Virus braviax, [hijackthis] Résolu

Question

Bonjour,
    
ça plusieurs heures que jessaie d'eradiquer un virus de mon pc.

voici le rapport hijack apres avoir fait plusieurs tour en sans echec :
++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:37:00, on 06/02/2008
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Tgaud\Bureau\antivir\HijackTdhis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O20 - AppInit_DLLs: cru629.dat
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

g!rly · Answer

salut 

t´as bien du te battre vu la taille de ton hijack this...

pour le moment tu n´as aucune protection d´active!

peux etre bagle est de la partie aussi? pour le savoir fais ceci :

Télécharge ELIBAGLA en bas de cette page
http://www.zonavirus.com/datos/descargas/95/elibagla.asp (clique sur le bouton "Descargar Elibagla") sur ton bureau.

Lance-le, de préférence en mode sans échec si tu en as la possibilité, en mode normal dans le cas contraire. Patiente le temps du scan.
Lorsqu'il a terminé, poste le contenu du fichier infoSat.txt qui se trouve dans Poste de travail > Disque C:\
Et par la même occasion, précise si tu peux à nouveau démarrer en mode sans échec.

***Ne pas rebooter en passant par msconfig.

@+

Tgaudlol · Answer

BAGLE cest de lhistoire ancienne.
J'ai testé elibagla et le desinfecteur symantec, ils m'ont tout deux dit que j'etait pas contaminé.

Bizzarre car javais à ce moments des problemes de reboot intempestif lors de scans, que je n'ai plus depuis.

J'ai egalement fait le scan panda antivirus et bitdefender, en vain.

g!rly · Answer

re,

tu as gardé le rapport d´eliblaga?

je peux le voir stp

Ton antivirus est bien desactivé, non!? 

peux tu faire ceci :

Télécharge ComboScan sur ton Bureau en bas de cette pae en clickant sur download file

-> http://www.geekstogo.com/forum/files/

Ferme toutes les applications en cours : antivirus, pare-feu, etc ..
Double-clic sur comboscan.exe, dans la fenêtre qui s'affiche, clic sur OK.
Soit patient...
Le rapport Comboscan.txt s'affichera, copie et colle le contenu de ce fichier ici.

Le rapport peut-être long et en deux morceaux vérifie qu'il soit en entier.

@+

jacques.gache · Answer

bonsoir,essais avec rogueremover https://www.clubic.com/telecharger-fiche28630-rogueremover-free.html
fais une analyse anti-virus en ligne http://www.commentcamarche.net/faq/sujet 8872 scanner en ligne avec bitdefender
puis passe un anti-spyware comme spybot https://kerio.probb.fr/t774-tuto-pour-spybot-search-and-destroy#1 , et rootkits http://www.commentcamarche.net/telecharger/telecharger 34055249 sophos anti rootkit

Tgaudlol · Answer

Ok alors voici le rapport comboscan :

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Deckard's System Scanner v20071014.68
Run by Tgaud on 2008-02-06 09:51:05
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Failed to create restore point; System Restore is disabled (service is not running).


Backed up registry hives.
Performed disk cleanup.

[color=red]System Drive C: has 4.76 GiB (less than 15%) free./color


-- HijackThis (run as Tgaud.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:51:35, on 06/02/2008
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\BitTornado\btdownloadgui.exe
C:\Program Files\BitTornado\btdownloadgui.exe
C:\Program Files\BitTornado\btdownloadgui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Tgaud\Bureau\dsds.exe
C:\DOCUME~1\Tgaud\Bureau\antivir\Tgaud.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O20 - AppInit_DLLs: cru629.dat
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

Tgaudlol · Answer

- HijackThis Fixed Entries (C:\DOCUME~1\Tgaud\Bureau\antivir\backups\) --------

backup-20080206-073734-149 O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
backup-20080206-073734-369 O4 - HKLM\..\Run: [braviax] braviax.exe
backup-20080206-073734-540 O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
backup-20080206-073734-579 O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
backup-20080206-073734-589 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
backup-20080206-073734-672 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
backup-20080206-073734-764 O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
backup-20080206-073735-389 O20 - AppInit_DLLs: cru629.dat
backup-20080206-073735-805 O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
backup-20080206-074930-180 O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
backup-20080206-074930-235 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
backup-20080206-074930-310 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
backup-20080206-074930-339 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
backup-20080206-074930-400 O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
backup-20080206-074930-575 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
backup-20080206-074930-607 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
backup-20080206-074930-729 O20 - AppInit_DLLs: cru629.dat
backup-20080206-074930-769 O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
backup-20080206-075036-809 O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
backup-20080206-075957-152 O20 - AppInit_DLLs: cru629.dat
backup-20080206-075957-415 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
backup-20080206-075957-422 O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
backup-20080206-075957-667 O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
backup-20080206-075957-674 O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
backup-20080206-075957-682 O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
backup-20080206-075957-683 O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
backup-20080206-075957-756 O4 - HKLM\..\Run: [braviax] braviax.exe
backup-20080206-075957-966 O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
backup-20080206-075957-977 O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
backup-20080206-080240-530 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
backup-20080206-080240-581 O4 - HKLM\..\Run: [braviax] braviax.exe
backup-20080206-080240-626 O20 - AppInit_DLLs: cru629.dat
backup-20080206-080240-926 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
backup-20080206-080623-226 O4 - HKLM\..\Run: [braviax] braviax.exe
backup-20080206-080623-258 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
backup-20080206-080623-277 R3 - Default URLSearchHook is missing
backup-20080206-080623-322 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
backup-20080206-080623-436 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
backup-20080206-080623-621 O20 - AppInit_DLLs: cru629.dat
backup-20080206-080717-491 O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
backup-20080206-080717-927 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
backup-20080206-080718-306 O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
backup-20080206-080718-491 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
backup-20080206-080718-563 O16 - DPF: {5EDB10D9-7E95-4833-A218-62F375DAFCF1} - https://parici.sopragroup.com/postauthI/epi.cab
backup-20080206-080718-566 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
backup-20080206-080718-684 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
backup-20080206-080718-933 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
backup-20080206-081133-332 O4 - HKLM\..\Run: [braviax] braviax.exe
backup-20080206-081133-403 O20 - AppInit_DLLs: cru629.dat
backup-20080206-081133-498 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
backup-20080206-081133-612 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
backup-20080206-081133-798 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
backup-20080206-081241-600 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
backup-20080206-081241-992 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
backup-20080206-081406-252 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
backup-20080206-081406-668 O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
backup-20080206-081406-914 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
backup-20080206-081406-921 O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
backup-20080206-081440-405 O4 - HKUS\.DEFAULT\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe (User 'Default user')
backup-20080206-081440-881 O4 - HKUS\S-1-5-18\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe (User 'SYSTEM')
backup-20080206-081507-609 O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
backup-20080206-082251-238 O4 - HKLM\..\Run: [braviax] braviax.exe
backup-20080206-082251-529 O20 - AppInit_DLLs: cru629.dat

Tgaudlol · Answer

-- File Associations -----------------------------------------------------------

[COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR]
[COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR]

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 asuskbnt (Enhanced Display Driver Helper Service) - c:\windows\system32\drivers\atkkbnt.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Help driver For Keyboard Service.>
R1 EIO - c:\windows\system32\drivers\eio.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Kernel Mode Driver for NT>
R1 Odptdi - c:\windows\system32\drivers\odptdi.sys <Not Verified; Aventail Corporation; Aventail(R) Connect(TM) with Smart Tunneling(TM)>
R3 Video3D (ASUS Video3D Service) - c:\windows\system32\drivers\video3d32.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Video3D driver>
R4 atidgllk - c:\windows\atidgllk.sys <Not Verified; Overclocking Tool; Overclocking Tool>

S1 asusgsb (ASUS Virtual Video Capture Device Driver) - c:\windows\system32\drivers\asusgsb32.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Virtual Video Capture Device Driver>
S3 catchme - c:\docume~1\tgaud\locals~1\temp\catchme.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 ATKKeyboardService (ATK Keyboard Service) - c:\windows\atkkbservice.exe <Not Verified; ASUSTeK COMPUTER INC.; ASUS Keyboard Service>

S4 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour>
S4 FLEXnet Licensing Service - "c:\program files\fichiers communs\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: ATI T200 Unified AVStream Driver
Device ID: DISPLAY\NTATIVRV01\5&1C3C013C&2&80000008&01&00
Manufacturer: ATI Technologies
Name: ATI T200 Unified AVStream Driver
PNP Device ID: DISPLAY\NTATIVRV01\5&1C3C013C&2&80000008&01&00
Service: ATIAVAIW

-- Files created between 2008-01-06 and 2008-02-06 -----------------------------

2008-02-06 08:32:02 6144 --a------ C:\WINDOWS\system32\cru629.dat
2008-02-06 08:32:02 11264 --a------ C:\WINDOWS\system32\braviax.exe
2008-02-06 08:32:02 6144 --a------ C:\WINDOWS\cru629.dat
2008-02-06 08:32:02 11264 --a------ C:\WINDOWS\braviax.exe
2008-02-06 07:38:53 1593889 --a------ C:\C1gomb4odFix.exe
2008-02-06 07:19:41 6656 --a------ C:\WINDOWS\system32\users32.dat
2008-02-06 07:15:00 0 d-------- C:\WINDOWS\ERUNT
2008-02-06 06:32:33 0 d-------- C:\Documents and Settings\Administrateur\Application Data\Mozilla
2008-02-06 05:53:34 0 dr-h----- C:\Documents and Settings\Tgaud\Recent
2008-02-06 05:47:07 0 d-------- C:\Documents and Settings\Tgaud\Application Data\Grisoft
2008-02-06 05:40:49 0 d-------- C:\toto
2008-02-06 05:29:45 0 d-------- C:\Program Files\Lavasoft
2008-02-06 05:29:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-06 04:14:13 29184 --a------ C:\WINDOWS\system32\drivers\beep.sys
2008-02-05 23:08:23 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-05 22:15:40 0 d-------- C:\Program Files\Lop SD
2008-02-05 22:15:19 3508 --a------ C:\Start_.cmd
2008-02-05 22:15:19 0 d-------- C:\327882R2FWJFW
2008-02-05 21:54:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-02-05 21:29:48 0 d-------- C:\Program Files\Trend Micro
2008-02-05 21:04:05 0 d-------- C:\!KillBox
2008-02-05 20:02:58 2764 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-05 20:01:32 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-05 20:01:32 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-02-05 20:01:32 85504 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-02-05 20:01:32 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-02-05 20:01:32 81920 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-02-05 20:01:32 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-05 20:01:31 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-02-05 19:49:33 0 d-------- C:\Program Files\CCleaner
2008-02-05 19:14:26 80 --a------ C:\WINDOWS\system32\suspend.bin
2008-02-05 19:14:23 16384 --a------ C:\WINDOWS\system32\nod32se.exe
2008-02-04 20:11:32 0 d-------- C:\Program Files\Microsoft Games
2008-02-03 07:59:53 31232 --a------ C:\WINDOWS\system32\drivers\odptdi.sys <Not Verified; Aventail Corporation; Aventail(R) Connect(TM) with Smart Tunneling(TM)>
2008-02-02 01:34:49 0 d-------- C:\Documents and Settings\Tgaud\Application Data\Hamachi
2008-02-02 01:34:20 0 d-------- C:\Program Files\Hamachi
2008-02-01 20:21:40 58368 --a------ C:\okfcats.exe
2008-02-01 20:21:36 55568 --a------ C:\eyegc.exe
2008-01-25 22:40:08 0 d-------- C:\Program Files\QuickTime
2008-01-20 17:52:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3
2008-01-16 22:26:55 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-01-16 22:22:43 0 dr------- C:\Documents and Settings\LocalService\Favoris
2008-01-16 22:20:29 84992 --a------ C:\WINDOWS\system32\drivers\AtiHdAud.sys <Not Verified; ATI Research Inc.; Windows (R) Server 2003 DDK driver>
2008-01-16 22:20:29 2642944 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys <Not Verified; ATI Technologies Inc.; ATI Radeon WindowsNT Miniport Driver>
2008-01-16 22:20:28 21504 --a------ C:\WINDOWS\system32\test12.exe
2008-01-16 22:20:28 21504 --a------ C:\WINDOWS\system32\dfsj2321.exe

