Virus win 32 bho

seb -  
g!rly Messages postés 18462 Statut Contributeur -
Bonjour,
j'ai moi aussi un probleme avec avast qui detecte le virus
win 32 bho kd
mais avast n'arrive pas a le detecte, merci pour votre aide.
Configuration: Windows XP
Internet Explorer 6.0

9 réponses

  1.
    g!rly Messages postés 18462 Statut Contributeur 407
     
    salut seb,

    Télécharge combofix.exe (par sUBs) sur ton Bureau.

    -> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    -> Double clique combofix.exe.
    -> Tape sur la touche 1 (Yes) pour démarrer le scan.
    -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

    NOTE : Le rapport se trouve également ici : C:\Combofix.txt

    et

    Télécharge HijackThis ici :

    -> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

    Tutoriel d´utilisation (video) :

    -> http://pageperso.aol.fr/balltrap34/demohijack.htm

    Post le rapport généré ici stp...

    ps : fais le hijack this apres avoir passé combofix et post les rapports

    @+
    0
  2. seb
     
    ci pour ton aide, voici le premier rapport:
    ComboFix 08-01-18.5 - YVES 2008-01-18 22:38:32.2 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.477 [GMT 1:00]
    Running from: D:\DOCUME~1\YVES\MESDOC~1\combofix.exe
    * Created a new restore point

    [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
    .

    ((((((((((((((((((((((((((((( Fichiers créés 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))))))))
    .

    2008-01-18 22:08 . 2008-01-18 22:06 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
    2008-01-18 22:06 . 2008-01-18 22:09 <REP> d-------- C:\Documents and Settings\YVES\.housecall6.6
    2008-01-18 22:05 . 2008-01-18 22:05 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
    2008-01-18 22:05 . 2008-01-18 22:05 286,720 --a------ C:\WINDOWS\PATCH.EXE
    2008-01-18 22:05 . 2008-01-18 22:05 69,689 --a------ C:\WINDOWS\UNZIP.DLL
    2008-01-18 22:05 . 2008-01-18 22:05 40 --a------ C:\WINDOWS\TSC.INI
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d--h----- C:\Documents and Settings\Administrateur.LABOMBE.004\Voisinage réseau
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d--h----- C:\Documents and Settings\Administrateur.LABOMBE.004\Voisinage d'impression
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.004\Mes documents
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> dr------- C:\Documents and Settings\Administrateur.LABOMBE.004\Menu Démarrer
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.004\Favoris
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.004\Bureau
    2008-01-18 21:42 . 2008-01-18 21:42 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logishrd
    2008-01-18 21:39 . 2008-01-18 21:39 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
    2008-01-18 21:39 . 2008-01-18 21:39 <REP> d-------- C:\Program Files\Fichiers communs\Ankiro
    2008-01-18 21:39 . 2008-01-18 21:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
    2008-01-18 21:17 . 2008-01-18 21:25 <REP> d--h----- C:\Documents and Settings\Administrateur.LABOMBE.004\Modèles
    2008-01-17 17:59 . 2007-07-01 04:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-01-17 17:59 . 2007-07-01 04:36 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-01-17 17:58 . 2008-01-17 18:00 <REP> d-------- C:\WINDOWS\system32\fr-fr
    2008-01-17 17:07 . 2008-01-18 21:36 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.003\Modèles
    2008-01-17 16:57 . 2008-01-18 21:37 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.002\Modèles
    2008-01-16 22:08 . 2008-01-16 22:08 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared
    2008-01-12 13:38 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
    2008-01-12 13:38 . 2008-01-12 13:40 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2008-01-12 13:37 . 2008-01-18 21:39 <REP> d-------- C:\WINDOWS\Internet Logs
    2008-01-12 12:53 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2008-01-12 12:32 . 2008-01-12 12:32 <REP> d-------- C:\Program Files\Axis Communications
    2008-01-11 22:27 . 2008-01-18 21:39 <REP> d-------- C:\Documents and Settings\YVES\Application Data\SPAMfighter
    2008-01-11 21:26 . 2008-01-18 21:38 <REP> d-------- C:\Program Files\Windows Live Safety Center
    2008-01-11 19:03 . 2008-01-11 19:03 <REP> d-------- C:\Program Files\Fichiers communs\Application
    2008-01-10 21:26 . 2008-01-10 21:26 <REP> d-------- C:\WINDOWS\.jagex_cache_32
    2008-01-06 21:21 . 2008-01-06 21:21 94,208 --a------ C:\WINDOWS\system32\ScrUnZip.dll
    2007-12-28 23:24 . 2007-12-28 23:24 <REP> d-------- C:\Documents and Settings\YVES\Application Data\dvdcss
    2007-12-24 18:47 . 19,456 C:\WINDOWS\system32\drivers\aeiqcdma.dat
    2007-12-24 18:45 . 2004-08-05 13:00 84,992 --a------ C:\WINDOWS\system32\avica.dll
    2007-12-22 22:27 . 2007-12-22 22:27 528 -r-hs---- C:\WINDOWS\egirllic15
    2007-12-22 22:21 . 2007-12-22 22:21 <REP> d-------- C:\Program Files\Pineapple Works
    2007-12-18 15:46 . 2007-12-18 15:46 319,488 --a------ C:\WINDOWS\system32\adssite_sidebar.dll

