Virtumonde et alertes sécurité par windows

Bonjour

Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse


ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.


A++

Bon alors voici le rapport VBG :

[02/22/2008, 13:24:18] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Administrateur\Bureau\VirtumundoBeGone.exe" )
[02/22/2008, 13:24:25] - Detected System Information:
[02/22/2008, 13:24:25] - Windows Version: 5.1.2600, Service Pack 2
[02/22/2008, 13:24:25] - Current Username: Administrateur (Admin)
[02/22/2008, 13:24:25] - Windows is in NORMAL mode.
[02/22/2008, 13:24:25] - Searching for Browser Helper Objects:
[02/22/2008, 13:24:26] - BHO 1: {06358080-33BE-452b-9B31-E54E112ADCCA} ()
[02/22/2008, 13:24:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/22/2008, 13:24:26] - No filename found. Continuing.
[02/22/2008, 13:24:26] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/22/2008, 13:24:26] - BHO 3: {23D44BCF-AA7A-41D6-8905-E808F16322EF} ()
[02/22/2008, 13:24:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/22/2008, 13:24:26] - Checking for HKLM\...\Winlogon\Notify\nnnnnkl
[02/22/2008, 13:24:26] - Key not found: HKLM\...\Winlogon\Notify\nnnnnkl, continuing.
[02/22/2008, 13:24:26] - BHO 4: {3A271508-9F31-4B3E-BC0B-C4305FAA2DB5} ()
[02/22/2008, 13:24:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/22/2008, 13:24:26] - No filename found. Continuing.
[02/22/2008, 13:24:26] - BHO 5: {53707962-6F74-2D53-2644-206D7942484F} ()
[02/22/2008, 13:24:26] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/22/2008, 13:24:27] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[02/22/2008, 13:24:27] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[02/22/2008, 13:24:27] - BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/22/2008, 13:24:27] - BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[02/22/2008, 13:24:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/22/2008, 13:24:27] - No filename found. Continuing.
[02/22/2008, 13:24:27] - BHO 8: {AC8F6FB5-67EF-4AC3-A1D9-A8B9D95FE396} ()
[02/22/2008, 13:24:27] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/22/2008, 13:24:27] - Checking for HKLM\...\Winlogon\Notify\byvvt
[02/22/2008, 13:24:27] - Key not found: HKLM\...\Winlogon\Notify\byvvt, continuing.
[02/22/2008, 13:24:27] - BHO 9: {CDA8F659-426C-4C8A-B5A8-8715D6AFD848} ()
[02/22/2008, 13:24:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/22/2008, 13:24:28] - No filename found. Continuing.
[02/22/2008, 13:24:28] - BHO 10: {cdfb9b1a-66e9-4609-9785-a7b3c8c6936c} ()
[02/22/2008, 13:24:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/22/2008, 13:24:28] - No filename found. Continuing.
[02/22/2008, 13:24:28] - Finished Searching Browser Helper Objects
[02/22/2008, 13:24:28] - Finishing up...
[02/22/2008, 13:24:28] - Nothing found! Exiting...


Et le rapport nouveau rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:00:26, on 22/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Streamload\MediaMax XL\StreamloadService.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Programmes ajoutés\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {06358080-33BE-452b-9B31-E54E112ADCCA} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {23D44BCF-AA7A-41D6-8905-E808F16322EF} - C:\WINDOWS\system32\nnnnnkl.dll
O2 - BHO: (no name) - {3A271508-9F31-4B3E-BC0B-C4305FAA2DB5} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmes ajoutés\Anti espion Nettoyeur Spybot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {AC8F6FB5-67EF-4AC3-A1D9-A8B9D95FE396} - C:\WINDOWS\system32\byvvt.dll (file missing)
O2 - BHO: (no name) - {CDA8F659-426C-4C8A-B5A8-8715D6AFD848} - (no file)
O2 - BHO: {c6396c8c-3b7a-5879-9064-9e66a1b9bfdc} - {cdfb9b1a-66e9-4609-9785-a7b3c8c6936c} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://config.zebulon.fr/plugins/hardwaredetection.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: xxwwu - C:\WINDOWS\system32\xxwwu.dll (file missing)
O20 - Winlogon Notify: yayvuvw - yayvuvw.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Streamload Service (StreamloadService) - Streamload - C:\Program Files\Streamload\MediaMax XL\StreamloadService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ok
On continue

Télécharges ComboFix à partir d'un de ces liens :
En premier
http://download.bleepingcomputer.com/sUBs/ComboFix.exe


Et important, enregistre le sur le bureau.

Avant d'utiliser ComboFix :

► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.


Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. /!\

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,
est automatiquement sauvegardé et rangé à C:\Combofix.txt)

► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.


+ un log Hijackthis

A++

Alors voici le rapport Combofix :

ComboFix 08-02-22.3 - Administrateur 2008-02-22 18:33:36.1 - NTFSx86
Endroit: C:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\hjldstyt.ini
C:\WINDOWS\system32\klnovpni.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnnnnkl.dll
C:\WINDOWS\system32\swqetblq.ini
C:\WINDOWS\system32\turrignl.ini
C:\WINDOWS\system32\xmgwjlki.ini

----- BITS: Possible sites infect‚s -----

hxxp://au.download.windowsu
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-22 to 2008-02-22 ))))))))))))))))))))))))))))))))))))
.