Tgaudlol · Answer

-- Find3M Report ---------------------------------------------------------------

2008-02-06 07:23:54 560624 --a------ C:\WINDOWS\system32\perfh00C.dat
2008-02-06 07:23:54 110764 --a------ C:\WINDOWS\system32\perfc00C.dat
2008-02-06 05:29:13 0 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-06 04:39:35 0 d-------- C:\Program Files\MSN Messenger
2008-02-06 04:36:44 0 d-------- C:\Program Files\DAEMON Tools
2008-02-06 04:36:44 0 d-------- C:\Program Files\Bonjour
2008-02-06 00:52:20 360 --a------ C:\Program Files\cxrasbwj.txt
2008-01-27 23:13:13 0 d-------- C:\Program Files\eMule
2008-01-20 17:57:46 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-16 22:53:39 0 d-------- C:\Documents and Settings\Tgaud\Application Data\Skype
2008-01-16 16:02:08 0 d-------- C:\Documents and Settings\Tgaud\Application Data\skypePM
2008-01-15 18:42:00 0 d-------- C:\Program Files\Steam
2008-01-05 20:57:06 0 d-------- C:\Program Files\Alwil Software
2008-01-05 19:30:08 0 d-------- C:\Program Files\Microsoft Security AdviserREN
2008-01-05 19:29:34 0 d-------- C:\Program Files\Messenger
2008-01-05 18:33:43 805 --a------ C:\WINDOWS\mozver.dat
2008-01-05 18:33:36 0 d-------- C:\Program Files\Java
2008-01-05 18:32:56 0 d-------- C:\Program Files\Fichiers communs
2008-01-05 18:32:56 0 d-------- C:\Program Files\Fichiers communs\Java
2007-12-28 20:24:56 0 d-------- C:\Documents and Settings\Tgaud\Application Data\Adobe
2007-12-23 01:58:51 0 d-------- C:\Program Files\Super macro
2007-12-17 20:46:18 0 d-------- C:\Program Files\THQ
2007-12-12 14:44:19 0 d-------- C:\Program Files\DivX
2007-12-11 23:55:06 0 d-------- C:\Program Files\Skype
2007-12-11 23:55:04 0 d-------- C:\Program Files\Fichiers communs\Skype
2007-11-19 20:59:17 669184 --a------ C:\WINDOWS\system32\pbsvc.exe
2007-11-17 02:53:11 579072 --a------ C:\WINDOWS\system32\user32.dll <Not Verified; Microsoft Corporation; Système d'exploitation Microsoft® Windows®>
2007-11-15 23:39:46 364544 --a------ C:\WINDOWS\system32\ATIDEMGX.dll <Not Verified; Advanced Micro Devices, Inc.; Catalyst® Control Centre>
2007-11-15 23:38:41 268288 --a------ C:\WINDOWS\system32\ati2dvag.dll <Not Verified; ATI Technologies Inc.; ATI Radeon WindowsNT Display Driver>
2007-11-15 23:31:08 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll <Not Verified; ATI Technologies Inc.; ATI Display Driver Utilities>
2007-11-15 23:30:52 143360 --a------ C:\WINDOWS\system32\atipdlxx.dll <Not Verified; ATI Technologies, Inc.; ATI Desktop Component>
2007-11-15 23:30:40 122880 --a------ C:\WINDOWS\system32\Oemdspif.dll <Not Verified; ATI Technologies, Inc.; ATI Driver Interface Component>
2007-11-15 23:30:33 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe <Not Verified; ATI Technologies, Inc.; ATI Default Resolution Update>
2007-11-15 23:30:25 43520 --a------ C:\WINDOWS\system32\ati2edxx.dll <Not Verified; ATI Technologies, Inc.; ATI External Device Utility>
2007-11-15 23:30:12 122880 --a------ C:\WINDOWS\system32\ati2evxx.dll <Not Verified; ATI Technologies Inc.; ATI External Event Utility for Windows>
2007-11-15 23:28:51 495616 --a------ C:\WINDOWS\system32\ati2evxx.exe <Not Verified; ATI Technologies Inc.; ATI External Event Utility for Windows>
2007-11-15 23:28:02 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL <Not Verified; ATI Technologies Inc.; ATI Radeon Family>
2007-11-15 23:23:26 9314304 --a------ C:\WINDOWS\system32\atioglx2.dll <Not Verified; ATI Technologies Inc.; ATI OpenGL driver>
2007-11-15 23:19:53 3135040 --a------ C:\WINDOWS\system32\ati3duag.dll <Not Verified; ATI Technologies Inc.; ATI Technologies Inc. Radeon DirectX Universal Driver>
2007-11-15 23:08:52 1601792 --a------ C:\WINDOWS\system32\ativvaxx.dll <Not Verified; ATI Technologies Inc.; ATI Technologies Inc. Radeon Video Acceleration Universal Driver>
2007-11-15 23:08:33 887724 --a------ C:\WINDOWS\system32\ativva6x.dat
2007-11-15 22:54:36 376832 --a------ C:\WINDOWS\system32\atikvmag.dll <Not Verified; ATI Technologies Inc.; Virtual Command And Memory Manager>
2007-11-15 22:52:43 17408 --a------ C:\WINDOWS\system32\atitvo32.dll <Not Verified; ATI Technologies Inc.; ATI RageTheater/ImpacTV COM interface>
2007-11-15 22:50:08 176128 --a------ C:\WINDOWS\system32\atiok3x2.dll <Not Verified; ATI Technologies Inc.; Ring 0 x2 Component>
2007-11-15 22:46:45 499712 --a------ C:\WINDOWS\system32\ati2cqag.dll <Not Verified; ATI Technologies Inc.; ATI Radeon Family>
2007-11-15 16:39:00 593920 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart>

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [12/04/2007 10:33 C:\WINDOWS\RTHDCPL.exe]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [10/11/2006 12:35]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [11/04/2007 14:32 C:\WINDOWS\KHALMNPR.Exe]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [30/09/2007 03:18]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDesktopIniCache"=1 (0x1)
"NoActiveDesktopChanges"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=cru629.dat

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tgaud^Menu Démarrer^Programmes^Démarrage^CCC.lnk]
path=C:\Documents and Settings\Tgaud\Menu Démarrer\Programmes\Démarrage\CCC.lnk
backup=C:\WINDOWS\pss\CCC.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer]
C:\WINDOWS\system32\JMRaidSetup.exe boot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonjour]
C:\WINDOWS\vmmreg32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\CTFMON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firewall auto setup]
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\winlogon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GamerOSD]
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]
C:\WINDOWS\JM\JMInsIDE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft all]
C:\WINDOWS\mmall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PostBootReminder]
C:\Documents and Settings\Tgaud\Bureau\~tmp1174.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\program files\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Windows IPSEC Monitor"=2 (0x2)
"Microsoft I Service"=2 (0x2)
"Windows Management Service"=2 (0x2)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"helpsvc"=2 (0x2)
"FontCache3.0.0.0"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
"msupdate"=2 (0x2)
"usnjsvc"=3 (0x3)
"aswUpdSv"=2 (0x2)
"aawservice"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a58c786-9a16-11dc-95ac-00604cd59310}]
AutoRun\command- F:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a58c787-9a16-11dc-95ac-00604cd59310}]
AutoRun\command- G:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e72cb806-6f21-11dc-9587-806d6172696f}]
AutoRun\command- D:\setup.exe

-- End of Deckard's System Scanner: finished at 2008-02-06 09:52:12 ------------

g!rly · Answer

tu peux le poster en entier stp

g!rly · Answer

ok
je regarde et reviens...

Tgaudlol · Answer

Voila cest tres long, merci pour votre temp.

Sinon le bitdefender je l'ai executé deja, voici le log

+++++++++++
Fichier analysé
	
 Statut

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BBUDN8ER\packed_installer_cna[1].exe
Infecté par: Trojan.Proxy.Wopla.AO
Supprimé



C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\RASMO4JC\gr[1].exe
Suspecté de: Generic.Malware.SF.CBCE0FF6
Supprimé

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2T0RCHQH\demos[1].exe
Infecté par: Dropped:Generic.Dld.HotLan.1ADAB5B6
Supprimé



C:\Documents and Settings\Tgaud\Bureau\Nouveau dossier (6)\ieupdr2.exed
Infecté par: Trojan.Downloader.Small.AAJM
Supprimé

C:\Documents and Settings\Tgaud\Local Settings\Temporary Internet Files\Content.IE5\KLMNCD23\wssl49[1].exe
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\E4.tmp
Infecté par: Win32.Mydoom.ABS
Supprimé

C:\ie_updater.exe
Infecté par: Trojan.Downloader.Small.AAJM
Supprimé

C:
ethlpr.exe
Infecté par: Generic.PWStealer.CE711C1B
Supprimé

C:\WINDOWS\braviax.exe
Infecté par: Generic.Malware.Yd!dld!sp.730153C3
Supprimé
(mais recréé depuis ... pff)



C:\WINDOWS\cru629.dat
Infecté par: Backdoor.Small.CIF
Supprimé

C:\WINDOWS\ieupdr.exe
Infecté par: Trojan.Downloader.Small.AAJM
Supprimé

C:\WINDOWS\mmall.exe
Suspecté de: Generic.Malware.Sdld.39165A59
Supprimé
(mais recréé depuis )


C:\WINDOWS\mmgr.exe
Suspecté de: Generic.Malware.SF.CBCE0FF6
Supprimé

C:\WINDOWS\mm_tmpgr.exe
Suspecté de: Generic.Malware.SF.CBCE0FF6
Supprimé

C:\WINDOWS\system32\basecoet32.dll
Infecté par: Trojan.Agent.AGKK
Supprimé

C:\WINDOWS\system32\basepwo32.dll
Infecté par: Trojan.Agent.AGKK
Echec de la suppression
(pas trop compris celui ci, apparemment cestu ne dll des antivirus & co? car dedans il etait referencé sur avast, hijack & co).
A moin que ce soit un CONTRE antivirus, d'ou les references.