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-18 21:37 --------- d-----w C:\Program Files\Wanadoo
    2008-01-18 20:49 --------- d-----w C:\Program Files\eMule
    2008-01-18 20:42 --------- d-----w C:\Program Files\Fichiers communs\LogiShrd
    2008-01-18 17:39 --------- d-----w C:\Program Files\Logitech
    2008-01-16 21:13 --------- d-----w C:\Program Files\Fichiers communs\Adobe
    2008-01-16 21:10 --------- d-----w C:\Program Files\OCCT
    2008-01-16 10:30 77,353 ----a-w C:\WINDOWS\system32\adssite_sidebar_uninstall.exe
    2008-01-15 18:46 --------- d-----w C:\Documents and Settings\YVES\Application Data\LimeWire
    2008-01-08 17:29 --------- d-----w C:\Documents and Settings\YVES\Application Data\OpenOffice.org2
    2007-12-22 21:42 --------- d-----w C:\Program Files\LimeWire
    2007-12-22 10:46 --------- d-----w C:\Program Files\Java
    2007-12-14 19:31 --------- d-----w C:\Documents and Settings\YVES\Application Data\InterTrust
    2007-12-13 18:29 --------- d-----w C:\Documents and Settings\YVES\Application Data\MSNInstaller
    2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
    2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
    2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
    2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
    2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
    2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
    2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
    2007-12-04 11:50 79,868 ----a-w C:\WINDOWS\system32\adssite-remove.exe
    2007-12-01 19:41 --------- d-----w C:\Program Files\Ahead
    2007-12-01 19:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
    2007-11-30 19:06 --------- d-----w C:\Documents and Settings\YVES\Application Data\XnView
    2007-11-30 18:43 --------- d-----w C:\Documents and Settings\YVES\Application Data\gtk-2.0
    2007-11-26 17:34 1,635,755 ----a-w C:\WINDOWS\YZ-Models.scr
    2007-11-21 20:51 --------- d-----w C:\Program Files\Fichiers communs\Ahead
    2007-11-19 11:29 --------- d-----w C:\Program Files\AskTBar
    2007-11-03 17:58 25,064 ----a-w C:\Documents and Settings\YVES\Application Data\GDIPFONTCACHEV1.DAT
    2007-10-09 17:27 125,677,130 ------w C:\Program Files\ooo_2.3.0_win32intel_install_wjre_fr.exe
    2007-09-20 18:12 4,164,698 ----a-w C:\Program Files\Limewire Lime Wire Pro 4.12.3.zip
    2007-09-13 15:11 4,301,387 ----a-w C:\Program Files\shareaza_2.2.5.0.exe
    2007-09-13 12:28 3,534,076 ------w C:\Program Files\instala-emuleplus.exe
    2007-09-12 19:31 3,378,248 ----a-w C:\Program Files\limewirewin.exe
    2004-08-05 12:00 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
    2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
    2004-08-05 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
    2004-08-05 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
    2007-05-17 11:29 549,376 --sha-w C:\WINDOWS\system32\oleaut32.dll
    2004-08-05 12:00 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
    2004-08-05 12:00 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}]
    2007-12-18 15:46 319488 --a------ C:\WINDOWS\system32\adssite_sidebar.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C8A568E-4201-478a-8536-526CF371D2E2}]
    C:\WINDOWS\system32\nsnA.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F2111E43-332E-4678-97CD-6D9794910FA9}]
    2004-08-05 13:00 84992 --a------ C:\WINDOWS\system32\avica.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
    @={E4000AC4-5E5F-4956-807A-C5854405D64F}