2008-02-20 21:40 . 2008-02-21 19:25 <REP> d-------- C:\VundoFix Backups
2008-02-18 21:40 . 2008-02-18 21:40 <REP> d-------- C:\Program Files\Avira
2008-02-18 21:40 . 2008-02-18 21:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-02-17 19:55 . 2008-02-18 14:57 <REP> d-------- C:\Program Files\a-squared Free
2008-02-16 16:50 . 2008-02-16 16:49 691,545 --a------ C:\WINDOWS\unins000.exe
2008-02-16 16:50 . 2008-02-16 16:50 3,466 --a------ C:\WINDOWS\unins000.dat
2008-02-14 17:02 . 2008-02-14 17:02 54,762 --a------ C:\WINDOWS\system32\jkghje.dll
2008-02-12 13:21 . 2008-02-12 13:21 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Ambient Design

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 17:47 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\OpenOffice.org2
2008-02-21 18:56 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Canon
2008-02-16 15:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 14:26 2,073,600 ----a-w C:\WINDOWS\Internet Logs\xDB46.tmp
2008-02-08 20:17 --------- d-----w C:\Program Files\Crazy Browser
2008-02-05 12:25 2,043,904 ----a-w C:\WINDOWS\Internet Logs\xDB45.tmp
2008-02-05 12:25 115,200 ----a-w C:\WINDOWS\Internet Logs\xDB44.tmp
2008-02-04 21:20 3,344,896 ----a-w C:\WINDOWS\Internet Logs\xDB42.tmp
2008-02-04 21:20 2,042,880 ----a-w C:\WINDOWS\Internet Logs\xDB43.tmp
2008-01-31 05:09 6,694,536 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-01-30 12:59 2,034,176 ----a-w C:\WINDOWS\Internet Logs\xDB41.tmp
2008-01-30 07:45 2,033,664 ----a-w C:\WINDOWS\Internet Logs\xDB40.tmp
2008-01-28 21:30 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\FileZilla
2008-01-26 09:30 3,149,824 ----a-w C:\WINDOWS\Internet Logs\xDB3E.tmp
2008-01-26 09:30 2,029,568 ----a-w C:\WINDOWS\Internet Logs\xDB3F.tmp
2008-01-22 18:37 --------- d-----w C:\Program Files\FileZilla Client
2008-01-20 04:57 2,704,896 ----a-w C:\WINDOWS\Internet Logs\xDB3C.tmp
2008-01-20 04:57 2,012,160 ----a-w C:\WINDOWS\Internet Logs\xDB3D.tmp
2008-01-16 07:24 2,006,016 ----a-w C:\WINDOWS\Internet Logs\xDB3B.tmp
2008-01-16 07:24 1,993,728 ----a-w C:\WINDOWS\Internet Logs\xDB3A.tmp
2008-01-10 07:20 799,232 ----a-w C:\WINDOWS\Internet Logs\xDB39.tmp
2008-01-09 05:38 774,144 ----a-w C:\WINDOWS\Internet Logs\xDB37.tmp
2008-01-09 05:38 1,996,800 ----a-w C:\WINDOWS\Internet Logs\xDB38.tmp
2008-01-08 20:18 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-01-07 21:25 8,565,248 ----a-w C:\WINDOWS\Internet Logs\xDB36.tmp
2007-12-30 20:19 --------- d-----w C:\Program Files\FileZilla
2007-12-29 21:50 1,971,712 ----a-w C:\WINDOWS\Internet Logs\xDB35.tmp
2007-12-26 11:56 --------- d-----w C:\Program Files\eMule
2007-12-25 18:08 53,528 ----a-w C:\Documents and Settings\Administrateur\Application Data\GDIPFONTCACHEV1.DAT
2007-12-22 21:39 1,344,512 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp
2007-12-20 19:58 964,608 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp
2007-12-18 21:10 1,308,672 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp
2007-12-15 19:23 727,552 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp
2007-12-13 20:21 576,000 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp
2007-12-13 20:21 1,952,768 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp
2007-12-12 20:24 795,648 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp
2007-12-10 21:37 761,856 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp
2007-12-08 20:34 1,082,880 ----a-w C:\WINDOWS\Internet Logs\xDB2C.tmp
2007-12-07 07:30 4,204,544 ----a-w C:\WINDOWS\Internet Logs\xDB2A.tmp
2007-12-07 07:30 1,936,896 ----a-w C:\WINDOWS\Internet Logs\xDB2B.tmp
2007-11-30 12:32 1,930,752 ----a-w C:\WINDOWS\Internet Logs\xDB29.tmp
2007-11-29 20:30 1,929,216 ----a-w C:\WINDOWS\Internet Logs\xDB28.tmp
2007-11-23 20:37 5,323,264 ----a-w C:\WINDOWS\Internet Logs\xDB27.tmp
2007-11-15 07:07 1,904,128 ----a-w C:\WINDOWS\Internet Logs\xDB26.tmp
2007-11-10 20:52 3,522,048 ----a-w C:\WINDOWS\Internet Logs\xDB25.tmp
2007-11-04 21:23 2,372,096 ----a-w C:\WINDOWS\Internet Logs\xDB24.tmp
2007-11-01 10:42 435,200 ----a-w C:\WINDOWS\Internet Logs\xDB23.tmp
2007-10-31 06:00 1,713,152 ----a-w C:\WINDOWS\Internet Logs\xDB22.tmp
2007-10-26 19:46 2,480,128 ----a-w C:\WINDOWS\Internet Logs\xDB20.tmp
2007-10-26 19:46 1,836,032 ----a-w C:\WINDOWS\Internet Logs\xDB21.tmp
2007-10-19 06:02 1,825,280 ----a-w C:\WINDOWS\Internet Logs\xDB1F.tmp