C:\WINDOWS\system32\braviax.exe
Infecté par: Generic.Malware.Yd!dld!sp.730153C3
Echec de la suppression
(supprimé puis recréé depuis)

C:\WINDOWS\system32\cru629.dat
Infecté par: Backdoor.Small.CIF
Supprimé
(recréé depuis)

C:\WINDOWS\system32\crypts.dll
Infecté par: Generic.Dld.HotLan.1ADAB5B6
Echec de la suppression
(jarté à la main, pas d'idée si il est recréé ou non)

C:\WINDOWS\system32\dfsj2228.exe
Infecté par: Trojan.Proxy.Xorpix.BT
Supprimé

C:\WINDOWS\system32\dfsj2295.exe
Infecté par: Trojan.Proxy.Wopla.AO
Supprimé

C:\WINDOWS\system32\dfsj2305.exe
Infecté par: Trojan.DNSChanger.BX
Supprimé

C:\WINDOWS\system32\dfsj2318.exe
Infecté par: Trojan.Spy.BZub.NHJ
Supprimé

C:\WINDOWS\system32\dllcache\beep.sys
Infecté par: Generic.Malware.P!.A67ADB26
Supprimé

C:\WINDOWS\system32\drivers\beep.sys
Infecté par: Generic.Malware.P!.A67ADB26
Supprimé

C:\WINDOWS\system32\drivers
disaluo.sys
Infecté par: Trojan.Proxy.Wopla.AO
Supprimé

C:\WINDOWS\system32\drivers\Vbf15.sys
Infecté par: Trojan.Downloader.Small.AAKE
Supprimé

C:\WINDOWS\system32\suspend.exe
Infecté par: Trojan.Agent.AGQD
Supprimé

C:\WINDOWS\system32\vhosts.exe
Infecté par: Packer.Malware.Crypter.A
Supprimé

C:\WINDOWS\system32\_svchost.exe
Infecté par: Trojan.Downloader.Small.AAJM
Supprimé

C:\WINDOWS\Temp\2B40.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\6A94.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\7550.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\883A.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\8E35.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\9961.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\9F7B.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Echec de la suppression
(le process etait lancé je l'ai donc kill puis effacé manuellement)


C:\WINDOWS\Temp\A567.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\A9EB.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\BBCE.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\Temp\CC62.tmp
Infecté par: Generic.Spammer.HotLan.30B6AAD6
Supprimé

C:\WINDOWS\vmmreg32.exe
Infecté par: Trojan.Agent.AGNJ
Supprimé

++++++++++++++++++++++++++++++++++++++++++++++++

Tgaudlol · Answer

Oui actuellement mes antivirus sont desactivé (tjrs present sur la machine mais pas demarré, je les ai viré de hijackthis par paranoia une fois qu'ils mont montré qu'ils etaient innefficaces.)


seul truc que javais pas fermé pdt le scan : 3 bittornado (telechargements)
et un ou deux msn.

g!rly · Answer

re,

* Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax.exe
C:\Program Files\cxrasbwj.txt
C:\WINDOWS\mmall.exe
C:\Documents and Settings\Tgaud\Bureau\~tmp1174.exe
C:\WINDOWS\braviax.exe

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

puis 

Regarde bien l'indication en bas, avant de commencer la procédure.
Télécharge Look2Me-Destroyer.exe sur ton Bureau.

http://secubox.aldria.com/topic-518.html

. Ferme toutes les fenêtres actives.
. Lance l'outil Look2Me-Destroyer.exe.
. Coche Run this program as a task
. Un message s'affichera :
"Look2Me-Destroyer will close and re-open in approximately 1 minute"-> OK
. Il se relancera après la minute, puis appuie sur le bouton Scan for L2M.
. Les icônes de ton Bureau vont disparaître.
. Le scan termine, clique sur Remove L2M
. Un nouveau message Done Scanning apparaîtra, clique sur OK.
. Suivi de Done removing infected files! Look2Me-Destroyer will now shutdown your computer -> OK.
. Ton PC va s’éteindre.
. Démarre ton PC normalement.
. Colle le rapport généré, situé ici : C:\Look2Me-Destroyer.txt

Si Look2Me-Destroyer ne se relance pas automatiquement après la minute, redémarre et essaie à nouveau.
-------- 

1/ Si Look2Me-Destroyer ne se relance pas automatiquement après les 10 secondes, redémarre et essaie à nouveau.
 
2/ Si tu reçois un message de ton firewall disant que l'outil tente d'accéder à l'internet : Accepte ou desactive ton firewall
 
3/ Si un message runtime error '339' s'affiche : télécharge MSWINSCK.OCX et place-le dans le dossier C:\Windows\System32.
http://www.olinformatique.com/DLL-FILES/FILES/mswinsck.ocx.php WINSCK.OCX
 
post les deux rapports stp

@+

Tgaudlol · Answer

peut tu preciser quelle etape je fais en normal et quelle etape je fais en sans echec? merci !

g!rly · Answer

fais tout en mode normal...

Tgaudlol · Answer

File/Folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax.exe not found.
C:\Program Files\cxrasbwj.txt moved successfully.
File/Folder C:\WINDOWS\mmall.exe not found.
C:\Documents and Settings\Tgaud\Bureau\~tmp1174.exe moved successfully.
C:\WINDOWS\braviax.exe moved successfully.
 
OTMoveIt2 v1.0.17 log created on 02062008_102950



Par contre pour le deuxieme truc il veut pas se relancer au bout d'une minute.
jai rebooté reesayé, ça marchait pas mieux.

(et comme jai rebooté, jai RE supprimé braviax.exe)

g!rly · Answer

re,

bon...

arrives tu as passer combofix maintenant?

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

Tgaudlol · Answer

Le scan est terminé en faite en insistante cetait bon.


Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 06/02/2008 10:42:04


Attempting to delete infected files...

Making registry repairs.


Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrateurs - Succeeded

Tgaudlol · Answer

concernant combofixe, il se passe rien quand je clique dessus.


Si je le renomme, lorsque je click dessus une minibarre de chargment se rempli sur son propre icone (il reagit), mais aucune fenetre  ne souvre.

g!rly · Answer

ok

peux tu essayer de passer combofix maintenant...

comme indiqué au post 17.

g!rly · Answer

ok

passe ceci :

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

@+

Tgaudlol · Answer

comme indiqué au poste 19 ça marche pas.

g!rly · Answer

les reponses se croisent...passe sdfix

Tgaudlol · Answer

Alors jai executé le truc en mode sans echec, puis redemarré en mode normal.
le virus est tjrs present au passage.

voici le log :


SDFix: Version 1.137

Run by Tgaud on 06/02/2008 at 10:59

Microsoft Windows XP [version 5.1.2600]

Running From: C:	ytyty\SDFix

Safe Mode:
Checking Services: 

Patched user32.dll detected!

Note: SDFix Does Not Repair This File!

"C:\WINDOWS\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2gdr\user32.dll" 578048 02/03/2005 19:10
"C:\WINDOWS\SoftwareDistribution\Download\46faa4cd5c82200be099d1b1e8a12eed\sp2qfe\user32.dll" 578048 02/03/2005 19:20
"C:\WINDOWS\SoftwareDistribution\Download\807aa275a612b3508a3d1d613bbf6226\sp2gdr\user32.dll" 578560 08/03/2007 16:37
"C:\WINDOWS\SoftwareDistribution\Download\807aa275a612b3508a3d1d613bbf6226\sp2qfe\user32.dll" 579072 08/03/2007 16:50
"C:\WINDOWS\system32\user32.dll" 579072 17/11/2007 02:53
"C:\WINDOWS\system32\dllcache\user32.dll" 579072 17/11/2007 02:53

Download the below update to restore original files:

https://docs.microsoft.com/en-us/


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Session Manager\SubSystems:
Trojan File basepwo32.dll and startup entry Found!
basepwo32.dll will be removed after reboot if registry value is repaired
 

Rebooting...


Session Manager\SubSystems:
ServerDll value restored to basesrv.dll
Key export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
"Windows"=%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

Removing C:\WINDOWS\system32\basepwo32.dll
 

Original beep.sys Restored

"C:\WINDOWS\system32\dllcache\beep.sys" 4224 05/02/2008 20:09
"C:\WINDOWS\system32\drivers\beep.sys" 4224 05/02/2008 20:09

 

Normal Mode:
Checking Files: 

Trojan Files Found:

C:\WINDOWS\SYSTEM32\OSAREWQP.TMP - Deleted
C:\WINDOWS\system32\5_exception.nls - Deleted
C:\WINDOWS\system32\bns.dat  - Deleted
C:\WINDOWS\system32\users32.dat  - Deleted
C:\WINDOWS\system32\basepwo32.dll - Deleted





Removing Temp Files...

ADS Check:
 


                                 Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-06 11:02:13
Windows 5.1.2600 Service Pack 2, v.2149 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ebcc33]
"Type"=dword:00000001
"Tag"=dword:00000001
"Group"="System Reserved\0Boot Bus Extender\0System Bus Extender\0SCSI miniport\0Port\0Primary Disk\0SCSI Class\0SCSI CDROM Class\0FSFilter Infrastructure\0FSFilter System\0FSFilter Bottom\0FSFilter Copy Protection\0FSFilter Security Enhancer\0FSFilter Open File\0FSFilter Physical Quota Management\0FSFilter Encryption\0FSFilter Compression\0FSFilter HSM\0FSFilter Cluster File System\0FSFilter System Recovery\0FSFilter Quota Management\0FSFilter Content Screener\0FSFilter Continuous Backup\0FSFilter Replication\0FSFilter Anti-Virus\0FSFilter Undelete\0FSFilter Activity Monitor\0FSFilter Top\0Filter\0Boot File System\0Base\0Pointer Port\0Keyboard Port\0Pointer Class\0Keyboard Class\0Video Init\0Video\0Video Save\0File System\0Event Log\0Streams Drivers\0NDIS Wrapper\0COM Infrastructure\0UIGroup\0LocalValidation\0PlugPlay\0PNP_TDI\0NDIS\0TDI\0NetBIOSGroup\0ShellSvcGroup\0SchedulerGroup\0SpoolerGroup\0AudioGroup\0SmartCardGroup\0NetworkProvider\0RemoteValidation\0NetDDEGroup\0Parallel arbitrator\0Extended Base\0PCI Configuration\0MS Transactions\0"
"ErrorControl"=dword:00000001
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:6e,45,e8,6c,96,af,b9,db,9c,73,57,77,c8,7d,d1,bb,81,6f,35,fd,84,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,c6,e2,7d,d8,8f,48,fc,e1,72,e8,b7,b7,96,45,05,f0,a8,..
"khjeh"=hex:d7,1f,30,5e,30,97,bc,ae,a4,1d,65,2c,17,b5,53,da,3f,05,f9,36,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:64,62,05,00,60,66,42,00,00,00,00,00,e8,ff,ff,ff,20,70,42,00,20,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:64,62,03,00,a0,69,42,00,72,69,74,79,d8,ff,ff,ff,d8,39,06,00,88,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ebcc33]
"Type"=dword:00000001
"Tag"=dword:00000001
"Group"="System Reserved\0Boot Bus Extender\0System Bus Extender\0SCSI miniport\0Port\0Primary Disk\0SCSI Class\0SCSI CDROM Class\0FSFilter Infrastructure\0FSFilter System\0FSFilter Bottom\0FSFilter Copy Protection\0FSFilter Security Enhancer\0FSFilter Open File\0FSFilter Physical Quota Management\0FSFilter Encryption\0FSFilter Compression\0FSFilter HSM\0FSFilter Cluster File System\0FSFilter System Recovery\0FSFilter Quota Management\0FSFilter Content Screener\0FSFilter Continuous Backup\0FSFilter Replication\0FSFilter Anti-Virus\0FSFilter Undelete\0FSFilter Activity Monitor\0FSFilter Top\0Filter\0Boot File System\0Base\0Pointer Port\0Keyboard Port\0Pointer Class\0Keyboard Class\0Video Init\0Video\0Video Save\0File System\0Event Log\0Streams Drivers\0NDIS Wrapper\0COM Infrastructure\0UIGroup\0LocalValidation\0PlugPlay\0PNP_TDI\0NDIS\0TDI\0NetBIOSGroup\0ShellSvcGroup\0SchedulerGroup\0SpoolerGroup\0AudioGroup\0SmartCardGroup\0NetworkProvider\0RemoteValidation\0NetDDEGroup\0Parallel arbitrator\0Extended Base\0PCI Configuration\0MS Transactions\0"
"ErrorControl"=dword:00000001
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:000008ba
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:6e,45,e8,6c,96,af,b9,db,9c,73,57,77,c8,7d,d1,bb,81,6f,35,fd,84,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,c6,e2,7d,d8,8f,48,fc,e1,72,e8,b7,b7,96,45,05,f0,a8,..
"khjeh"=hex:d7,1f,30,5e,30,97,bc,ae,a4,1d,65,2c,17,b5,53,da,3f,05,f9,36,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:53,8d,af,45,9b,b0,2b,94,df,bd,25,74,bb,0b,84,8c,a6,ca,06,9e,91,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0f,9f,06,17,89,d7,8b,f0,5c,d1,60,3a,8b,5f,9a,ac,90,44,fa,e6,48,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Ebcc33]
"Type"=dword:00000001
"Tag"=dword:00000001
"Group"="System Reserved\0Boot Bus Extender\0System Bus Extender\0SCSI miniport\0Port\0Primary Disk\0SCSI Class\0SCSI CDROM Class\0FSFilter Infrastructure\0FSFilter System\0FSFilter Bottom\0FSFilter Copy Protection\0FSFilter Security Enhancer\0FSFilter Open File\0FSFilter Physical Quota Management\0FSFilter Encryption\0FSFilter Compression\0FSFilter HSM\0FSFilter Cluster File System\0FSFilter System Recovery\0FSFilter Quota Management\0FSFilter Content Screener\0FSFilter Continuous Backup\0FSFilter Replication\0FSFilter Anti-Virus\0FSFilter Undelete\0FSFilter Activity Monitor\0FSFilter Top\0Filter\0Boot File System\0Base\0Pointer Port\0Keyboard Port\0Pointer Class\0Keyboard Class\0Video Init\0Video\0Video Save\0File System\0Event Log\0Streams Drivers\0NDIS Wrapper\0COM Infrastructure\0UIGroup\0LocalValidation\0PlugPlay\0PNP_TDI\0NDIS\0TDI\0NetBIOSGroup\0ShellSvcGroup\0SchedulerGroup\0SpoolerGroup\0AudioGroup\0SmartCardGroup\0NetworkProvider\0RemoteValidation\0NetDDEGroup\0Parallel arbitrator\0Extended Base\0PCI Configuration\0MS Transactions\0"
"ErrorControl"=dword:00000001
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:6e,45,e8,6c,96,af,b9,db,9c,73,57,77,c8,7d,d1,bb,81,6f,35,fd,84,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,c6,e2,7d,d8,8f,48,fc,e1,72,e8,b7,b7,96,45,05,f0,a8,..
"khjeh"=hex:d7,1f,30,5e,30,97,bc,ae,a4,1d,65,2c,17,b5,53,da,3f,05,f9,36,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:53,8d,af,45,9b,b0,2b,94,df,bd,25,74,bb,0b,84,8c,a6,ca,06,9e,91,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0f,9f,06,17,89,d7,8b,f0,5c,d1,60,3a,8b,5f,9a,ac,90,44,fa,e6,48,..

scanning hidden registry entries ...

scanning hidden files ...

C:\WINDOWS\system32\drivers\Ebcc33.sys 167936 bytes executable

scan completed successfully
hidden processes: 0
hidden services: 1
hidden files: 21


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:	ytyty\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 11 Jun 2004     1,667,584 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT5.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BIT8.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\22fb973e059470cc1b5d76c4ae605351\BITC.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT4.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2769b111678c52099a3b3123b12f2325\BIT9.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\30285791903730fbf957a83562db4ff4\BIT6.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4844df1d57a292079101da42a26d7d72\BIT2.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT1.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9e870549834e2bceb796e44a1e3ac6f5\BITB.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bc066f3f60df1b38218903dd0d40ce98\BIT3.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cb8921d0c7830b2f33c00fa4c8a10d17\BIT7.tmp"
Tue  5 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d77b9b5b8fed23dd91f50d167cce60d3\BITA.tmp"
Wed 16 Jan 2008         4,608 A.SH. --- "C:\_OTMoveIt\MovedFiles\02062008_102950\Documents and Settings\Tgaud\Bureau\~tmp1174.exe"

Finished!

Tgaudlol · Answer

J'ai essayé de lancer combofix.exe ça a marché ! mais je l'ai fais en mode "normal" et pas en mode "sans echec". Bon le virus est tjrs la, mais voici le log : +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ComboFix 08-02.05.3 - Tgaud 2008-02-06 11:05:37.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1528 [GMT 1:00] Endroit: C:\Documents and Settings\Tgaud\Bureau\CombroFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\symavc32.sys C:\WINDOWS\OPTIONS\CABS\_desktop.ini C:\WINDOWS\system32\drivers\EBCC33.sys C:\WINDOWS\system32\users32.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_EBCC33 -------\LEGACY_MSUPDATE ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-06 to 2008-02-06 )))))))))))))))))))))))))))))))))))) . 2008-02-06 11:08 . 2008-02-06 11:08 6,656 --a------ C:\WINDOWS\system32\users32.dat 2008-02-06 11:02 . 2008-02-06 11:02 29 --a------ C:\WINDOWS\system32\ytfqhgia.tmp 2008-02-06 10:54 . 2008-02-06 11:05 d-------- C: ytyty 2008-02-06 10:44 . 2008-02-06 10:56 11,264 --a------ C:\WINDOWS\braviax.exe 2008-02-06 09:50 . 2008-02-06 09:50 d-------- C:\Deckard 2008-02-06 08:32 . 2008-02-06 10:56 11,264 --a------ C:\WINDOWS\system32\braviax.exe 2008-02-06 08:32 . 2008-02-06 10:56 6,144 --a------ C:\WINDOWS\system32\cru629.dat 2008-02-06 08:32 . 2008-02-06 10:56 6,144 --a------ C:\WINDOWS\cru629.dat 2008-02-06 07:38 . 2008-02-05 22:05 1,593,889 --a------ C:\C1gomb4odFix.exe 2008-02-06 07:19 . 2008-02-06 11:08 160,568 --a------ C:\WINDOWS\system32\winivstr.exe 2008-02-06 07:17 . 2004-06-10 15:18 29,056 --a------ C:\WINDOWS\system32\drivers\ip6fw.sys 2008-02-06 07:15 . 2008-02-06 07:15 d-------- C:\WINDOWS\ERUNT 2008-02-06 05:47 . 2008-02-06 05:47 d-------- C:\Documents and Settings\Tgaud\Application Data\Grisoft 2008-02-06 05:40 . 2008-02-06 05:40 d-------- C: oto 2008-02-06 05:37 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-02-06 05:29 . 2008-02-06 05:29 d-------- C:\Program Files\Lavasoft 2008-02-06 05:29 . 2008-02-06 05:33 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-06 04:14 . 2008-02-05 20:09 4,224 --a------ C:\WINDOWS\system32\drivers\beep.sys 2008-02-06 04:14 . 2008-02-05 20:09 4,224 --a--c--- C:\WINDOWS\system32\dllcache\beep.sys 2008-02-06 00:33 . 2008-02-06 00:33 d-------- C:\_OTMoveIt 2008-02-05 23:08 . 2008-02-06 06:44 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-02-05 22:18 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-02-05 22:18 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-02-05 22:18 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-02-05 22:18 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-02-05 22:18 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-02-05 22:18 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-02-05 22:18 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-02-05 22:18 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-02-05 22:15 . 2008-02-05 22:17 d-------- C:\Program Files\Lop SD 2008-02-05 21:54 . 2008-02-05 21:54 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-02-05 21:29 . 2008-02-05 21:29 d-------- C:\Program Files\Trend Micro 2008-02-05 20:57 . 2008-02-06 10:53 d-------- C:\SDFix 2008-02-05 20:02 . 2008-02-06 07:13 2,764 --a------ C:\WINDOWS\system32 mp.reg 2008-02-05 20:01 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-02-05 20:01 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-02-05 20:01 . 2008-02-05 00:23 85,504 --a------ C:\WINDOWS\system32\VACFix.exe 2008-02-05 20:01 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-02-05 20:01 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-02-05 20:01 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-02-05 20:01 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-02-05 19:49 . 2008-02-05 19:49 d-------- C:\Program Files\CCleaner 2008-02-05 19:14 . 2008-02-05 19:14 16,384 --a------ C:\WINDOWS\system32 od32se.exe 2008-02-05 19:14 . 2008-02-05 19:14 80 --a------ C:\WINDOWS\system32\suspend.bin 2008-02-04 20:11 . 2008-02-04 20:11 d-------- C:\Program Files\Microsoft Games 2008-02-03 07:59 . 2006-08-03 13:53 31,232 --a------ C:\WINDOWS\system32\drivers\odptdi.sys 2008-02-02 01:34 . 2008-02-02 01:34 d-------- C:\Program Files\Hamachi 2008-02-02 01:34 . 2008-02-05 00:55 d-------- C:\Documents and Settings\Tgaud\Application Data\Hamachi 2008-02-02 01:34 . 2008-02-02 01:54 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-02-01 20:21 . 2008-02-01 20:21 58,368 --a------ C:\okfcats.exe 2008-02-01 20:21 . 2008-02-01 20:21 55,568 --a------ C:\eyegc.exe 2008-01-25 22:40 . 2008-01-25 22:40 d-------- C:\Program Files\QuickTime 2008-01-20 17:52 . 2008-01-20 17:52 d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3 2008-01-16 22:25 . 2008-01-16 22:30 14 --ah----- C:\WINDOWS\mmax.ini 2008-01-16 22:23 . 2008-01-16 22:23 4 --a------ C:\WINDOWS\c.pid 2008-01-16 22:22 . 2008-01-16 22:22 dr------- C:\Documents and Settings\LocalService\Favoris 2008-01-16 22:19 . 2008-01-16 22:19 4 --a------ C:\E5.tmp . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-06 04:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-06 04:29 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-02-06 03:39 --------- d-----w C:\Program Files\MSN Messenger 2008-02-06 03:36 --------- d-----w C:\Program Files\DAEMON Tools 2008-02-06 03:36 --------- d-----w C:\Program Files\Bonjour 2008-02-03 13:36 196,608 ----a-w C:\WINDOWS\system32\drivers\aStandard.bin 2008-01-27 22:13 --------- d-----w C:\Program Files\eMule 2008-01-20 16:57 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-16 21:53 --------- d-----w C:\Documents and Settings\Tgaud\Application Data\Skype 2008-01-16 15:02 --------- d-----w C:\Documents and Settings\Tgaud\Application Data\skypePM 2008-01-15 17:42 --------- d-----w C:\Program Files\Steam 2008-01-05 19:57 --------- d-----w C:\Program Files\Alwil Software 2008-01-05 18:30 --------- d-----w C:\Program Files\Microsoft Security AdviserREN 2008-01-05 17:35 102,664 ----a-w C:\WINDOWS\system32\drivers mcomm.sys 2008-01-05 17:33 --------- d-----w C:\Program Files\Java 2008-01-05 17:32 --------- d-----w C:\Program Files\Fichiers communs\Java 2007-12-23 00:58 --------- d-----w C:\Program Files\Super macro 2007-12-18 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Media Center Programs 2007-12-17 19:46 --------- d-----w C:\Program Files\THQ 2007-12-12 13:44 --------- d-----w C:\Program Files\DivX 2007-12-11 22:55 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2007-12-11 22:55 --------- d-----w C:\Program Files\Skype 2007-12-11 22:55 --------- d-----w C:\Program Files\Fichiers communs\Skype 2007-12-11 22:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-11-19 19:59 22,328 ----a-w C:\Documents and Settings\Tgaud\Application Data\PnkBstrK.sys . [color=blue]Infected C:\WINDOWS\system32\user32.dll hex repaired[/color] ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-09-30 03:18 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 10:33 16132608 C:\WINDOWS\RTHDCPL.exe] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe] "braviax"="braviax.exe" [2008-02-06 10:56 11264 C:\WINDOWS\system32\braviax.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "UseDesktopIniCache"= 1 (0x1) [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech SetPoint.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Tgaud^Menu Démarrer^Programmes^Démarrage^CCC.lnk] path=C:\Documents and Settings\Tgaud\Menu Démarrer\Programmes\Démarrage\CCC.lnk backup=C:\WINDOWS\pss\CCC.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer] -r------- 2007-02-06 13:08 1953792 C:\WINDOWS\system32\JMRaidSetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 02:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 11:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor] --a------ 2007-04-23 20:20 1114112 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonjour] C:\WINDOWS\vmmreg32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-06-11 15:43 14336 C:\WINDOWS\system32\CTFMON.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firewall auto setup] C:\DOCUME~1\Tgaud\LOCALS~1\Temp\winlogon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GamerOSD] --a------ 2007-02-14 08:42 380928 C:\Program Files\ASUS\GamerOSD\GamerOSD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup] -r------- 2006-10-30 13:44 36864 C:\WINDOWS\JM\JMInsIDE.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft all] C:\WINDOWS\mmall.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] ---hs---- 2004-06-11 15:54 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PostBootReminder] C:\Documents and Settings\Tgaud\Bureau\~tmp1174.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-11-12 15:48 21760296 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2007-12-03 21:00 1266936 c:\program files\steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Windows IPSEC Monitor"=2 (0x2) "Microsoft I Service"=2 (0x2) "Windows Management Service"=2 (0x2) "PnkBstrA"=2 (0x2) "ose"=3 (0x3) "odserv"=3 (0x3) "idsvc"=3 (0x3) "IDriverT"=3 (0x3) "helpsvc"=2 (0x2) "FontCache3.0.0.0"=3 (0x3) "FLEXnet Licensing Service"=3 (0x3) "Bonjour Service"=2 (0x2) "msupdate"=2 (0x2) "usnjsvc"=3 (0x3) "aswUpdSv"=2 (0x2) "aawservice"=2 (0x2) R1 Odptdi;Odptdi;C:\WINDOWS\system32\drivers\odptdi.sys [2006-08-03 13:53] R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2006-09-29 09:06] R4 atidgllk;atidgllk;C:\WINDOWS\atidgllk.sys [2005-10-20 08:29] S1 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb32.sys [2005-10-20 15:25] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-09-30 07:56] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a58c786-9a16-11dc-95ac-00604cd59310}] \Shell\AutoRun\command - F:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a58c787-9a16-11dc-95ac-00604cd59310}] \Shell\AutoRun\command - G:\Setup.exe . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-02-06 09:31:00 C:\WINDOWS\Tasks\At1.job" - C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe "2008-02-06 09:36:08 C:\WINDOWS\Tasks\At2.job" - C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe "2008-02-06 09:38:10 C:\WINDOWS\Tasks\At3.job" - C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe "2008-02-06 09:38:12 C:\WINDOWS\Tasks\At4.job" - C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-06 11:08:37 Windows 5.1.2600 Service Pack 2, v.2149 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\ATKKBService.exe . ************************************************************************** . Temps d'accomplissement: 2008-02-06 11:09:36 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-06 10:09:34 . 2008-02-05 21:59:27 --- E O F --- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Tgaudlol · Answer

petit post pour dire que je viens de rajouter le log ComboFix.exe ci dessus
   juste apres celui du SDfix.exe.

g!rly · Answer

re,

fais ceci :

rends toi sur ce site et fais l´update :

https://docs.microsoft.com/en-us/ 

vide tes fichier temporaire avec ceci :

->Clean Up 40:
http://pageperso.aol.fr/balltrap34/CleanUp40.exe
->aide en image:(merci a Balltrap34)
http://pageperso.aol.fr/balltrap34/democleanup.htm

click sur option et décoche la case devant : delete prefect files

vide le manuellement :

:: Le contenu du dossier prefetch ::

* C:\WINDOWS\Prefetch <= sauf le fichier layout.ini

* Ne pas oublier de vider la corbeille !

redemarre

puis repost un hijack this stp

@+

tgaudlol · Answer

Impossible de nettoyer mieux que ça, il se relance pas apres un redemarrage :(




CleanUp! started on 02/06/08 11:29:31.
C:\Documents and Settings\Tgaud\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Historique\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
'Typed URLs' (Internet Explorer) - removed from the registry.
C:\Documents and Settings\Tgaud\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Application Data\Mozilla\Firefox\Profiles\b9ksu0pt.default\cookies.txt.old - deleted
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\~DF214E.tmp currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\~DF2159.tmp currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\~DFF431.tmp currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\~DFF43C.tmp currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\~DF214E.tmp currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\~DF2159.tmp currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\~DFF431.tmp currently in use. Will be deleted when Windows is restarted.
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\~DFF43C.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\locals~1	empor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DF214E.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DF2159.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DFF431.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DFF43C.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\locals~1	empor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Historique\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DF214E.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DF2159.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DFF431.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DFF43C.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DF214E.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DF2159.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DFF431.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temp\~DFF43C.tmp currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Tgaud\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\WINDOWS\Resources\Themes\Luna\luna.msstyles - deleted
'Run MRU' list - removed from the registry.
Paint Recent File List - removed from the registry.
WordPad Recent File List - removed from the registry.
Telnet's MRU list - removed from the registry.
CleanUp! 4.0 recovered 4.0 MB of disk space from 2 files.
CleanUp! finished on 02/06/08 11:29:34.

Jattend pour le reste?

g!rly · Answer

oui c´est normal il te demande juste de redemarrer...

post un nouveau comboscan stp

@+

Tgaudlol · Answer

Bon j'ai pas reussi à effacer tous les fichiers.
La plupart il dit qu'il va les effacer au redemarrage windows, mais si au redemarrage je clique sur "cleanup" encore il
en re-éfface plein, et me dis qu'il yen a encore en utilisation qu'il peut pas effacer....
Sans compter que dans windows/prefatch les fichiers reviennent à chaque fois.


    Voici le nouvo comboscan en mode normal.



Deckard's System Scanner v20071014.68
Run by Tgaud on 2008-02-06 11:51:01
Computer is in Normal Mode.
--------------------------------------------------------------------------------

[color=red]System Drive C: has 4.52 GiB (less than 15%) free./color


-- HijackThis (run as Tgaud.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:51:03, on 06/02/2008
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\braviax.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tgaud\Bureau\dsds.exe (cest le nom de comboscan chez moi)
C:\DOCUME~1\Tgaud\Bureau\antivir\Tgaud.exe ( mon username.exe???????)

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

g!rly · Answer

re,

redemarre en mode sans echec 

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(X)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"braviax"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PostBootReminder]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Note : regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin
Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :

C:\WINDOWS\system32\users32.dat
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\cru629.dat
C:\C1gomb4odFix.exe
C:\WINDOWS\system32	mp.reg
C:\WINDOWS\system32\WS2Fix.exe
C:\WINDOWS\system32	est12.exe
C:\WINDOWS\system32\dfsj2321.exe
C:\Documents and Settings\Tgaud\Bureau\~tmp1174.exe

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

redemarre normalement et repost un hijack this 

@+

Tgaudlol · Answer

Le virus est parti pour l'instant, je suis en mode normal, mais j'ai peur qu'en redemarrant il revienne.
Avant de prendre ce risque et de verifier une fois pour toute je dois faire quelquehcose d'autre?   


Ok voici les deux d'affilé :



C:\WINDOWS\system32\users32.dat moved successfully.
C:\WINDOWS\system32\braviax.exe moved successfully.
C:\WINDOWS\cru629.dat moved successfully.
C:\C1gomb4odFix.exe moved successfully. (celui ci cetait combofix, mais je l'avais renomé de maniere bizzarre ;) )
C:\WINDOWS\system32	mp.reg moved successfully.
C:\WINDOWS\system32\WS2Fix.exe moved successfully.
C:\WINDOWS\system32	est12.exe moved successfully.
C:\WINDOWS\system32\dfsj2321.exe moved successfully.
File/Folder C:\Documents and Settings\Tgaud\Bureau\~tmp1174.exe not found.
 
OTMoveIt2 v1.0.17 log created on 02062008_153434


+++++++++++++++++++++++++++++++++++++++++++++++++

 Deckard's System Scanner v20071014.68
Run by Tgaud on 2008-02-06 15:41:26
Computer is in Normal Mode.
--------------------------------------------------------------------------------

[color=red]System Drive C: has 4.52 GiB (less than 15%) free./color


-- HijackThis (run as Tgaud.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:41:30, on 06/02/2008
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tgaud\Bureau\dsds.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\Tgaud\Bureau\antivir\Tgaud.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

g!rly · Answer

re,

ca a l´air d´etre ok pour braviax car la cle a disparue.

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instal l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php 
http://speedweb1.free.fr/frames2.php?page=tuto5
<- tutoriel configuration du scanner...

une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes : 
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

instale aussi :

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

https://kerio.probb.fr/f2-sunbelt-kerio-personal-firewall

ou zone alarm plus facil a configurer mais moins performant

https://www.malekal.com/tutoriel-zonealarm-firewall/

refais tourner clean up

et redemarre 

apres j´aimerais que tu fasse un scan a l´aide d´antivir avec les reglages que je t´ai stipulés au dessus;  vu le resultat alarmant de celui de bitdefender...

post le rapport d´antivir une fois effectué.

@+

tgaudlol · Answer

Le virus est plus la.
j'ai un peu galeré à installer le firewall etc (mise a jour pour sunbelt software firewall associé à kério + mise à jour des updates windows = deux minute de freeze sur les appli au demarrage de windows, sans que je puisse rien faire car un logiciel invisible faisait un truc, et le firewall demarrait plus il plantait a cause d'un Db.()  qquechose comme ça.

Une restauration systeme tout remarche, firewall comprisapres et me voici.
(sauf la mise à jour de kerio qui atteint pas le site sunbelt)

Nouveau hijack :


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:09:32, on 06/02/2008
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tgaud\Bureau\antivir\HijackTdhis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

Utilisateur anonyme · Answer

test pseudo

Tgaudlol · Answer

bon j'ai installé noscript pour firefox ainsi que spybot qui ma fait un peu de menage en plus ds les troyen.

sinon voici le dernier rapport "COMPLET" en date, penses tu que je puisse passer le sujet en resolve? ou il reste des choses à faire?: 

Deckard's System Scanner v20071014.68
Run by Tgaud on 2008-02-06 21:18:41
Computer is in Normal Mode.
--------------------------------------------------------------------------------

[color=red]System Drive C: has 3.18 GiB (less than 15%) free.[/color]


-- HijackThis (run as Tgaud.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:18:50, on 06/02/2008
Platform: Windows XP SP2, v.2149 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2149)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tgaud\Bureau\antivir\dsds.exe
C:\DOCUME~1\Tgaud\Bureau\antivir\Tgaud.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

g!rly · Answer

re,

peux tu faire un scan a l´aide d´antivir et poster le rapport ici,  comme je t´avais demandé au post 33

regarde les réglages que je t´ai indiqués avant de le lancer...

@´+

Tgaudlol · Answer

AntiVir PersonalEdition Classic
Report file date: jeudi 7 février 2008  02:12

Scanning for 1094800 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2, v.2149)  [5.1.2600]
Username:         Tgaud
Computer name:    TGAUDLAND

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95    3367424 Bytes  14/12/2007 16:26:12
ANTIVIR2.VDF : 7.0.2.49    1339904 Bytes  25/01/2008 16:26:12
ANTIVIR3.VDF : 7.0.2.101    336896 Bytes  06/02/2008 20:09:17
AVEWIN32.DLL : 7.6.0.62    3240448 Bytes  06/02/2008 16:26:12
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes  06/02/2008 16:26:12
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: E:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: jeudi 7 février 2008  02:12

Starting search for hidden objects.
'35686' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'rsvp.exe' - '1' Module(s) have been scanned
Scan process 'hamachi.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ATKKBService.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
29 processes with 29 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [NOTE]      No virus was found!
Master boot sector HD1
      [NOTE]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'E:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '25' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\QooBox\Quarantine\catchme2008-02-06_110835.10.zip
  [0] Archive type: ZIP
  --> beep.sys
      [DETECTION] Is the Trojan horse TR/Agent.29184.25
  --> beep.sys.1
      [DETECTION] Is the Trojan horse TR/Agent.29184.25
      [INFO]      The file was deleted!
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\Ebcc33.sys.vir
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!
C:\SDFix\backups\backups.zip
  [0] Archive type: ZIP
  --> backups/fnhoje
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!
C:	ytyty\SDFix\backups\backups.zip
  [0] Archive type: ZIP
  --> backups/basepwo32.dll
      [DETECTION] Is the Trojan horse TR/Agent.ehk.5
  --> backups/beep.sys
      [DETECTION] Is the Trojan horse TR/Agent.29184.25
      [INFO]      The file was deleted!
C:\WINDOWS\braviax.exe
      [DETECTION] Is the Trojan horse TR/Agent.11264.61
      [INFO]      The file was deleted!
C:\WINDOWS\system32\winivstr.exe
      [WARNING]   'Is the Trojan horse TR/Crypt.XDR.Gen'. This detection is probably an error. Please send us this file immediately for further analysis.
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!
C:\_OTMoveIt\MovedFiles\02062008_041742\Windows\system32\crypts.dll
      [DETECTION] Is the Trojan horse TR/Click.Agent.LT.5
      [INFO]      The file was deleted!
C:\_OTMoveIt\MovedFiles\02062008_041853\WINDOWS\system32\braviax.exe
      [DETECTION] Is the Trojan horse TR/Agent.11264.61
      [INFO]      The file was deleted!
C:\_OTMoveIt\MovedFiles\02062008_102950\WINDOWS\braviax.exe
      [DETECTION] Is the Trojan horse TR/Agent.11264.61
      [INFO]      The file was deleted!
C:\_OTMoveIt\MovedFiles\02062008_104045\WINDOWS\braviax.exe
      [DETECTION] Is the Trojan horse TR/Agent.11264.61
      [INFO]      The file was deleted!
C:\_OTMoveIt\MovedFiles\02062008_153434\WINDOWS\cru629.dat
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was deleted!
C:\_OTMoveIt\MovedFiles\02062008_153434\WINDOWS\system32\braviax.exe
      [DETECTION] Is the Trojan horse TR/Agent.11264.61
      [INFO]      The file was deleted!
C:\_OTMoveIt\MovedFiles\02062008_153434\WINDOWS\system32\dfsj2321.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!
C:\_OTMoveIt\MovedFiles\02062008_153434\WINDOWS\system32	est12.exe
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!
Begin scan in 'E:\' <Stockage>


End of the scan: jeudi 7 février 2008  03:01
Used time: 49:02 min

The scan has been done completely.

   7501 Scanning directories
 494327 Files were scanned
     15 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     13 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 494312 Files not concerned
   1775 Archives were scanned
      3 Warnings
     45 Notes
  35686 Objects were scanned with rootkit scan
      0 Hidden objects were found

g!rly · Answer

salut  Tgaudlol,

oui c´est normal que kerio ne se mette pas a jour, ils ont arreté le developpement de leur par feu...

peux tu repasser combofix et poster le rapport ici stp sans le renommer :

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

Tgaudlol · Answer

ComboFix 08-02.05.3 - Tgaud 2008-02-07 14:35:25.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1339 [GMT 1:00] Endroit: C:\Documents and Settings\Tgaud\Bureau\ComboFix.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ----- BITS: Possible sites infectés ----- hxxp://www.download.windowsupdate.com . ((((((((((((((((((((((((((((( Fichiers créés 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))))))) . 2008-02-06 21:02 . 2008-02-06 21:02 d-------- C:\WINDOWS\LastGood 2008-02-06 20:01 . 2008-02-06 20:26 547 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-02-06 19:59 . 2008-02-06 19:59 d-------- C:\Program Files\Sunbelt Software 2008-02-06 19:41 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-02-06 19:41 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2008-02-06 19:41 . 2007-07-30 19:19 203,096 --a--c--- C:\WINDOWS\system32\dllcache\wuweb.dll 2008-02-06 18:12 . 2008-02-06 18:12 d-------- C:\Program Files\Kerio 2008-02-06 17:55 . 2008-02-06 17:55 d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-06 17:55 . 2008-02-06 18:01 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-06 17:26 . 2008-02-06 17:26 250 --a------ C:\WINDOWS\gmer.ini 2008-02-06 17:24 . 2008-02-06 17:24 d-------- C:\Program Files\Avira 2008-02-06 17:24 . 2008-02-06 17:24 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-02-06 11:21 . 2008-02-06 11:21 d-------- C:\Program Files\CleanUp! 2008-02-06 10:54 . 2008-02-07 14:35 d-------- C: ytyty 2008-02-06 09:50 . 2008-02-06 09:50 d-------- C:\Deckard 2008-02-06 07:19 . 2008-02-06 11:45 160,568 --a------ C:\WINDOWS\system32\winivstr.exe 2008-02-06 07:17 . 2004-06-10 15:18 29,056 --a------ C:\WINDOWS\system32\drivers\ip6fw.sys 2008-02-06 07:15 . 2008-02-06 07:15 d-------- C:\WINDOWS\ERUNT 2008-02-06 05:47 . 2008-02-06 05:47 d-------- C:\Documents and Settings\Tgaud\Application Data\Grisoft 2008-02-06 05:40 . 2008-02-06 05:40 d-------- C: oto 2008-02-06 05:37 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-02-06 05:29 . 2008-02-06 05:29 d-------- C:\Program Files\Lavasoft 2008-02-06 05:29 . 2008-02-06 05:33 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-06 04:14 . 2008-02-05 20:09 4,224 --a------ C:\WINDOWS\system32\drivers\beep.sys 2008-02-06 04:14 . 2008-02-05 20:09 4,224 --a--c--- C:\WINDOWS\system32\dllcache\beep.sys 2008-02-06 00:33 . 2008-02-06 00:33 d-------- C:\_OTMoveIt 2008-02-05 23:08 . 2008-02-06 06:44 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-02-05 22:18 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-02-05 22:18 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-02-05 22:18 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-02-05 22:18 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-02-05 22:18 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-02-05 22:18 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-02-05 22:18 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-02-05 22:18 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-02-05 22:15 . 2008-02-05 22:17 d-------- C:\Program Files\Lop SD 2008-02-05 22:15 . 2008-02-06 11:09 d-------- C:\CombroFix 2008-02-05 22:15 . 2004-06-11 15:43 402,432 --a------ C:\kmd.exe 2008-02-05 21:54 . 2008-02-05 21:54 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-02-05 21:29 . 2008-02-05 21:29 d-------- C:\Program Files\Trend Micro 2008-02-05 20:57 . 2008-02-06 10:53 d-------- C:\SDFix 2008-02-05 20:01 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-02-05 20:01 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-02-05 20:01 . 2008-02-05 00:23 85,504 --a------ C:\WINDOWS\system32\VACFix.exe 2008-02-05 20:01 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-02-05 20:01 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-02-05 20:01 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-02-05 19:49 . 2008-02-05 19:49 d-------- C:\Program Files\CCleaner 2008-02-05 19:14 . 2008-02-05 19:14 16,384 --a------ C:\WINDOWS\system32 od32se.exe 2008-02-05 19:14 . 2008-02-05 19:14 80 --a------ C:\WINDOWS\system32\suspend.bin 2008-02-04 20:11 . 2008-02-04 20:11 d-------- C:\Program Files\Microsoft Games 2008-02-02 01:34 . 2008-02-02 01:34 d-------- C:\Program Files\Hamachi 2008-02-02 01:34 . 2008-02-06 23:14 d-------- C:\Documents and Settings\Tgaud\Application Data\Hamachi 2008-02-02 01:34 . 2008-02-02 01:54 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-01-25 22:40 . 2008-01-25 22:40 d-------- C:\Program Files\QuickTime 2008-01-20 17:52 . 2008-01-20 17:52 d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3 2008-01-16 22:25 . 2008-01-16 22:30 14 --ah----- C:\WINDOWS\mmax.ini 2008-01-16 22:23 . 2008-01-16 22:23 4 --a------ C:\WINDOWS\c.pid 2008-01-16 22:22 . 2008-01-16 22:22 dr------- C:\Documents and Settings\LocalService\Favoris . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-06 18:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-02-06 10:22 --------- d-----w C:\Program Files\Super macro 2008-02-06 10:22 --------- d-----w C:\Program Files\eMule 2008-02-06 04:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-06 04:29 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-02-06 03:39 --------- d-----w C:\Program Files\MSN Messenger 2008-02-06 03:36 --------- d-----w C:\Program Files\DAEMON Tools 2008-02-06 03:36 --------- d-----w C:\Program Files\Bonjour 2008-02-03 13:36 196,608 ----a-w C:\WINDOWS\system32\drivers\aStandard.bin 2008-01-20 16:57 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-16 21:53 --------- d-----w C:\Documents and Settings\Tgaud\Application Data\Skype 2008-01-16 15:02 --------- d-----w C:\Documents and Settings\Tgaud\Application Data\skypePM 2008-01-15 17:42 --------- d-----w C:\Program Files\Steam 2008-01-05 19:57 --------- d-----w C:\Program Files\Alwil Software 2008-01-05 19:47 9,216 ----a-w C:\WINDOWS\system32\avgwlntf.dll 2008-01-05 19:34 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-01-05 18:30 --------- d-----w C:\Program Files\Microsoft Security AdviserREN 2008-01-05 17:35 102,664 ----a-w C:\WINDOWS\system32\drivers mcomm.sys 2008-01-05 17:33 --------- d-----w C:\Program Files\Java 2008-01-05 17:32 --------- d-----w C:\Program Files\Fichiers communs\Java 2007-12-18 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Media Center Programs 2007-12-17 19:46 --------- d-----w C:\Program Files\THQ 2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2007-12-12 13:44 --------- d-----w C:\Program Files\DivX 2007-12-11 22:55 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2007-12-11 22:55 --------- d-----w C:\Program Files\Skype 2007-12-11 22:55 --------- d-----w C:\Program Files\Fichiers communs\Skype 2007-12-11 22:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-12-11 22:34 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-12-11 22:34 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-11-25 22:43 245,408 ----a-w C:\WINDOWS\system32\unicows.dll 2007-11-19 20:29 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-11-19 19:59 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe 2007-11-19 19:59 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-11-19 19:59 22,328 ----a-w C:\Documents and Settings\Tgaud\Application Data\PnkBstrK.sys 2007-11-19 19:59 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-15 22:39 364,544 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2007-11-15 22:38 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2007-11-15 22:31 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2007-11-15 22:30 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2007-11-15 22:30 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2007-11-15 22:30 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2007-11-15 22:30 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2007-11-15 22:30 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2007-11-15 22:28 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2007-11-15 22:28 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2007-11-15 22:23 9,314,304 ----a-w C:\WINDOWS\system32\atioglx2.dll 2007-11-15 22:19 3,135,040 ----a-w C:\WINDOWS\system32\ati3duag.dll 2007-11-15 22:08 1,601,792 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2007-11-15 21:54 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll 2007-11-15 21:52 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2007-11-15 21:50 176,128 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2007-11-15 21:46 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2007-11-15 15:39 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-09-30 03:18 5674352] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 10:33 16132608 C:\WINDOWS\RTHDCPL.exe] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-06 17:26 249896] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "UseDesktopIniCache"= 1 (0x1) [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech SetPoint.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Tgaud^Menu Démarrer^Programmes^Démarrage^CCC.lnk] path=C:\Documents and Settings\Tgaud\Menu Démarrer\Programmes\Démarrage\CCC.lnk backup=C:\WINDOWS\pss\CCC.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer] -r------- 2007-02-06 13:08 1953792 C:\WINDOWS\system32\JMRaidSetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 02:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 11:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor] --a------ 2007-04-23 20:20 1114112 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonjour] C:\WINDOWS\vmmreg32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-06-11 15:43 14336 C:\WINDOWS\system32\CTFMON.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firewall auto setup] C:\DOCUME~1\Tgaud\LOCALS~1\Temp\winlogon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GamerOSD] --a------ 2007-02-14 08:42 380928 C:\Program Files\ASUS\GamerOSD\GamerOSD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup] -r------- 2006-10-30 13:44 36864 C:\WINDOWS\JM\JMInsIDE.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft all] C:\WINDOWS\mmall.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] ---hs---- 2004-06-11 15:54 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-11-12 15:48 21760296 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2007-12-03 21:00 1266936 c:\program files\steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Windows IPSEC Monitor"=2 (0x2) "Microsoft I Service"=2 (0x2) "Windows Management Service"=2 (0x2) "PnkBstrA"=2 (0x2) "ose"=3 (0x3) "odserv"=3 (0x3) "idsvc"=3 (0x3) "IDriverT"=3 (0x3) "helpsvc"=2 (0x2) "FontCache3.0.0.0"=3 (0x3) "FLEXnet Licensing Service"=3 (0x3) "Bonjour Service"=2 (0x2) "msupdate"=2 (0x2) "usnjsvc"=3 (0x3) "aswUpdSv"=2 (0x2) "aawservice"=2 (0x2) R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2004-04-15 11:02] R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2006-09-29 09:06] R4 atidgllk;atidgllk;C:\WINDOWS\atidgllk.sys [2005-10-20 08:29] R4 Odptdi;Odptdi;C:\WINDOWS\system32\drivers\odptdi.sys [] S1 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb32.sys [2005-10-20 15:25] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-09-30 07:56] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a58c786-9a16-11dc-95ac-00604cd59310}] \Shell\AutoRun\command - F:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a58c787-9a16-11dc-95ac-00604cd59310}] \Shell\AutoRun\command - G:\Setup.exe . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-02-07 09:31:00 C:\WINDOWS\Tasks\At1.job" - C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe "2008-02-07 09:36:00 C:\WINDOWS\Tasks\At2.job" - C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe "2008-02-07 09:38:00 C:\WINDOWS\Tasks\At3.job" - C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe "2008-02-07 09:38:00 C:\WINDOWS\Tasks\At4.job" - C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-07 14:36:55 Windows 5.1.2600 Service Pack 2, v.2149 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-02-07 14:37:13 ComboFix-quarantined-files.txt 2008-02-07 13:37:11 . 2008-02-05 21:59:27 --- E O F ---