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-22 16:10 1871872]
    "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 13:50 122880]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
    "Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2007-02-05 03:05 4354048]
    "Btet"="C:\PROGRA~1\COMMON~1\SSEMBL~1\dexplore.exe" [ ]
    "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2006-09-14 15:15 5001216]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan"="SOUNDMAN.EXE" [2005-04-15 04:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-10-10 20:49 7286784]
    "nwiz"="nwiz.exe" [2005-10-10 20:49 1519616 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-10-10 20:49 86016]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
    "EPSON Stylus DX4800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.exe" [2005-02-02 05:00 98304]
    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49 20480]
    "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55 32768]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 00:12 488984]
    "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 00:13 774168]
    "{F7-78-81-15-ZN}"="C:\windows\system32\kpdsrngp.exe" [ ]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "SPAMfighter Agent"="E:\Program Files\SPAMfighter\SFAgent.exe" [2008-01-02 17:03 308880]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]

    C:\Documents and Settings\YVES\Menu D‚marrer\Programmes\D‚marrage\
    VirtualExpander.lnk - C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe [2007-10-02 19:22:47]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

    R0 xhiomydp;xhiomydp;C:\WINDOWS\system32\drivers\aeiqcdma.dat []
    R2 SPAMfighter Update Service;SPAMfighter Update Service;"E:\Program Files\SPAMfighter\sfus.exe" [2008-01-02 17:03]
    S3 CrystalCpuInfo;CrystalCpuInfo;C:\Program Files\OCCT\CpuInfo.sys [2003-11-25 06:50]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fb63638-495a-11db-975f-806d6172696f}]
    \Shell\AutoRun\command - G:\ASUSACPI.exe

    *Newly Created Service* - TMCOMM
    .
    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
    "2008-01-18 14:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
    - C:\Program Files\Norton Security Scan\Nss.exe
    "2008-01-18 21:12:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-18 22:41:13
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-18 22:42:13
    .
    2007-09-06 20:19:20 --- E O F ---
    0
  3. seb
     
    et voici le deuxieme rapport:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:45:53, on 18/01/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    E:\Program Files\SPAMfighter\sfus.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    E:\Program Files\SPAMfighter\SFAgent.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Shareaza\Shareaza.exe
    C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
    C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
    C:\WINDOWS\explorer.exe
    C:\PROGRA~1\Wanadoo\WOOBRO~1\DownloadManager.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.icrfast.com/index.php?rvs=hompag
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Adssite Search Assistant - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - C:\WINDOWS\system32\adssite_sidebar.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: ads_optimizer - {9C8A568E-4201-478a-8536-526CF371D2E2} - C:\WINDOWS\system32\nsnA.dll (file missing)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O2 - BHO: (no name) - {F2111E43-332E-4678-97CD-6D9794910FA9} - C:\WINDOWS\system32\avica.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
    O4 - HKLM\..\Run: [{F7-78-81-15-ZN}] C:\windows\system32\kpdsrngp.exe P2D002
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SPAMfighter Agent] "E:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
    O4 - HKCU\..\Run: [Btet] "C:\PROGRA~1\COMMON~1\SSEMBL~1\dexplore.exe" --ru -vt yazb
    O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://chamrousse.dyndns.org/activex/AMC.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - E:\Program Files\SPAMfighter\sfus.exe
    0
  4. g!rly Messages postés 18462 Statut Contributeur 407
     
    re,

    instales un des par feu ci dessous :

    par feu : kerio

    http://www.malekal.com/kerio_firewall.php#mozTocId721480

    https://www.vulgarisation-informatique.com/kerio.php

    ou zone alarm plus facil a configurer mais moins performant

    http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

    et

    regarde ceci concernant avast :

    antivir vs avast :

    -> http://forum.malekal.com/ftopic3528.php

    alors je te conseille de le desinstaller et d´installer antivir a la place

    Telecharge et instal l'antivirus Antivir Personal Edition Classic :

    ->https://www.malekal.com/avira-free-security-antivirus-gratuit/

    https://www.avira.com/en/prime

    http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner...

    une fois antivir ouvert click sur configuration puis coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
    puis click sur configuration en haut a droite puis dans la nouvelle fenetre a gauche >scanner > scan all files et en dessous >scanner priority = High
    toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

    tu surf avec internet explorer 6.0 = failles de securitées importantes

    alors fais les mises a jour windows : tu veux la version 7.0

    et pourquoi ne pas surfer avec firefox? = plus sur, tout en gardant ie 7.0 pour les mises a jour windows car impossible a effectuer sous firefox

    http://www.firefox.fr/

    Copie le texte ci-dessous :

    File::
    C:\WINDOWS\system32\adssite_sidebar.dll
    C:\WINDOWS\system32\nsnA.dll
    C:\WINDOWS\system32\avica.dll
    C:\PROGRA~1\COMMON~1\SSEMBL~1\dexplore.exe
    C:\windows\system32\kpdsrngp.exe
    C:\WINDOWS\system32\drivers\aeiqcdma.dat
    C:\WINDOWS\Tasks\Norton Security Scan.job
    C:\Program Files\Norton Security Scan\Nss.exe
    C:\WINDOWS\system32\adssite_sidebar_uninstall.exe
    C:\WINDOWS\System32\FTRTSVC.exe

    Folder::
    C:\Program Files\Norton Security Scan
    C:\Program Files\AskTBar

    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}]
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9C8A568E-4201-478a-8536-526CF371D2E2}]
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F2111E43-332E-4678-97CD-6D9794910FA9}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Btet"=-
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "{F7-78-81-15-ZN}"=-

    driver::
    xhiomydp

    Ouvre le Bloc-Notes puis colle le texte copié.
    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    Sauvegarde ce fichier sous le nom de CFScript.txt.

    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

    http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

    Cela va relancer Combofix,

    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

    Ne touche à rien tant que le scan n'est pas terminé.

    Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

    S'il n'y a pas de rédémarrage, poste quand même les rapports.

    @+
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. yves
     
    ComboFix 08-02.05.3 - YVES 2008-02-05 18:29:24.4 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.573 [GMT 1:00]
    Endroit: D:\Documents and Settings\YVES\Mes documents\combofix.exe

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    C:\Program Files\AskTBar
    C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL
    C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
    C:\Program Files\AskTBar\bar\Cache\[u]0[/u]004DB39.bin
    C:\Program Files\AskTBar\bar\Cache\[u]0[/u]004DD9B.bin
    C:\Program Files\AskTBar\bar\Cache\[u]0[/u]004DED3.bin
    C:\Program Files\AskTBar\bar\Cache\[u]0[/u]01D012B
    C:\Program Files\AskTBar\bar\Cache\[u]0[/u]21EFB5B
    C:\Program Files\AskTBar\bar\Cache\files.ini
    C:\Program Files\AskTBar\bar\History\search2
    C:\Program Files\AskTBar\bar\Settings\prevcfg2.htm
    C:\Program Files\AskTBar\PopSwatr\History\allowed
    C:\Program Files\AskTBar\PopSwatr\History\notallow
    C:\WINDOWS\system32\adssite_sidebar.dll
    C:\WINDOWS\system32\adssite_sidebar_uninstall.exe
    C:\WINDOWS\system32\avica.dll
    C:\WINDOWS\system32\drivers\aeiqcdma.dat
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\WINDOWS\Tasks\Norton Security Scan.job

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_XHIOMYDP
    -------\xhiomydp

    ((((((((((((((((((((((((((((( Fichiers créés 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))))))))))))
    .

    2008-02-05 17:52 . 2008-02-05 17:52 <REP> d-------- C:\Program Files\Avira
    2008-02-05 17:52 . 2008-02-05 17:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
    2008-02-04 13:51 . 2008-02-04 14:26 812 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
    2008-02-03 18:38 . 2008-02-03 19:29 0 --a------ C:\FileOut.Cns
    2008-02-03 18:38 . 2008-02-03 19:29 0 --a------ C:\FileIn.Cns
    2008-02-02 10:47 . 2008-02-02 10:47 46,300 --a------ C:\WINDOWS\system32\AdssiteSocial-uninstall.exe
    2008-01-19 17:32 . 2008-01-19 17:32 <REP> d-------- C:\Program Files\Sunbelt Software
    2008-01-19 11:47 . 2007-10-11 00:49 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-01-19 11:47 . 2007-10-11 00:49 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-01-19 11:47 . 2007-10-11 00:49 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-01-19 11:47 . 2007-10-11 00:49 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-01-19 11:47 . 2007-10-11 00:49 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-01-19 11:47 . 2007-10-11 00:49 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-01-19 11:47 . 2007-10-10 11:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-01-19 10:37 . 2008-02-04 19:29 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
    2008-01-19 10:37 . 2008-01-19 10:37 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
    2008-01-19 10:37 . 2008-02-04 19:29 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-01-18 22:45 . 2008-01-18 22:45 <REP> d-------- C:\Program Files\Trend Micro
    2008-01-18 22:08 . 2008-01-18 22:06 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
    2008-01-18 22:06 . 2008-01-18 22:09 <REP> d-------- C:\Documents and Settings\YVES\.housecall6.6
    2008-01-18 22:05 . 2008-01-18 22:05 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
    2008-01-18 22:05 . 2008-01-18 22:05 286,720 --a------ C:\WINDOWS\PATCH.EXE
    2008-01-18 22:05 . 2008-01-18 22:05 69,689 --a------ C:\WINDOWS\UNZIP.DLL
    2008-01-18 22:05 . 2008-01-18 22:05 40 --a------ C:\WINDOWS\TSC.INI
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d--h----- C:\Documents and Settings\Administrateur.LABOMBE.004\Voisinage réseau
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d--h----- C:\Documents and Settings\Administrateur.LABOMBE.004\Voisinage d'impression
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.004\Mes documents
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> dr------- C:\Documents and Settings\Administrateur.LABOMBE.004\Menu Démarrer
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.004\Favoris
    2008-01-18 21:47 . 2008-01-18 21:47 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.004\Bureau
    2008-01-18 21:39 . 2008-01-18 21:39 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
    2008-01-18 21:39 . 2008-01-18 21:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
    2008-01-18 21:17 . 2008-01-18 21:25 <REP> d--h----- C:\Documents and Settings\Administrateur.LABOMBE.004\Modèles
    2008-01-18 11:06 . 2008-01-18 11:06 294,912 --a------ C:\WINDOWS\system32\iebrowserc.dll
    2008-01-17 17:59 . 2007-07-01 04:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-01-17 17:59 . 2007-07-01 04:36 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-01-17 17:58 . 2008-01-17 18:00 <REP> d-------- C:\WINDOWS\system32\fr-fr
    2008-01-17 17:07 . 2008-01-18 21:36 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.003\Modèles
    2008-01-17 16:57 . 2008-01-18 21:37 <REP> d-------- C:\Documents and Settings\Administrateur.LABOMBE.002\Modèles
    2008-01-16 22:08 . 2008-01-16 22:08 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared
    2008-01-12 13:38 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
    2008-01-12 13:38 . 2008-01-12 13:40 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2008-01-12 13:37 . 2008-01-18 21:39 <REP> d-------- C:\WINDOWS\Internet Logs
    2008-01-12 12:32 . 2008-01-12 12:32 <REP> d-------- C:\Program Files\Axis Communications
    2008-01-11 22:27 . 2008-01-18 21:39 <REP> d-------- C:\Documents and Settings\YVES\Application Data\SPAMfighter
    2008-01-11 21:26 . 2008-01-18 21:38 <REP> d-------- C:\Program Files\Windows Live Safety Center
    2008-01-10 21:26 . 2008-01-10 21:26 <REP> d-------- C:\WINDOWS\.jagex_cache_32
    2008-01-06 21:21 . 2008-01-06 21:21 94,208 --a------ C:\WINDOWS\system32\ScrUnZip.dll

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-05 17:25 --------- d-----w C:\Program Files\Wanadoo
    2008-02-05 17:24 --------- d-----w C:\Program Files\eMule
    2008-01-31 21:26 --------- d-----w C:\Documents and Settings\YVES\Application Data\OpenOffice.org2
    2008-01-25 21:50 --------- d-----w C:\Program Files\Fichiers communs\Adobe
    2008-01-24 13:03 --------- d-----w C:\Documents and Settings\YVES\Application Data\LimeWire
    2008-01-18 17:39 --------- d-----w C:\Program Files\Logitech
    2008-01-16 21:10 --------- d-----w C:\Program Files\OCCT
    2007-12-28 22:24 --------- d-----w C:\Documents and Settings\YVES\Application Data\dvdcss
    2007-12-22 21:42 --------- d-----w C:\Program Files\LimeWire
    2007-12-22 10:46 --------- d-----w C:\Program Files\Java
    2007-12-14 19:31 --------- d-----w C:\Documents and Settings\YVES\Application Data\InterTrust
    2007-12-13 18:29 --------- d-----w C:\Documents and Settings\YVES\Application Data\MSNInstaller
    2007-12-04 11:50 79,868 ----a-w C:\WINDOWS\system32\adssite-remove.exe
    2007-11-26 17:34 1,635,755 ----a-w C:\WINDOWS\YZ-Models.scr
    2007-11-07 09:28 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll
    2007-11-03 17:58 25,064 ----a-w C:\Documents and Settings\YVES\Application Data\GDIPFONTCACHEV1.DAT
    2004-08-05 12:00 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
    2006-08-25 15:51 617,472 --sha-w C:\WINDOWS\system32\comctl32.dll
    2004-08-05 12:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
    2004-08-05 12:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
    2007-05-17 11:29 549,376 --sha-w C:\WINDOWS\system32\oleaut32.dll
    2004-08-05 12:00 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
    2004-08-05 12:00 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}]
    2008-01-18 11:06 294912 --a------ C:\WINDOWS\system32\iebrowserc.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
    @={E4000AC4-5E5F-4956-807A-C5854405D64F}