2007-10-19 06:02 1,186,304 ----a-w C:\WINDOWS\Internet Logs\xDB1E.tmp
2007-10-17 19:14 1,823,744 ----a-w C:\WINDOWS\Internet Logs\xDB1D.tmp
2007-10-16 11:31 432,640 ----a-w C:\WINDOWS\Internet Logs\xDB1C.tmp
2007-10-15 06:17 2,644,480 ----a-w C:\WINDOWS\Internet Logs\xDB1A.tmp
2007-10-15 06:17 1,820,160 ----a-w C:\WINDOWS\Internet Logs\xDB1B.tmp
2007-10-07 20:13 496,640 ----a-w C:\WINDOWS\Internet Logs\xDB19.tmp
2007-10-05 19:27 1,806,848 ----a-w C:\WINDOWS\Internet Logs\xDB18.tmp
2007-10-05 19:27 1,715,200 ----a-w C:\WINDOWS\Internet Logs\xDB17.tmp
2007-09-30 04:31 2,700,800 ----a-w C:\WINDOWS\Internet Logs\xDB15.tmp
2007-09-30 04:31 1,797,632 ----a-w C:\WINDOWS\Internet Logs\xDB16.tmp
2007-09-22 19:53 3,701,248 ----a-w C:\WINDOWS\Internet Logs\xDB14.tmp
2007-09-13 20:37 2,721,280 ----a-w C:\WINDOWS\Internet Logs\xDB12.tmp
2007-09-13 20:37 1,764,864 ----a-w C:\WINDOWS\Internet Logs\xDB13.tmp
2007-09-07 11:37 1,836,032 ----a-w C:\WINDOWS\Internet Logs\xDB11.tmp
2007-09-03 11:43 1,742,848 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2007-09-03 11:43 1,260,032 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2007-09-01 20:09 6,172,160 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2007-09-01 20:09 1,741,312 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2007-08-02 19:46 975,360 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2007-07-31 19:48 434,688 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2007-07-30 11:23 1,812,992 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2007-07-30 11:23 1,653,248 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2007-07-27 06:09 1,529,856 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2007-07-13 11:48 1,615,872 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2007-07-13 11:48 1,268,224 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2007-06-25 06:14 2,151,424 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2007-06-25 06:14 1,580,032 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2007-05-23 20:34 4,077,568 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2007-05-11 21:09 1,486,848 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2007-04-23 06:06 2,545,664 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2007-04-25 16:09 566,850 --sh--w C:\WINDOWS\system32\uwwxx.bak1
2007-05-16 18:20 594,240 --sh--w C:\WINDOWS\system32\uwwxx.bak2
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC8F6FB5-67EF-4AC3-A1D9-A8B9D95FE396}]
C:\WINDOWS\system32\byvvt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-03-25 18:16 208946]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 10:38 49152]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-08 23:02 919280]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-04-19 18:29 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-18 21:49 249896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:09 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxwwu]
C:\WINDOWS\system32\xxwwu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayvuvw]
yayvuvw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"= %windir%\\system32\\sessmgr.exe:@xpsp2res.dll,-22019
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=

S3 fbxusb;Carte réseau virtuelle FreeBox USB;C:\WINDOWS\system32\DRIVERS\fbxusb32.sys [2004-10-20 16:23]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 18:45:40
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-22 18:56:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-22 17:56:03
.
2007-11-07 18:44:25 --- E O F ---

Et le HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:13:11, on 22/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Programmes ajoutés\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmes ajoutés\Anti espion Nettoyeur Spybot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {AC8F6FB5-67EF-4AC3-A1D9-A8B9D95FE396} - C:\WINDOWS\system32\byvvt.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://config.zebulon.fr/plugins/hardwaredetection.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: xxwwu - C:\WINDOWS\system32\xxwwu.dll (file missing)
O20 - Winlogon Notify: yayvuvw - yayvuvw.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Streamload Service (StreamloadService) - Streamload - C:\Program Files\Streamload\MediaMax XL\StreamloadService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe