Trojans Worms/ntech et TR/pandex - Page 5

re,

oui alors supprime tous le dossier de network associate.

pour deamon tool, j´aimerais bien entendre ce que moe pensse du driver, alors on va attendre son avis ;-)

ok pour antivir, post le rapport demain.

on va encore attendre pour mettre le topik en résolu.

bonne soirée`

@+

G!rly

j'ai fait le ménage, je lance antivir et je te poste le résultat demain.

Au fait, il fait quoi COMBO ?

bonne nuit à demain

fch22,

combofix il m´aime beaucoup :D

ok pour antivir

@ demain`

bonne nuit egalement ;-)

Resalut à tous les deux :-)

fch22, concernant sptd.sys et si tu es sur et certain de ne plus avoir Daemon tools ou alcohol 120 d'installé, il ne te sert plus à grand chose je pense.

Donc G!rly puisque tu voulais mon avis, si fch22 souhaite pousser le nettoyage jusque là, on peut le supprimer en passant par Combofix, je ne crois pas que ça posera un problème particulier à Combo, alors si en plus il t'aime beaucoup il fera çà avec le plus grand soin, j'en suis certain lol :-p
Qu'est-ce que tu en pense ?

Si tout les feux sont aux vert pour fch22 et pour toi aussi G!rly, voilà un exemple de ce qui peut se faire :

Ouvre le Menu Démarrer > Exécuter
Dans la boîte de dialogue, copie/colle tout ce qui est ci-dessous en gras :
fsutil file createnew "%userprofile%\bureau\CFScript.txt" 0
Puis valide

Reviens sur ton bureau puis ouvre le fichier CFScript.txt
Copie et colle à l'intérieur absolument tout ce qui est en bleu ci-dessous :

Driver::
sptd

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nru68.sys]

File::
C:\Windows\system32\drivers\sptd.sys 

Dans le menu du bloc notes, clic ensuite sur 'Fichier' puis sur "Enregistrer"

Referme le bloc notes, puis déplace et relache le fichier CFScript.txt qui se trouve sur le bureau sur l'icône de combofix.exe, exactement comme si tu voulais déposer ce fichier dans un dossier.
Laisse ensuite bosser Combofix et poste le rapport qui sera généré.

Voilou, bonne fin de soirée à vous deux.

@++

bonsoir,

voici le rapport du dernier scan,

Moe, je regarde ton post demain soir , en attendant bonne nuit et merci à vous pour votre support

AntiVir PersonalEdition Classic
Report file date: jeudi 7 février 2008 21:25

Scanning for 1092968 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: FAMILLE

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 22:37:06
ANTIVIR2.VDF : 7.0.2.49 1339904 Bytes 25/01/2008 09:12:33
ANTIVIR3.VDF : 7.0.2.94 307200 Bytes 05/02/2008 12:37:25
AVEWIN32.DLL : 7.6.0.62 3240448 Bytes 03/02/2008 11:58:44
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 23/01/2008 22:37:08
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: quarantine
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: jeudi 7 février 2008 21:25

Starting search for hidden objects.
'80613' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'FINDFAST.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'QuickAccess.exe' - '1' Module(s) have been scanned
Scan process 'apdproxy.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'WinPatrol.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'AOSD.EXE' - '1' Module(s) have been scanned
Scan process 'opware32.exe' - '1' Module(s) have been scanned
Scan process 'ABOARD.EXE' - '1' Module(s) have been scanned
Scan process 'PCMService.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'slrundll.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'fxssvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'slserv.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'AOLacsd.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
42 processes with 42 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[NOTE] No virus was found!
[WARNING] The boot sector file could not be read!
[WARNING] Error code: 0x0083
Master boot sector HD1
[NOTE] No virus was found!
[WARNING] The boot sector file could not be read!
[WARNING] Error code: 0x0015
Master boot sector HD2
[NOTE] No virus was found!
[WARNING] The boot sector file could not be read!
[WARNING] Error code: 0x0015
Master boot sector HD3
[NOTE] No virus was found!
[WARNING] The boot sector file could not be read!
[WARNING] Error code: 0x0015
Master boot sector HD4
[NOTE] No virus was found!
[WARNING] The boot sector file could not be read!
[WARNING] Error code: 0x0015

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '30' files ).

Starting the file scan:

Begin scan in 'C:\' <HDD>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!

End of the scan: jeudi 7 février 2008 22:38
Used time: 1:12:30 min

The scan has been done completely.

11494 Scanning directories
451516 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
451516 Files not concerned
11295 Archives were scanned
3 Warnings
1 Notes
80613 Objects were scanned with rootkit scan
0 Hidden objects were found

Bonjour,

voici le rapport

ComboFix 08-01-29.3 - parents 2008-02-09 9:44:45.7 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.73 [GMT 1:00]
Endroit: C:\Documents and Settings\parents\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\parents\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

FILE
C:\Windows\system32\drivers\sptd.sys
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\drivers\sptd.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SPTD
-------\sptd

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-09 to 2008-02-09 ))))))))))))))))))))))))))))))))))))
.

2008-02-07 19:38 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-06 21:44 . 2008-02-06 21:44 <REP> d-------- C:\Program Files\CCleaner
2008-02-06 17:00 . 2008-02-06 17:00 <REP> d-------- C:\Documents and Settings\ronan\Application Data\Grisoft
2008-02-05 18:24 . 2008-02-05 18:24 65 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2008-01-30 07:21 . 2008-01-30 07:21 <REP> d-------- C:\Documents and Settings\parents\Application Data\Grisoft
2008-01-30 07:21 . 2008-01-30 07:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-30 07:21 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-29 23:59 . 2008-01-29 23:59 <REP> d-------- C:\Program Files\Kerio
2008-01-29 23:18 . 2008-01-29 23:18 <REP> d-------- C:\WINDOWS\ERUNT
2008-01-29 21:49 . 2008-02-09 12:13 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-29 21:49 . 2008-01-29 21:49 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-27 13:43 . 2008-01-27 13:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-01-23 23:30 . 2008-01-23 23:30 <REP> d-------- C:\Program Files\Avira
2008-01-23 23:30 . 2008-01-23 23:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-23 19:10 . 2008-01-27 13:47 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-01-23 19:04 . 2008-01-27 13:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-01-22 19:40 . 2008-01-22 19:40 <REP> d-------- C:\Program Files\Trend Micro

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 12:13 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-02-07 18:41 --------- d-----w C:\Program Files\Java
2008-02-06 20:58 --------- d-----w C:\Program Files\Nvu
2008-02-06 16:00 --------- d-----w C:\Documents and Settings\ronan\Application Data\OpenOffice.org2
2008-02-06 10:00 --------- d-----w C:\Documents and Settings\parents\Application Data\Canon
2008-02-05 18:57 --------- d-----w C:\Documents and Settings\parents\Application Data\OpenOffice.org2
2008-02-02 13:08 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-02 12:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Network Associates
2008-01-27 12:44 --------- d-----w C:\Program Files\Neuf
2008-01-27 12:37 --------- d-----w C:\Program Files\Mindscape
2008-01-27 12:35 --------- d-----w C:\Program Files\Audio MP3 Converter
2008-01-27 09:57 --------- d-----w C:\Program Files\SuperCopier2
2008-01-27 09:45 --------- d-----w C:\Program Files\AtomixMP3
2008-01-01 22:43 --------- d-----w C:\Documents and Settings\parents\Application Data\Skyline
2008-01-01 10:47 --------- d-----w C:\Program Files\Intuisphere
2007-12-13 15:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\pixelStorm
2005-06-25 08:20 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin
2004-08-05 13:00 65,024 --sha-w C:\WINDOWS\system32\asycfilt.dll
2004-08-05 13:00 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-05 13:00 57,344 --sha-w C:\WINDOWS\system32\mfc42loc.dll
2004-08-05 13:00 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-05 13:00 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2004-08-05 13:00 253,952 --sha-w C:\WINDOWS\system32\msvcrt20.dll
2007-05-17 11:29 549,376 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-05 13:00 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-05 13:00 30,749 --sha-w C:\WINDOWS\system32\vbajet32.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Configuration de la C-BOX"="C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe" [2004-12-21 18:17 395264]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 10:57 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 14:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
"ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-12 21:10 339968]
"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2004-10-08 03:14 81920]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 10:31 24576]
"Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 10:38 49152]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-01-20 08:52 180269]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 16:26 406016]
"WinPatrol"="C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe" [2005-08-31 14:41 222784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 08:18 270648]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-23 23:37 249896]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
"DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" [ ]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-10-18 16:36]
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [1998-08-22 11:00]
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S2 ssoftnt4;ssoftnt4;C:\WINDOWS\system32\Drivers\ssoftnt4.sys []
S3 38a530a3-8412-4567-b27d-ba7003797791;38a530a3-8412-4567-b27d-ba7003797791;D:\Player\cds300.dll []
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 12:12]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 12:12]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 12:12]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 12:12]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 12:12]
S3 ovt530;Webcam Classic;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 16:04]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 21:41]
S3 VRETRACE;VRETRACE;C:\DOCUME~1\parents\LOCALS~1\Temp\VRETRACE.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 12:12:42
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Hercules\WebCam Station\PhotoImpression\share\pihook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\slrundll.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\microsoft office\Office\FINDFAST.EXE
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-09 12:19:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-09 11:19:15
ComboFix2.txt 2008-02-06 23:03:04
ComboFix3.txt 2008-02-06 20:40:15
ComboFix4.txt 2008-01-29 23:38:10
ComboFix5.txt 2008-01-29 21:58:05
.
2008-01-27 09:13:26 --- E O F ---

Bonjour Fch22,

Super ;-)

Je crois que notre collaboration se termine ici !

Dis moi quoi.

@+

Bonjour G!rly

Un grand merci à toi et à tous ceux qui m'ont aidé. Une équipe super efficace et compétente.

Je vais clore le topic , mais j'ai une dernière question:

J'ai maintenant Kerio, Antivir, AVG, et AD-Aware SE, est-ce une protection efficace ?

Comme résumé je mettrais bien que le dernier virus WORM/NETCH.Z.4 se trouvait dans Nru68.sys (en tout des morceaux du virus)

comme Antivir n'arrivait pas à ouvrir le fichier
C:\WINDOWS\system32\drivers\Nru68.sys
[WARNING] The file could not be opened!

il n'était pas détecté au scan, par contre le guard lui le détectait une fois qu'il se lançait .

un passage au travers de combofix a permis de le supprimer

au fait comment il se propage ce vers ? (navigation sur internet, ouverture de pieces jointes, MSN,..)

Bon dimanche à tous

Bonjour fch22,

pour parfaire ta protection instales ceci :

spywareblaster :

http://www.brightfort.com/spywareblaster.html

c´est un resident, il suffit de le mettre a jour de temps en temps car la version gratuite ne le fait pas toute seul , une fois installé et mis a jour tu mets toutes les protections sur "enable"

tuto : http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/question-spywareblaser-sujet_174747_1.htm

telecharge aussi cet anti spyware il a aussi un resident le teatimer :

spybot :

http://www.commentcamarche.net/telecharger/telecharger 122 spybot

http://www.safer-networking.org/fr/faq/33.html

Merci pour le resumé ;-)

Ce ver ce propage par mail esentiellement -> piece jointe infecté comme tu l´as vu.

Bonne soirée et bonne continuation

De rien, Merci ;-)

Bye`

merci,

j'ai tout installer

Bonne soirée et à plus !

Ok cool ;-)
Bonne soirée egalement.
Bye`