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-22 16:10 1871872]
    "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 13:50 122880]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55 5674352]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
    "Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2007-02-05 03:05 4354048]
    "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2006-09-14 15:15 5001216]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan"="SOUNDMAN.EXE" [2005-04-15 04:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-10-10 20:49 7286784]
    "nwiz"="nwiz.exe" [2005-10-10 20:49 1519616 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-10-10 20:49 86016]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
    "EPSON Stylus DX4800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.exe" [2005-02-02 05:00 98304]
    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49 20480]
    "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55 32768]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-05 18:03 249896]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]

    C:\Documents and Settings\YVES\Menu D‚marrer\Programmes\D‚marrage\
    VirtualExpander.lnk - C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe [2007-10-02 19:22:47 474808]

    C:\Documents and Settings\YVES\Menu D‚marrer\Programmes\D‚marrage\
    VirtualExpander.lnk - C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe [2007-10-02 19:22:47 474808]

    C:\Documents and Settings\YVES\Menu D‚marrer\Programmes\D‚marrage\
    VirtualExpander.lnk - C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe [2007-10-02 19:22:47 474808]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

    R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
    R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
    R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21]
    S3 CrystalCpuInfo;CrystalCpuInfo;C:\Program Files\OCCT\CpuInfo.sys [2003-11-25 06:50]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fb63638-495a-11db-975f-806d6172696f}]
    \Shell\AutoRun\command - G:\ASUSACPI.exe

    *Newly Created Service* - SSMDRV
    .
    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
    "2008-02-05 17:12:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-05 18:33:29
    Windows 5.1.2600 Service Pack 2 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-02-05 18:35:18
    ComboFix-quarantined-files.txt 2008-02-05 17:35:11
    ComboFix2.txt 2008-01-18 21:42:14
    .
    2008-01-19 10:52:04 --- E O F ---
    0
  7. yves
     
    j'ai ete un peu long car j'etais parti.
    encore merci pour tout, voici le 2 em rapport:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:40, on 2008-02-05
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Shareaza\Shareaza.exe
    C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
    C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.icrfast.com/index.php?rvs=hompag
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\WINDOWS\system32\iebrowserc.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
    O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - S-1-5-18 Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe (User 'Default user')
    O4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://chamrousse.dyndns.org/activex/AMC.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - Unknown owner - C:\WINDOWS\System32\FTRTSVC.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe (file missing)
    O23 - Service: LVSrvLauncher - Unknown owner - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe (file missing)
    O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    0
  8. g!rly Messages postés 18462 Statut Contributeur 407
     
    salut,

    merci de prevenir quand tu change de pseudo!

    seb = yves ??

    @+
    0
  9. yves
     
    desole pour le changement de prenom c'etait commence au nom du fiston.
    encore merci pour tout et je donnerai des nouvelles si tout va bien ou mm si ca deconne encore.
    merci et a bientot.
    0
  10. g!rly Messages postés 18462 Statut Contributeur 407
     
    ok

    je me disait bien que c´etait la meme personne; maintenant les choses sont claires ;-)

    on continue :

    ca te dis quelque chose ceci : VirtualExpander ?

    Copie le texte ci-dessous :

    File::
    C:\WINDOWS\system32\iebrowserc.dll

    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}]

    Ouvre le Bloc-Notes puis colle le texte copié.
    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    Sauvegarde ce fichier sous le nom de CFScript.txt.

    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

    http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

    Cela va relancer Combofix,

    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

    Ne touche à rien tant que le scan n'est pas terminé.

    Après redémarrage, poste le contenu du rapport Combofix.txt

    @+
    0

Discussions similaires

Adobe acrobat fich api-ms-win-core-winrt-l1-1-0.dll manquant
crinik2002 -
fabul -

41 réponses
Chrome://newtab
Nova -
snoopy35_ -

14 réponses
svp 32Gb est il egal a 32Go??
William Fernand -
nemrod18 -

3 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses