TR/BHO.agz.32 et TR/Crypt.Morphine.Gen

Question

Bonjour,
j'ai depuis hier 2 trojans détécté par mon Antivirus : TR/BHO.agz.32 et TR/Crypt.Morphine.Gen ,mais il ne peut ni les supprimer ni les mettre en quarantaine ( problème d'accés au fichier vérouillé)..
C'est embêtantje crois ! je n'arrete pas d'avoir des alertes mais sans pouvoir rien faire...
Merci de bien vouloir m'aider !!
Stéf.

ep44 · Answer

Bonjour
commence par ceci 
Télécharge sur le bureau
ftp://ftp.commentcamarche.com/download/HJTInstall.exe

=> Double-clic dessus
=> installe 
=> Clic Do a system scan and save the log
=> coller le rapport
si problème voir l'aide
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm 
@+

stéfanie · Answer

Voila j'ai fait comme indiqué ,voici  le rapport!
Merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:39:15, on 13/01/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ScanSoft\NaturallySpeaking\Program
atspeak.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32	askmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/ServicesAcces.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {C9908AA7-4972-4F31-A328-AB9D6C6F3744} - C:\WINDOWS\System32\dispexk.dll
O2 - BHO: (no name) - {D335C20A-D792-4656-8D44-8756079B1D75} - c:\windows\system32\c_g18030e.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Pluginseg\VeohToolbar.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files\ScanSoft\NaturallySpeaking\Program\Ereg.exe" -r "C:\Program Files\ScanSoft\NaturallySpeaking\Program\ereg.ini"
O4 - HKLM\..\Run: [zlij2nr5jlpd] C:\WINDOWS\system32\zlij2nr5jlpd.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [zlij2nr5jlpd] C:\WINDOWS\system32\zlij2nr5jlpd.exe
O4 - HKCU\..\Policies\Explorer\Run: [{E8057263-0964-1036-0620-030305160021}] "C:\Program Files\Fichiers communs\{E8057263-0964-1036-0620-030305160021}\Update.exe" mc-110-12-0001411
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Dragon NaturallySpeaking.lnk = C:\Program Files\ScanSoft\NaturallySpeaking\Program
atspeak.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Thalia\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab55579.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AB4ADC0F-2B4B-4B08-8B5C-CA4D6188A180} (P3Xfer Loader Class) - http://package.hyosungcdn.com/download/p3xset.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: ahdfgmoy - C:\WINDOWS\SYSTEM32\c_g18030e.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

ep44 · Answer

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix,
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
@+

stéfanie · Answer

voila le rapport de combofix

ComboFix 08-01-13.1 - Thalia 2008-01-13 13:14:04.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.263 [GMT 1:00]
Running from: C:\Documents and Settings\Thalia\Bureau\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Thalia\Application Data\macromedia\Flash Player\#SharedObjects\56BVUEW4\iforex.com
C:\Documents and Settings\Thalia\Application Data\macromedia\Flash Player\#SharedObjects\56BVUEW4\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Thalia\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Thalia\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\system32\c_g18030e.dll . . . . Echec de suppression

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-13 to 2008-01-13 ))))))))))))))))))))))))))))))))))))
.

2008-01-13 12:56 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 11:38 . 2008-01-13 11:38 <REP> d-------- C:\Program Files\Trend Micro
2008-01-13 11:15 . 2008-01-13 11:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-13 11:13 . 2008-01-13 13:20 <REP> d-------- C:\Program Files\Trojan Remover
2008-01-13 11:13 . 2008-01-13 11:13 <REP> d-------- C:\Documents and Settings\Thalia\Application Data\Simply Super Software
2008-01-13 11:13 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-01-13 11:13 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-01-12 18:20 . 2008-01-12 18:20 <REP> d-------- C:\Program Files\Avira
2008-01-12 18:20 . 2008-01-12 18:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-11 14:36 . 2007-07-31 23:56 4,729 --a------ C:\WINDOWS\_detmp.1
2008-01-06 22:48 . 2008-01-06 22:48 244 --ah----- C:\sqmnoopt08.sqm
2008-01-06 22:48 . 2008-01-06 22:48 232 --ah----- C:\sqmdata08.sqm
2008-01-04 17:05 . 2008-01-04 17:05 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll
2008-01-04 17:05 . 2008-01-04 17:05 741,632 --a------ C:\WINDOWS\system32\gjrcqroo.dat
2008-01-04 17:05 . 2008-01-04 17:05 246,545 --a------ C:\WINDOWS\system32\libssl32.dll
2008-01-04 17:05 . 2008-01-04 17:05 42,240 --a------ C:\WINDOWS\system32\gegwdynw.dat
2008-01-04 17:05 . 2008-01-12 18:14 36,608 --a------ C:\WINDOWS\system32\beywvvcw.dat
2008-01-04 17:05 . 2008-01-04 17:05 35,072 --a------ C:\WINDOWS\system32\oosurjis.dat
2007-12-26 03:13 . 2007-12-26 03:13 120,576 --a------ C:\WINDOWS\system32\vsadxuoo.dat
2007-12-26 03:06 . 2001-08-28 13:00 83,968 --a------ C:\WINDOWS\system32\c_g18030e.dll.bak
2007-12-26 03:06 . 2008-01-12 18:38 83,968 --a------ C:\WINDOWS\system32\c_g18030e.dll
2007-12-26 03:06 . 19,584 C:\WINDOWS\system32\drivers\uymskeub.dat
2007-12-26 03:05 . 2001-08-28 13:00 84,992 --a------ C:\WINDOWS\system32\dispexk.dll
2007-12-26 03:05 . 2007-12-26 03:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-26 03:05 . 2007-12-26 03:05 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-24 17:12 . 2007-12-24 17:12 268 --ah----- C:\sqmdata07.sqm
2007-12-24 17:12 . 2007-12-24 17:12 244 --ah----- C:\sqmnoopt07.sqm
2007-12-14 03:32 . 2007-12-14 03:32 <REP> d-------- C:\Program Files\Ventrilo
2007-12-14 03:30 . 2007-12-14 03:31 <REP> d-------- C:\Program Files\VentSrv
2007-12-14 03:30 . 2007-12-14 03:32 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 10:54 --------- d-----w C:\Documents and Settings\Thalia\Application Data\OpenOffice.org2
2008-01-12 22:12 --------- d-----w C:\Program Files\World of Warcraft
2008-01-12 16:15 --------- d-----w C:\Program Files\ewido anti-spyware 4.0
2008-01-11 13:36 --------- d-----w C:\Program Files\Abe's Exoddus
2007-12-07 13:06 --------- d-----w C:\Program Files\Office10
2007-12-07 13:04 --------- d-----w C:\Program Files\ScanSoft
2007-12-07 12:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-07 12:42 --------- d-----w C:\Program Files\Google
2007-12-07 12:39 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2007-12-07 12:39 --------- d-----w C:\Program Files\LimeWire
2007-12-07 12:38 --------- d-----w C:\Program Files\Java
2007-12-07 12:38 --------- d-----w C:\Program Files\eMule
2007-12-07 12:35 --------- d-----w C:\Program Files\OpenOffice
2007-11-14 19:35 --------- d-----w C:\Program Files\Soldier of Fortune II - Double Helix
2007-07-10 15:42 132,895 ----a-w C:\WINDOWS\Fonts\kiralynn.zip
2007-07-10 15:41 319,491 ----a-w C:\WINDOWS\Fonts\epoxy_history.zip
2007-07-10 15:36 89,933 ----a-w C:\WINDOWS\Fonts\bleeding_cowboys.zip
2007-07-10 15:36 824,904 ----a-w C:\WINDOWS\Fonts\wc_wunderbach_mix_bta.zip
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C9908AA7-4972-4F31-A328-AB9D6C6F3744}]
2001-08-28 13:00 84992 --a------ C:\WINDOWS\System32\dispexk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D335C20A-D792-4656-8D44-8756079B1D75}]
2008-01-12 18:38 83968 --a------ c:\windows\system32\c_g18030e.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-12-03 13:21 3461120]
"zlij2nr5jlpd"="C:\WINDOWS\system32\zlij2nr5jlpd.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 10:52 221184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-14 21:59 282624]
"DNS7reminder"="C:\Program Files\ScanSoft\NaturallySpeaking\Program\Ereg.exe" [2003-07-30 18:16 729088]
"zlij2nr5jlpd"="C:\WINDOWS\system32\zlij2nr5jlpd.exe" [ ]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-12 18:31 249896]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-13 11:14 737872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{E8057263-0964-1036-0620-030305160021}"= "C:\Program Files\Fichiers communs\{E8057263-0964-1036-0620-030305160021}\Update.exe" mc-110-12-0001411

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ahdfgmoy]
c_g18030e.dll 2008-01-12 18:38 83968 C:\WINDOWS\system32\c_g18030e.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^officejet 6100.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\officejet 6100.lnk
backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Thalia^Menu Démarrer^Programmes^Démarrage^Dragon NaturallySpeaking.lnk]
path=C:\Documents and Settings\Thalia\Menu Démarrer\Programmes\Démarrage\Dragon NaturallySpeaking.lnk
backup=C:\WINDOWS\pss\Dragon NaturallySpeaking.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
--a------ 2002-10-15 18:00 1818624 C:\WINDOWS\mixer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-09-25 17:50 20053544 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ClipSrv"=3 (0x3)
"Adobe LM Service"=3 (0x3)

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [2007-07-18 14:22]
R0 spzcbjps;spzcbjps;C:\WINDOWS\System32\drivers\uymskeub.dat []
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04]
S2 ozllihqp;AGP Bus z75d8 Monitor;C:\WINDOWS\System32\svchost.exe [2001-08-28 13:00]
S3 o1394bul;o1394bul;C:\DOCUME~1\Thalia\LOCALS~1\Temp\o1394bul.sys []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ozllihqp

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-13 13:21:40
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\wuauclt.exe.wusetup.383953.bak 53080 bytes executable
C:\WINDOWS\system32\wuaueng.dll.wusetup.388296.bak 1710936 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************
.
Completion time: 2008-01-13 13:29:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-13 12:29:54

ep44 · Answer

selectionne ceci


driver::

uymskeub.dat


registry::

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9908AA7-4972-4F31-A328-AB9D6C6F3744}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D335C20A-D792-4656-8D44-8756079B1D75}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"zlij2nr5jlpd"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"zlij2nr5jlpd"=-



File::

C:\WINDOWS\system32\gjrcqroo.dat 
C:\WINDOWS\system32\gegwdynw.dat
C:\WINDOWS\system32\beywvvcw.dat 
C:\WINDOWS\system32\oosurjis.dat
C:\WINDOWS\system32\vsadxuoo.dat
C:\WINDOWS\system32\c_g18030e.dll.bak
C:\WINDOWS\system32\c_g18030e.dll
C:\WINDOWS\system32\dispexk.dll 
C:\WINDOWS\system32\libeay32.dll
C:\WINDOWS\system32\libssl32.dll 
C:\WINDOWS\System32\drivers\uymskeub.dat



=> Copie le texte sélectionné (CTRL+C).
=> Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
=> Colle le texte copié dans ce bloc-notes (CTRL+V).
=> Sauvegarde ce fichier sous le nom de CFScript.txt
=> Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe
=> Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
=> Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
=> Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
=> Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

@+

stéfanie · Answer

Coucou Ep44
voici mon nouveau rapport
Merci pour l'aide !

ComboFix 08-01-13.1 - Thalia 2008-01-13 16:35:40.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.244 [GMT 1:00]
Running from: C:\Documents and Settings\Thalia\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Thalia\Bureau\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\c_g18030e.dll . . . . Echec de suppression

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-13 to 2008-01-13 ))))))))))))))))))))))))))))))))))))
.

2008-01-13 12:56 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 11:38 . 2008-01-13 11:38 <REP> d-------- C:\Program Files\Trend Micro
2008-01-13 11:15 . 2008-01-13 11:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-13 11:13 . 2008-01-13 13:22 <REP> d-------- C:\Program Files\Trojan Remover
2008-01-13 11:13 . 2008-01-13 11:13 <REP> d-------- C:\Documents and Settings\Thalia\Application Data\Simply Super Software
2008-01-13 11:13 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-01-13 11:13 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-01-12 18:20 . 2008-01-12 18:20 <REP> d-------- C:\Program Files\Avira
2008-01-12 18:20 . 2008-01-12 18:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-11 14:36 . 2007-07-31 23:56 4,729 --a------ C:\WINDOWS\_detmp.1
2008-01-06 22:48 . 2008-01-06 22:48 244 --ah----- C:\sqmnoopt08.sqm
2008-01-06 22:48 . 2008-01-06 22:48 232 --ah----- C:\sqmdata08.sqm
2008-01-04 17:05 . 2008-01-04 17:05 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll
2008-01-04 17:05 . 2008-01-04 17:05 741,632 --a------ C:\WINDOWS\system32\gjrcqroo.dat
2008-01-04 17:05 . 2008-01-04 17:05 246,545 --a------ C:\WINDOWS\system32\libssl32.dll
2008-01-04 17:05 . 2008-01-04 17:05 42,240 --a------ C:\WINDOWS\system32\gegwdynw.dat
2008-01-04 17:05 . 2008-01-12 18:14 36,608 --a------ C:\WINDOWS\system32\beywvvcw.dat
2008-01-04 17:05 . 2008-01-04 17:05 35,072 --a------ C:\WINDOWS\system32\oosurjis.dat
2007-12-26 03:13 . 2007-12-26 03:13 120,576 --a------ C:\WINDOWS\system32\vsadxuoo.dat
2007-12-26 03:06 . 2001-08-28 13:00 83,968 --a------ C:\WINDOWS\system32\c_g18030e.dll.bak
2007-12-26 03:06 . 2008-01-12 18:38 83,968 --a------ C:\WINDOWS\system32\c_g18030e.dll
2007-12-26 03:06 . 19,584 C:\WINDOWS\system32\drivers\uymskeub.dat
2007-12-26 03:05 . 2001-08-28 13:00 84,992 --a------ C:\WINDOWS\system32\dispexk.dll
2007-12-26 03:05 . 2007-12-26 03:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-26 03:05 . 2007-12-26 03:05 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-24 17:12 . 2007-12-24 17:12 268 --ah----- C:\sqmdata07.sqm
2007-12-24 17:12 . 2007-12-24 17:12 244 --ah----- C:\sqmnoopt07.sqm
2007-12-14 03:32 . 2007-12-14 03:32 <REP> d-------- C:\Program Files\Ventrilo
2007-12-14 03:30 . 2007-12-14 03:31 <REP> d-------- C:\Program Files\VentSrv
2007-12-14 03:30 . 2007-12-14 03:32 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 12:28 --------- d-----w C:\Documents and Settings\Thalia\Application Data\OpenOffice.org2
2008-01-12 22:12 --------- d-----w C:\Program Files\World of Warcraft
2008-01-12 16:15 --------- d-----w C:\Program Files\ewido anti-spyware 4.0
2008-01-11 13:36 --------- d-----w C:\Program Files\Abe's Exoddus
2007-12-07 13:06 --------- d-----w C:\Program Files\Office10
2007-12-07 13:04 --------- d-----w C:\Program Files\ScanSoft
2007-12-07 12:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-07 12:42 --------- d-----w C:\Program Files\Google
2007-12-07 12:39 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2007-12-07 12:39 --------- d-----w C:\Program Files\LimeWire
2007-12-07 12:38 --------- d-----w C:\Program Files\Java
2007-12-07 12:38 --------- d-----w C:\Program Files\eMule
2007-12-07 12:35 --------- d-----w C:\Program Files\OpenOffice
2007-11-14 19:35 --------- d-----w C:\Program Files\Soldier of Fortune II - Double Helix
2007-07-10 15:42 132,895 ----a-w C:\WINDOWS\Fonts\kiralynn.zip
2007-07-10 15:41 319,491 ----a-w C:\WINDOWS\Fonts\epoxy_history.zip
2007-07-10 15:36 89,933 ----a-w C:\WINDOWS\Fonts\bleeding_cowboys.zip
2007-07-10 15:36 824,904 ----a-w C:\WINDOWS\Fonts\wc_wunderbach_mix_bta.zip
.

((((((((((((((((((((((((((((( snapshot@2008-01-13_13.29.34.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-13 12:13:48 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-01-13 15:35:33 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
- 2008-01-13 12:13:48 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-01-13 15:35:33 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-01-13 12:13:49 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
+ 2008-01-13 15:35:33 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
- 2008-01-13 12:13:49 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
+ 2008-01-13 15:35:33 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
- 2008-01-13 12:13:49 3,366,912 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT
+ 2008-01-13 15:35:33 3,366,912 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT
- 2008-01-13 12:13:49 368,640 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
+ 2008-01-13 15:35:34 368,640 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
- 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
+ 2007-07-30 18:19:20 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
- 2007-04-16 20:45:28 92,504 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll
+ 2007-07-30 18:19:20 92,504 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll
- 2007-04-16 20:45:20 53,080 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
+ 2007-07-30 18:19:16 53,080 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
- 2007-04-16 20:45:54 1,710,936 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
+ 2007-07-30 18:19:42 1,712,984 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
- 2007-11-01 11:25:16 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-01-13 12:25:28 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-01 11:25:16 48,616 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-01-13 12:25:28 48,616 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2007-11-01 11:25:16 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-01-13 12:25:28 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-11-01 11:25:16 367,658 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-01-13 12:25:28 367,658 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2007-07-30 18:18:40 33,624 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll
+ 2007-07-30 18:19:12 43,352 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.0.6000.381\wups2.dll
- 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
+ 2007-07-30 18:19:36 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
- 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
+ 2007-07-30 18:19:16 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
- 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
+ 2007-07-30 18:19:42 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
- 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
+ 2007-07-30 18:19:32 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
- 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
+ 2007-07-30 18:18:40 33,624 ----a-w C:\WINDOWS\system32\wups.dll
- 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
+ 2007-07-30 18:19:12 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
- 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
+ 2007-07-30 18:19:28 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C9908AA7-4972-4F31-A328-AB9D6C6F3744}]
2001-08-28 13:00 84992 --a------ C:\WINDOWS\System32\dispexk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D335C20A-D792-4656-8D44-8756079B1D75}]
2008-01-12 18:38 83968 --a------ c:\windows\system32\c_g18030e.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-12-03 13:21 3461120]
"zlij2nr5jlpd"="C:\WINDOWS\system32\zlij2nr5jlpd.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 10:52 221184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-14 21:59 282624]
"DNS7reminder"="C:\Program Files\ScanSoft\NaturallySpeaking\Program\Ereg.exe" [2003-07-30 18:16 729088]
"zlij2nr5jlpd"="C:\WINDOWS\system32\zlij2nr5jlpd.exe" [ ]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-12 18:31 249896]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-13 11:14 737872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{E8057263-0964-1036-0620-030305160021}"= "C:\Program Files\Fichiers communs\{E8057263-0964-1036-0620-030305160021}\Update.exe" mc-110-12-0001411

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ahdfgmoy]
c_g18030e.dll 2008-01-12 18:38 83968 C:\WINDOWS\system32\c_g18030e.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^officejet 6100.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\officejet 6100.lnk
backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Thalia^Menu Démarrer^Programmes^Démarrage^Dragon NaturallySpeaking.lnk]
path=C:\Documents and Settings\Thalia\Menu Démarrer\Programmes\Démarrage\Dragon NaturallySpeaking.lnk
backup=C:\WINDOWS\pss\Dragon NaturallySpeaking.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
--a------ 2002-10-15 18:00 1818624 C:\WINDOWS\mixer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-09-25 17:50 20053544 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ClipSrv"=3 (0x3)
"Adobe LM Service"=3 (0x3)

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [2007-07-18 14:22]
R0 spzcbjps;spzcbjps;C:\WINDOWS\System32\drivers\uymskeub.dat []
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04]
S2 ozllihqp;AGP Bus z75d8 Monitor;C:\WINDOWS\System32\svchost.exe [2001-08-28 13:00]
S3 o1394bul;o1394bul;C:\DOCUME~1\Thalia\LOCALS~1\Temp\o1394bul.sys []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ozllihqp

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-13 16:47:25
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-13 16:53:41 - machine was rebooted [Thalia]
ComboFix-quarantined-files.txt 2008-01-13 15:53:37
ComboFix2.txt 2008-01-13 12:29:59

ep44 · Answer

tu n'as pas fait ce que je t'ai demandé 

une fois le document texte CFScript.txt sur ton bureau 
fait le glisser sur l'icône de combofix 
et tu doit avoir une fenêtre bleu qui apparait 
tape 1
regarde la poste 5
@+

stéfanie · Answer

Mince pourtant il me semble que c'est ce que 'jai fait..
j'ai copier coller ce que tu m'as demandé de selectionner (en gras sur ton post 5)
je l'ai coller dans un fichier block note que j'ai enregistrer sur le bureau sous le nom de CFScript.txt
et j'ai ensuite fait glisser ce même fichier texte sur l'icone croix rouge de mon bureau correspondant a Combofix.exe
bon je recommence!

ep44 · Answer

ok @+

stéfanie · Answer

Voila le nouveau rapport j'espère que c'est bon!
@+

ComboFix 08-01-13.1 - Thalia 2008-01-13 20:08:36.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.251 [GMT 1:00]
Running from: C:\Documents and Settings\Thalia\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Thalia\Bureau\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE
C:\WINDOWS\system32\beywvvcw.dat
C:\WINDOWS\system32\c_g18030e.dll
C:\WINDOWS\system32\c_g18030e.dll.bak
C:\WINDOWS\system32\dispexk.dll
C:\WINDOWS\System32\drivers\uymskeub.dat
C:\WINDOWS\system32\gegwdynw.dat
C:\WINDOWS\system32\gjrcqroo.dat
C:\WINDOWS\system32\libeay32.dll
C:\WINDOWS\system32\libssl32.dll
C:\WINDOWS\system32\oosurjis.dat
C:\WINDOWS\system32\vsadxuoo.dat
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\beywvvcw.dat
C:\WINDOWS\system32\c_g18030e.dll
C:\WINDOWS\system32\c_g18030e.dll.bak
C:\WINDOWS\system32\dispexk.dll
C:\WINDOWS\System32\drivers\uymskeub.dat
C:\WINDOWS\system32\gegwdynw.dat
C:\WINDOWS\system32\gjrcqroo.dat
C:\WINDOWS\system32\libeay32.dll
C:\WINDOWS\system32\libssl32.dll
C:\WINDOWS\system32\oosurjis.dat
C:\WINDOWS\system32\vsadxuoo.dat

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-13 to 2008-01-13 ))))))))))))))))))))))))))))))))))))
.

2008-01-13 12:56 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 11:38 . 2008-01-13 11:38 <REP> d-------- C:\Program Files\Trend Micro
2008-01-13 11:15 . 2008-01-13 11:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-13 11:13 . 2008-01-13 16:47 <REP> d-------- C:\Program Files\Trojan Remover
2008-01-13 11:13 . 2008-01-13 11:13 <REP> d-------- C:\Documents and Settings\Thalia\Application Data\Simply Super Software
2008-01-13 11:13 . 2003-02-02 19:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-01-13 11:13 . 2002-03-06 00:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-01-12 18:20 . 2008-01-12 18:20 <REP> d-------- C:\Program Files\Avira
2008-01-12 18:20 . 2008-01-12 18:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-11 14:36 . 2007-07-31 23:56 4,729 --a------ C:\WINDOWS\_detmp.1
2008-01-06 22:48 . 2008-01-06 22:48 244 --ah----- C:\sqmnoopt08.sqm
2008-01-06 22:48 . 2008-01-06 22:48 232 --ah----- C:\sqmdata08.sqm
2007-12-26 03:05 . 2007-12-26 03:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-26 03:05 . 2007-12-26 03:05 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-24 17:12 . 2007-12-24 17:12 268 --ah----- C:\sqmdata07.sqm
2007-12-24 17:12 . 2007-12-24 17:12 244 --ah----- C:\sqmnoopt07.sqm
2007-12-14 03:32 . 2007-12-14 03:32 <REP> d-------- C:\Program Files\Ventrilo
2007-12-14 03:30 . 2007-12-14 03:31 <REP> d-------- C:\Program Files\VentSrv
2007-12-14 03:30 . 2007-12-14 03:32 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 16:12 --------- d-----w C:\Program Files\ewido anti-spyware 4.0
2008-01-13 15:49 --------- d-----w C:\Documents and Settings\Thalia\Application Data\OpenOffice.org2
2008-01-12 22:12 --------- d-----w C:\Program Files\World of Warcraft
2008-01-11 13:36 --------- d-----w C:\Program Files\Abe's Exoddus
2007-12-07 13:06 --------- d-----w C:\Program Files\Office10
2007-12-07 13:04 --------- d-----w C:\Program Files\ScanSoft
2007-12-07 12:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-07 12:42 --------- d-----w C:\Program Files\Google
2007-12-07 12:39 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2007-12-07 12:39 --------- d-----w C:\Program Files\LimeWire
2007-12-07 12:38 --------- d-----w C:\Program Files\Java
2007-12-07 12:38 --------- d-----w C:\Program Files\eMule
2007-12-07 12:35 --------- d-----w C:\Program Files\OpenOffice
2007-11-14 19:35 --------- d-----w C:\Program Files\Soldier of Fortune II - Double Helix
2007-07-10 15:42 132,895 ----a-w C:\WINDOWS\Fonts\kiralynn.zip
2007-07-10 15:41 319,491 ----a-w C:\WINDOWS\Fonts\epoxy_history.zip
2007-07-10 15:36 89,933 ----a-w C:\WINDOWS\Fonts\bleeding_cowboys.zip
2007-07-10 15:36 824,904 ----a-w C:\WINDOWS\Fonts\wc_wunderbach_mix_bta.zip
.

((((((((((((((((((((((((((((( snapshot_2008-01-13_16.53.20.49 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-13 15:35:33 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-01-13 19:08:30 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
- 2008-01-13 15:35:33 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-01-13 19:08:30 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-01-13 15:35:33 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
+ 2008-01-13 19:08:30 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
- 2008-01-13 15:35:33 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
+ 2008-01-13 19:08:30 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
- 2008-01-13 15:35:33 3,366,912 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT
+ 2008-01-13 19:08:30 3,403,776 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT
- 2008-01-13 15:35:34 368,640 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
+ 2008-01-13 19:08:30 368,640 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-12-03 13:21 3461120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 10:52 221184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-14 21:59 282624]
"DNS7reminder"="C:\Program Files\ScanSoft\NaturallySpeaking\Program\Ereg.exe" [2003-07-30 18:16 729088]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-12 18:31 249896]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-13 11:14 737872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{E8057263-0964-1036-0620-030305160021}"= "C:\Program Files\Fichiers communs\{E8057263-0964-1036-0620-030305160021}\Update.exe" mc-110-12-0001411

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^officejet 6100.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\officejet 6100.lnk
backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Thalia^Menu Démarrer^Programmes^Démarrage^Dragon NaturallySpeaking.lnk]
path=C:\Documents and Settings\Thalia\Menu Démarrer\Programmes\Démarrage\Dragon NaturallySpeaking.lnk
backup=C:\WINDOWS\pss\Dragon NaturallySpeaking.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
--a------ 2002-10-15 18:00 1818624 C:\WINDOWS\mixer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-09-25 17:50 20053544 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ClipSrv"=3 (0x3)
"Adobe LM Service"=3 (0x3)

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [2007-07-18 14:22]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04]
S0 spzcbjps;spzcbjps;C:\WINDOWS\System32\drivers\uymskeub.dat []
S2 ozllihqp;AGP Bus z75d8 Monitor;C:\WINDOWS\System32\svchost.exe [2001-08-28 13:00]
S3 o1394bul;o1394bul;C:\DOCUME~1\Thalia\LOCALS~1\Temp\o1394bul.sys []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ozllihqp

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-13 20:15:11
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-13 20:21:32 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-13 19:21:29
ComboFix2.txt 2008-01-13 15:53:41
ComboFix3.txt 2008-01-13 12:29:59

ep44 · Answer

oui en effet beaucoup mieux ;-))

Télécharge:
http://www.grisoft.cz/filedir/inst/avgas-setup-7.5.1.43.exe AVG-AntiSpyware

=> Installer
=> Le lancer
=> Clic : Mise à jour
------
= Redémarre en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistre ou imprime les consignes.

Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
=> Dans ANALYSE ( en forme de loupe )
=> Paramètres ==> sous COMMENT REAGIR==>clic sur Actions recommandées ==>Quarantaine
=> Clic : Analyse complète du système
-------
=> à la fin du scan ( qui est assez long)
=> Clic Appliquer toutes les actions <== ceci Très important
=> Clic Sauvegarder rapport puis Enregistrer sous et choisir bureau
-------
En mode normal
colle le rapport

TR/BHO.agz.32 et TR/Crypt.Morphine.Gen

11 réponses

Votre réponse

Discussions similaires

Newsletters