10-13 13:13 --------- d-------- C:\Program Files\iPod
2007-10-13 13:13 --------- d-------- C:\Program Files\Apple Software Update
2007-10-13 12:23 --------- d-------- C:\Program Files\IVT Corporation
2007-10-13 12:19 20747 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2007-10-13 12:18 --------- d-------- C:\Program Files\RALINK
2007-10-13 12:15 --------- d-------- C:\Program Files\Fichiers communs\Nero
2007-10-13 12:14 --------- d-------- C:\Program Files\Ahead
2007-10-13 12:13 --------- d-------- C:\Program Files\Fichiers communs\Ahead
2007-10-13 12:10 204288 --a--c--- C:\WINDOWS\system32\dllcache\uxtheme.dll
2007-10-13 12:10 204288 --a------ C:\WINDOWS\system32\uxtheme.dll
2007-10-13 12:07 0 --a------ C:\WINDOWS\nsreg.dat
2007-10-13 11:59 --------- d-------- C:\Program Files\AMD
2007-10-13 11:58 --------- d-------- C:\Program Files\Realtek AC97
2007-10-13 11:50 --------- d-------- C:\Program Files\Fichiers communs\SpeechEngines
2007-10-13 11:50 --------- d-------- C:\Program Files\Fichiers communs\ODBC
2007-10-13 11:00 --------- d-------- C:\Program Files\microsoft frontpage
2007-10-13 10:59 0 -rahs---- C:\MSDOS.SYS
2007-10-13 10:59 0 -rahs---- C:\IO.SYS
2007-10-13 10:59 0 --a------ C:\CONFIG.SYS
2007-10-13 10:59 0 --a------ C:\AUTOEXEC.BAT
2007-10-13 10:58 --------- d-------- C:\Program Files\Services en ligne
2007-10-13 10:57 21892 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-10-13 10:57 --------- d-------- C:\Program Files\Fichiers communs\MSSoap
2007-10-13 10:56 --------- d-------- C:\Program Files\Windows NT
2007-10-13 10:56 --------- d-------- C:\Program Files\MSN Gaming Zone
2007-10-13 10:56 --------- d-------- C:\Program Files\Messenger

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-22 03:54]
"nwiz"="nwiz.exe" [2005-04-22 03:54 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\System32\sw20.exe" [2005-06-30 07:03]
"SW24"="C:\WINDOWS\System32\sw24.exe" [2005-07-04 06:29]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-22 03:54]
"SoundMan"="SOUNDMAN.EXE" [2005-11-11 07:07 C:\WINDOWS\soundman.exe]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2004-08-20 15:09]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-11-24 10:27]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-08 23:02]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-10-13 13:31]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-10-14 18:09]
"Windows Zero Driver"="wncmgr.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-16 20:35]
"msnmsgr"="~C:\Program Files\MSN Messenger\msnmsgr.exe" []
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-10-14 18:09]
"Invisible Secrets 4"="C:\PROGRA~1\INVISI~1\invtray.exe" [2007-07-18 13:22]

C:\Documents and Settings\Ouissem\Menu D‚marrer\Programmes\D‚marrage\
1.txt [2007-10-25 18:23:46]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Ralink Wireless Utility.lnk - C:\WINDOWS\RaUI.exe [2007-10-13 12:19:27]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\System32\gebyv.dll

R1 AmdK8;Pilote de processeur AMD;C:\WINDOWS\System32\DRIVERS\AmdK8.sys
R3 irsir;Pilote série infrarouge Microsoft;C:\WINDOWS\System32\DRIVERS\irsir.sys
S3 GMSIPCI;GMSIPCI;\??\G:\INSTALL\GMSIPCI.SYS
S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\System32\DRIVERS\KS-959.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\System32\DRIVERS\MSIRCOMM.sys
S3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\System32\DRIVERS\point32.sys

Contents of the 'Scheduled Tasks' folder
2007-10-13 12:13:13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-01 15:26:35
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-12-01 15:28:42 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-12-01 15:28
C:\ComboFix2.txt ... 2007-12-01 14:55

--- E O F ---
0
Réponse 12 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
refais stp un nouveau hijack
0
Réponse 13 / 25
Kafey
 
voila :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:40:37, on 01/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\PROGRA~1\INVISI~1\invtray.exe
C:\WINDOWS\RaUI.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [Windows Zero Driver] wncmgr.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Invisible Secrets 4] C:\PROGRA~1\INVISI~1\invtray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: 1.txt
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\WINDOWS\RaUI.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0
Réponse 14 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
Télécharge sur le bureau [url=http://siri.urz.free.fr/Fix/SmitfraudFix.zip]SmitfraudFix.zip[/url]
=> Double clic sur SmitfraudFix.zip
=> Extraire tout
=> Double clic sur SmitfraudFix
=> Double Clic sur SmitfraudFix.cmd
=> Choisir Option 1
=> poste le rapport
0
Réponse 15 / 25
Kafey
 
SmitFraudFix v2.256

Rapport fait à 15:54:44,03, 01/12/2007
Executé à partir de C:\Documents and Settings\Ouissem\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\PROGRA~1\INVISI~1\invtray.exe
C:\WINDOWS\RaUI.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Ouissem

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Ouissem\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Ouissem\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Ralink Wireless LAN Card V2 - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{37EEC8B2-4CB3-4BF2-B2EE-A2273C1BB8BF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{37EEC8B2-4CB3-4BF2-B2EE-A2273C1BB8BF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{37EEC8B2-4CB3-4BF2-B2EE-A2273C1BB8BF}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin
0
Réponse 16 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
il faut faire les mises à jours de windows
http://www.microsoft.com/downloads/details.aspx?FamilyId=3549EA9E-DA3F-43B9-A4F1-AF243B6168F3&displaylang=fr
et voici la version de IE7
http://www.google.com/toolbar/ie7/intl/fr/

ensuite
fais un scan avec bitdefender et colle le rapport

https://www.bitdefender.com/toolbox/

un tuto
https://kerio.probb.fr/t673-bitdefender-antivirus-en-ligne
0
Réponse 17 / 25
Kafey
 
Voila, j'ai fais le scan, et voila le rapport

<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner -Scan Report</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<meta name="generator" content="Namo WebEditor v5.0(Trial)">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >

<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td width="458">
<p><font face="Arial" color=red><span style="font-size:14pt;"><b>BitDefender
Online Scanner</b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan="3" width="912">
<p><font face="Arial"><span style="font-size:11pt;"><B>Scan report generated
at: Sat, Dec 01, 2007 - 17:16:12</b></span></font></p>
</td>
</tr>

<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B>Scan
path: </b></span><span style="font-size:10pt;">C:\;D:\;E:\;F:\;G:\;</span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Statistics</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Time</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">00:42:58</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Files</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">164441</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Folders</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">6950</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Boot Sectors</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">6</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">2046</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Packed Files</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">6843</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Results</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Identified Viruses </font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">5</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Infected Files </font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Suspect Files </font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">2</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Warnings</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Disinfected</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Deleted Files</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">9</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Engines Info</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Virus Definitions</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">879717</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Engine build</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Scan plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">14</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archive plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">38</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Unpack plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">E-mail plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">6</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">System plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">1</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Scan Settings</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">First Action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Disinfect</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Second Action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Delete</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Heuristics</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Yes</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Enable Warnings</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Yes</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Scanned Extensions</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">*;</font></p>
</td>
</tr>

<tr>
<td width="57%">
<p><font face="Arial" size="2">Exclude Extensions</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2"> </font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Scan Emails</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Yes</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Scan Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Yes</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Scan Packed</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Yes</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Scan Files</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Yes</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Scan Boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Yes</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td colspan=2>  
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="252" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Scanned File</b></font></p>
</td>
<td width="195" bgcolor="#CCCCCC" align="right">
<p align="left"><b><font size="2" face="Arial"> Status</font></b></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">C:\Documents and Settings\Ouissem\Bureau\ComboFix.exe=>(RAR Sfx o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infected with: Trojan.Bat.Sdel.B</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\Documents and Settings\Ouissem\Bureau\ComboFix.exe=>(RAR Sfx o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Disinfection failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\Documents and Settings\Ouissem\Bureau\ComboFix.exe=>(RAR Sfx o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\Documents and Settings\Ouissem\Bureau\ComboFix.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Update failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infected with: Generic.Adw.SaveNow.E8ADC126</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Disinfection failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\QooBox\Quarantine\C\WINDOWS\system32\wncmgr.exe.vir</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Suspected of: BehavesLike:Win32.ProcessHijack</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\QooBox\Quarantine\C\WINDOWS\system32\wncmgr.exe.vir</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Disinfection failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\QooBox\Quarantine\C\WINDOWS\system32\wncmgr.exe.vir</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015418.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infected with: Win32.Worm.Rontok.F</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015418.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015419.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infected with: Win32.Worm.Rontok.F</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015419.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015437.exe=>(NSIS o)=>zlib_nsis0010=>(CAB Sfx r)=>VVSN.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infected with: Generic.Adw.SaveNow.56AD4696</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015437.exe=>(NSIS o)=>zlib_nsis0010=>(CAB Sfx r)=>VVSN.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Disinfection failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015437.exe=>(NSIS o)=>zlib_nsis0010=>(CAB Sfx r)=>VVSN.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015437.exe=>(NSIS o)=>zlib_nsis0010=>(CAB Sfx r)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Update failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015456.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Detected with: Adware.Navipromo.BYJ</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015456.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Disinfection failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP45\A0015456.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP59\A0018080.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Suspected of: BehavesLike:Win32.ProcessHijack</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP59\A0018080.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Disinfection failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP59\A0018080.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP59\A0018186.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infected with: Generic.Adw.SaveNow.E8ADC126</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP59\A0018186.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Disinfection failed</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{5C998FA4-47F9-4A55-9F9C-812C770523E0}\RP59\A0018186.exe</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Deleted</font></p>
</td>
</tr>
</table>
</td>

<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>

</table>
<p> </p>

</body>
</html>
0
Réponse 18 / 25
Kafey
 
Bitdefender me dis qu'il y a surment un virus, et a trouvé bcps de fichiers infectés
0
Réponse 19 / 25
ep44 Messages postés 7432 Statut Contributeur 3
 
non il à bien effectué le nettoyage

refais un nouveau hijack stp
0
Réponse 20 / 25
Kafey
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41:46, on 01/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\WINDOWS\RaUI.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [Windows Zero Driver] wncmgr.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Invisible Secrets 4] C:\PROGRA~1\INVISI~1\invtray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: 1.txt
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\WINDOWS\RaUI.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
0

Discussions similaires

symboles et écritures pour nick msn
Pando -
roro -

20 réponses