g!rly · Answer

re,

Copie le texte ci-dessous :

File::
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\winlogon.exe
C:\WINDOWS\mmall.exe
C:\WINDOWS\Tasks\At1.job"
C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe
C:\WINDOWS\Tasks\At2.job"
C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe
C:\WINDOWS\Tasks\At3.job"
C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe
C:\WINDOWS\Tasks\At4.job"
C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe 

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firewall auto setup]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft all]

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 


Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt2

S'il n'y a pas de rédémarrage, poste quand même le rapport.

@+

Tgaudlol · Answer

Re, merci se tjrs toccuper du probleme. la fenetre bleu apparait mais elle me demande jamais 1 ou 2. cette fois jai juste eu une popup me demandant oui non à la sourie cest tout. je sais pas si le script a marché quoiqu'il en soit voici le compte rendu : ++++++++++++++++++++++++++++++++++++++++++++ ComboFix 08-02.05.3 - Tgaud 2008-02-07 15:29:42.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1564 [GMT 1:00] Endroit: C:\Documents and Settings\Tgaud\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Tgaud\Bureau\CFScript.txt * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE C:\DOCUME~1\Tgaud\Bureau\Look2Me-Destroyer.exe C:\DOCUME~1\Tgaud\LOCALS~1\Temp\winlogon.exe C:\WINDOWS\mmall.exe C:\WINDOWS\Tasks\At1.job" C:\WINDOWS\Tasks\At2.job" C:\WINDOWS\Tasks\At3.job" C:\WINDOWS\Tasks\At4.job" . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Tasks\At1.job C:\WINDOWS\Tasks\At2.job C:\WINDOWS\Tasks\At3.job C:\WINDOWS\Tasks\At4.job . ((((((((((((((((((((((((((((( Fichiers créés 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))))))) . 2008-02-07 14:35 . 2004-06-11 15:43 402,432 --a------ C:\kmd.exe 2008-02-06 21:02 . 2008-02-06 21:02 d-------- C:\WINDOWS\LastGood 2008-02-06 20:01 . 2008-02-06 20:26 547 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2008-02-06 19:59 . 2008-02-06 19:59 d-------- C:\Program Files\Sunbelt Software 2008-02-06 19:41 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-02-06 19:41 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2008-02-06 19:41 . 2007-07-30 19:19 203,096 --a--c--- C:\WINDOWS\system32\dllcache\wuweb.dll 2008-02-06 18:12 . 2008-02-06 18:12 d-------- C:\Program Files\Kerio 2008-02-06 17:55 . 2008-02-06 17:55 d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-06 17:55 . 2008-02-06 18:01 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-06 17:26 . 2008-02-06 17:26 250 --a------ C:\WINDOWS\gmer.ini 2008-02-06 17:24 . 2008-02-06 17:24 d-------- C:\Program Files\Avira 2008-02-06 17:24 . 2008-02-06 17:24 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-02-06 11:21 . 2008-02-06 11:21 d-------- C:\Program Files\CleanUp! 2008-02-06 10:54 . 2008-02-07 14:35 d-------- C: ytyty 2008-02-06 09:50 . 2008-02-06 09:50 d-------- C:\Deckard 2008-02-06 07:19 . 2008-02-06 11:45 160,568 --a------ C:\WINDOWS\system32\winivstr.exe 2008-02-06 07:17 . 2004-06-10 15:18 29,056 --a------ C:\WINDOWS\system32\drivers\ip6fw.sys 2008-02-06 07:15 . 2008-02-06 07:15 d-------- C:\WINDOWS\ERUNT 2008-02-06 05:47 . 2008-02-06 05:47 d-------- C:\Documents and Settings\Tgaud\Application Data\Grisoft 2008-02-06 05:40 . 2008-02-06 05:40 d-------- C: oto 2008-02-06 05:37 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-02-06 05:29 . 2008-02-06 05:29 d-------- C:\Program Files\Lavasoft 2008-02-06 05:29 . 2008-02-06 05:33 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-06 04:14 . 2008-02-05 20:09 4,224 --a------ C:\WINDOWS\system32\drivers\beep.sys 2008-02-06 04:14 . 2008-02-05 20:09 4,224 --a--c--- C:\WINDOWS\system32\dllcache\beep.sys 2008-02-06 00:33 . 2008-02-06 00:33 d-------- C:\_OTMoveIt 2008-02-05 23:08 . 2008-02-06 06:44 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-02-05 22:18 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2008-02-05 22:18 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2008-02-05 22:18 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2008-02-05 22:18 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2008-02-05 22:18 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2008-02-05 22:18 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2008-02-05 22:18 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2008-02-05 22:18 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2008-02-05 22:15 . 2008-02-05 22:17 d-------- C:\Program Files\Lop SD 2008-02-05 22:15 . 2008-02-06 11:09 d-------- C:\CombroFix 2008-02-05 21:54 . 2008-02-05 21:54 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-02-05 21:29 . 2008-02-05 21:29 d-------- C:\Program Files\Trend Micro 2008-02-05 20:57 . 2008-02-06 10:53 d-------- C:\SDFix 2008-02-05 20:01 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-02-05 20:01 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-02-05 20:01 . 2008-02-05 00:23 85,504 --a------ C:\WINDOWS\system32\VACFix.exe 2008-02-05 20:01 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-02-05 20:01 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-02-05 20:01 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-02-05 19:49 . 2008-02-05 19:49 d-------- C:\Program Files\CCleaner 2008-02-05 19:14 . 2008-02-05 19:14 16,384 --a------ C:\WINDOWS\system32 od32se.exe 2008-02-05 19:14 . 2008-02-05 19:14 80 --a------ C:\WINDOWS\system32\suspend.bin 2008-02-04 20:11 . 2008-02-04 20:11 d-------- C:\Program Files\Microsoft Games 2008-02-02 01:34 . 2008-02-02 01:34 d-------- C:\Program Files\Hamachi 2008-02-02 01:34 . 2008-02-07 15:29 d-------- C:\Documents and Settings\Tgaud\Application Data\Hamachi 2008-02-02 01:34 . 2008-02-02 01:54 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-01-25 22:40 . 2008-01-25 22:40 d-------- C:\Program Files\QuickTime 2008-01-20 17:52 . 2008-01-20 17:52 d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3 2008-01-16 22:25 . 2008-01-16 22:30 14 --ah----- C:\WINDOWS\mmax.ini 2008-01-16 22:23 . 2008-01-16 22:23 4 --a------ C:\WINDOWS\c.pid 2008-01-16 22:22 . 2008-01-16 22:22 dr------- C:\Documents and Settings\LocalService\Favoris . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-06 18:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-02-06 10:22 --------- d-----w C:\Program Files\Super macro 2008-02-06 10:22 --------- d-----w C:\Program Files\eMule 2008-02-06 04:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-06 04:29 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-02-06 03:39 --------- d-----w C:\Program Files\MSN Messenger 2008-02-06 03:36 --------- d-----w C:\Program Files\DAEMON Tools 2008-02-06 03:36 --------- d-----w C:\Program Files\Bonjour 2008-02-03 13:36 196,608 ----a-w C:\WINDOWS\system32\drivers\aStandard.bin 2008-01-20 16:57 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-16 21:53 --------- d-----w C:\Documents and Settings\Tgaud\Application Data\Skype 2008-01-16 15:02 --------- d-----w C:\Documents and Settings\Tgaud\Application Data\skypePM 2008-01-15 17:42 --------- d-----w C:\Program Files\Steam 2008-01-05 19:57 --------- d-----w C:\Program Files\Alwil Software 2008-01-05 19:47 9,216 ----a-w C:\WINDOWS\system32\avgwlntf.dll 2008-01-05 19:34 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-01-05 18:30 --------- d-----w C:\Program Files\Microsoft Security AdviserREN 2008-01-05 17:35 102,664 ----a-w C:\WINDOWS\system32\drivers mcomm.sys 2008-01-05 17:33 --------- d-----w C:\Program Files\Java 2008-01-05 17:32 --------- d-----w C:\Program Files\Fichiers communs\Java 2007-12-18 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Media Center Programs 2007-12-17 19:46 --------- d-----w C:\Program Files\THQ 2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2007-12-12 13:44 --------- d-----w C:\Program Files\DivX 2007-12-11 22:55 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2007-12-11 22:55 --------- d-----w C:\Program Files\Skype 2007-12-11 22:55 --------- d-----w C:\Program Files\Fichiers communs\Skype 2007-12-11 22:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-12-11 22:34 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-12-11 22:34 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-11-25 22:43 245,408 ----a-w C:\WINDOWS\system32\unicows.dll 2007-11-19 20:29 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-11-19 19:59 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe 2007-11-19 19:59 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-11-19 19:59 22,328 ----a-w C:\Documents and Settings\Tgaud\Application Data\PnkBstrK.sys 2007-11-19 19:59 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-11-15 22:39 364,544 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2007-11-15 22:38 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2007-11-15 22:31 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2007-11-15 22:30 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2007-11-15 22:30 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2007-11-15 22:30 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2007-11-15 22:30 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2007-11-15 22:30 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2007-11-15 22:28 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2007-11-15 22:28 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2007-11-15 22:23 9,314,304 ----a-w C:\WINDOWS\system32\atioglx2.dll 2007-11-15 22:19 3,135,040 ----a-w C:\WINDOWS\system32\ati3duag.dll 2007-11-15 22:08 1,601,792 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2007-11-15 21:54 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll 2007-11-15 21:52 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2007-11-15 21:50 176,128 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2007-11-15 21:46 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2007-11-15 15:39 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-09-30 03:18 5674352] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-04-12 10:33 16132608 C:\WINDOWS\RTHDCPL.exe] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-06 17:26 249896] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "UseDesktopIniCache"= 1 (0x1) [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech SetPoint.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Tgaud^Menu Démarrer^Programmes^Démarrage^CCC.lnk] path=C:\Documents and Settings\Tgaud\Menu Démarrer\Programmes\Démarrage\CCC.lnk backup=C:\WINDOWS\pss\CCC.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer] -r------- 2007-02-06 13:08 1953792 C:\WINDOWS\system32\JMRaidSetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 02:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 11:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor] --a------ 2007-04-23 20:20 1114112 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonjour] C:\WINDOWS\vmmreg32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-06-11 15:43 14336 C:\WINDOWS\system32\CTFMON.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GamerOSD] --a------ 2007-02-14 08:42 380928 C:\Program Files\ASUS\GamerOSD\GamerOSD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup] -r------- 2006-10-30 13:44 36864 C:\WINDOWS\JM\JMInsIDE.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2007-04-11 14:32 56080 C:\WINDOWS\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] ---hs---- 2004-06-11 15:54 1667584 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-11-12 15:48 21760296 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2007-12-03 21:00 1266936 c:\program files\steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Windows IPSEC Monitor"=2 (0x2) "Microsoft I Service"=2 (0x2) "Windows Management Service"=2 (0x2) "PnkBstrA"=2 (0x2) "ose"=3 (0x3) "odserv"=3 (0x3) "idsvc"=3 (0x3) "IDriverT"=3 (0x3) "helpsvc"=2 (0x2) "FontCache3.0.0.0"=3 (0x3) "FLEXnet Licensing Service"=3 (0x3) "Bonjour Service"=2 (0x2) "msupdate"=2 (0x2) "usnjsvc"=3 (0x3) "aswUpdSv"=2 (0x2) "aawservice"=2 (0x2) R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2004-04-15 11:02] R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2006-09-29 09:06] R4 atidgllk;atidgllk;C:\WINDOWS\atidgllk.sys [2005-10-20 08:29] R4 Odptdi;Odptdi;C:\WINDOWS\system32\drivers\odptdi.sys [] S1 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb32.sys [2005-10-20 15:25] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-09-30 07:56] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a58c786-9a16-11dc-95ac-00604cd59310}] \Shell\AutoRun\command - F:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a58c787-9a16-11dc-95ac-00604cd59310}] \Shell\AutoRun\command - G:\Setup.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-07 15:30:00 Windows 5.1.2600 Service Pack 2, v.2149 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-02-07 15:30:15 ComboFix-quarantined-files.txt 2008-02-07 14:30:13 ComboFix2.txt 2008-02-07 13:37:13 . 2008-02-05 21:59:27 --- E O F ---

g!rly · Answer

ok cool ;-)

maintenant sa serait bien de refaire un scan en ligne avec bitdefender

Scan en ligne bitdefender :

https://www.bitdefender.com/toolbox/

Clicker sur " I agree " et suivre les indications 

A faire imperativement sous internet explorer, en acceptant l´activ x

tutoriel en image en image

http://pageperso.aol.fr/rginformatique/mapage/defender.htm

Post le resultat ici stp

@+

Tgaudlol · Answer

Cest en cours mais tres long.
Peut tu, pour ma culture generale, recapituler ce que tu viens de me faire faire sur les derniers operation?
J'ai une formation en informatique mais la sécuritée ne fais pas partie de mon métier.
j'ai essayé de comprend pourquoi tu me faisait faire cela sans succes.

En tout cas cest tres gentil de m'aider.

g!rly · Answer

re,

oui le scan est long ;-(

il le serait moins si tu ne surfait pas en meme temps ;)

en faite on a enlevé deux clés de registre 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft all]
C:\WINDOWS\mmall.exe 

ce fichier on l´avait supprimé je m´en souviens mais pas la clé

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firewall auto setup]
C:\DOCUME~1\Tgaud\LOCALS~1\Temp\winlogon.exe 

celui a été supprimé mais je ne sais pas quand. la clé etait la aussi...

+ j´ai retirer l´outil look 2 me destroyer  ( + ces task job ) que l´on avait utilisé...

maintenant le scan de bit defender va nous montrer que la machine est bien propre,  je l´espere...

je te le fais faire car bizarrement antivir avait encore detecté braviax dans le dossier windows...

C:\WINDOWS\braviax.exe
[DETECTION] Is the Trojan horse TR/Agent.11264.61
[INFO] The file was deleted! 

@+

Tgaudlol · Answer

Scanned File
	

 Status

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003290.exe
	

Infected with: Generic.Malware.Yd!dld!sp.730153C3

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003290.exe
	

Disinfection failed

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003290.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003291.dll
	

Infected with: Generic.Dld.HotLan.1ADAB5B6

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003291.dll
	

Disinfection failed

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003291.dll
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003292.exe
	

Infected with: Generic.Malware.Yd!dld!sp.730153C3

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003292.exe
	

Disinfection failed

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003292.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003293.exe
	

Infected with: Generic.Malware.Yd!dld!sp.730153C3

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003293.exe
	

Disinfection failed

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003293.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003294.exe
	

Infected with: Generic.Malware.Yd!dld!sp.730153C3

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003294.exe
	

Disinfection failed

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003294.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003295.exe
	

Infected with: Generic.Malware.Yd!dld!sp.730153C3

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003295.exe
	

Disinfection failed

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP12\A0003295.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP2\A0000014.sys
	

Infected with: Trojan.Srizbi.AS

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP2\A0000014.sys
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP2\A0000018.exe
	

Detected with: Adware.Udefender.S

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP2\A0000018.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP3\A0000093.exe
	

Detected with: Adware.Udefender.S

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP3\A0000093.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP3\A0000155.exe
	

Detected with: Adware.Udefender.S

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP3\A0000155.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP3\A0000168.exe
	

Detected with: Adware.Udefender.S

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP3\A0000168.exe
	

Deleted

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP5\A0000210.exe
	

Infected with: Generic.Malware.Yd!dld!sp.730153C3

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP5\A0000210.exe
	

Disinfection failed

C:\System Volume Information\_restore{32925F0B-6273-4C5E-950B-403D819E7394}\RP5\A0000210.exe
	

Deleted

C:\WINDOWS\system32\winivstr.exe
	

Detected with: Adware.Udefender.S

C:\WINDOWS\system32\winivstr.exe
	

Deleted

g!rly · Answer

bon, 

c´est plutot pas mal ;-)

peux tu faire ceci :

Télécharge OAD http://sosvirus.changelog.fr/OAD.exe
- Enregistre le sur ton bureau

Double clique sur le OAD pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de :

winivstr.exe 

- Type de recherche : sélectionne l'option 6 puis valide

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ait terminé.
Le rapport de recherche s'affichera automatiquement à l’écran dès qu'il aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

Note importante : Suivant la taille des disques durs cette recherche peut prendre plusieurs minutes. Sois patient

il a l´air de revenir, antivir l´avait deja supprimé, mais avec un message disant qu´il penssait que c´etait un faux positif, on va verifier si il est toujours la et si il est afilié a queque chose.

@+

Tgaudlol · Answer

07/02/2008 ---- 21:48:46,23  

----------------------------------
§§§§§§ [winivstr.exe] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

g!rly · Answer

ok

c´est cool,

il n´est plus la ;-)

bon ca a l´air bon maintenant, qu´est ce que t´en pensse?

@+

Tgaudlol · Answer

J'en pense que je te remercie pour tout, c'est cool les personnes comme toi qui prennent de leur temp pour aider les autres.
Merci ;)

g!rly · Answer

ok,

de rien, merci ;-)

Bonne continuation`

Bye`

dada2col · Answer

bonjour j'ai aussi chopé braviax et cru 629 et je sais pas comment l'éliminer pouvez vous m'aider voilà le rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:55:18, on 22/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Documents and Settings\Dada\Bureau\eden.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: cru629.dat

jacques.gache · Answer

Tgaudlol bonsoir, ouvre un autre tropic car tu es sur un sujet résolu et tu risques de pas avoir beaucoup de réponse

Ginette · Answer

Bonjour 
Comme bien d'autres mon ordi est infecté avec braviax.exe.
J'arrive pas à m'en débarrasser .
Est ce que quelqu,un serait assez gentil pour me guider svp .
Je suis dans la soixantaine et peu habituée à supprimer un virus alors je demande un peu d'indulgence ;-))
Merci à l'avance et désolée de vous ennuyer avec un sujet que vous devez voir des millions de vois

jacques.gache · Answer

Ginette bonjour, ouvre toi un sujet perso se sera plus simple dés que tu la ouverts je t'aiderais

Virus braviax, [hijackthis]

55 réponses

Discussions similaires

Newsletters