Résultat Hijackthis suite à virus VundoTrojan Résolu

Question

Bonjour,

Veuillez trouver un nouveau résultat de Hijachthis après avoir nettoyé tous les registres avec RegCure (5 fois d'affilé pour arriver à 0 erreurs), un scan et nettoyage avec l'anti-Spyware XoftSpySE et un nouveau san et nettoyage avec mon antivirus McAfee.

Même après tout cela, je retrouve le Trojan dès que je lance IE quelqu'un à t'il une solution?
Le trojan est appelé Vundo Trojan, se trouve dans software/microsoft/juan et réapparaît même après nettoyage.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:47:07, on 24/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\DOCUME~1\Vincent\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.mcafee.com/StaticGenericPage.aspx?page=cookienotsupported&url=%2froot%2fcampaign.aspx%3fcid%3d16972%26culture%3dfr-FR%26ctst%3d1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [94695790] rundll32.exe "C:\WINDOWS\system32\pvbdfaca.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
O4 - Global Startup: Lancement Application Fax.lnk = C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O21 - SSODL: bdmanager - {784C03F7-BBBA-470B-833B-60D54E49685B} - C:\WINDOWS\bdmanager.dll
O21 - SSODL: admgcx - {F7E375DD-024C-452F-80A3-A52E12B1EFD2} - (no file)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

jlpjlp · Answer

slt,

scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.

______________
puis :


virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe


_____________

Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

_____________

recoplle un nouveau rapport hiajkchtis:

Je conseille de renomer Hijackthis, pour contrer l'infection que tu as

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

--------------

vince37 · Answer

Bonsoir,

Dois je faire tout cela en mode san échec? Déconnecter d'Internet? Avec mon antivirus actuel désactivé?

Slts

jlpjlp · Answer

de preference en mode sans echec, et deconnécté d'interent

vince37 · Answer

Bonsoir,

Je suis passé par toutes les étapes telles que décrites.

Trouves ci-dessous le rapport de VundoFix. A titre d'info au dernier démarrage j'ai eu un pb avec une DLL manquante vu qu'elle a été effacée (pvbdfaca.dll)

Rapport:
C:\WINDOWS\system32\bvbkcehf.dll
C:\WINDOWS\system32\fqhxctme.dll
C:\WINDOWS\system32\hyomqlce.dll
C:\WINDOWS\system32\jdkcujfw.dll
C:\WINDOWS\system32\jkklkhi.dll
C:\WINDOWS\system32\klnmp.ini
C:\WINDOWS\system32\klnmp.ini2
C:\WINDOWS\system32
yibobxg.dll
C:\WINDOWS\system32\pmnlk.dll
C:\WINDOWS\system32\pmnopno.dll
C:\WINDOWS\system32\pvbdfaca.dll
C:\WINDOWS\system32\qollsocv.dll
C:\WINDOWS\system32mrsofan.dll
C:\WINDOWS\system32\vthfohmu.dll
C:\WINDOWS\system32\wdhyrbed.dll

Suite à toutes les étapes, j'ai refait tourné le programme qui n'a plus trouvé de fichier infecté.

Ci-dessous rapport de virtumondebegone:


[02/24/2008, 21:50:45] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Vincent\Bureau\VirtumundoBeGone.exe" )
[02/24/2008, 21:50:52] - Detected System Information:
[02/24/2008, 21:50:52] -  Windows Version: 5.1.2600, Service Pack 2
[02/24/2008, 21:50:52] -  Current Username: Vincent (Admin)
[02/24/2008, 21:50:52] -  Windows is in SAFE mode with Networking.
[02/24/2008, 21:50:52] - Searching for Browser Helper Objects:
[02/24/2008, 21:50:52] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/24/2008, 21:50:52] -  BHO 2: {089FD14D-132B-48FC-8861-0048AE113215} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] -  Checking for HKLM\...\Winlogon\Notify\SiteAdv
[02/24/2008, 21:50:52] -  Key not found: HKLM\...\Winlogon\Notify\SiteAdv, continuing.
[02/24/2008, 21:50:52] -  BHO 3: {3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] -  Checking for HKLM\...\Winlogon\Notify\jkklkhi
[02/24/2008, 21:50:52] -  Found: HKLM\...\Winlogon\Notify\jkklkhi - This is probably Virtumundo.
[02/24/2008, 21:50:52] -  Assigning {3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA} MSEvents Object
[02/24/2008, 21:50:52] - BHO list has been changed! Starting over...
[02/24/2008, 21:50:52] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/24/2008, 21:50:52] -  BHO 2: {089FD14D-132B-48FC-8861-0048AE113215} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] -  Checking for HKLM\...\Winlogon\Notify\SiteAdv
[02/24/2008, 21:50:52] -  Key not found: HKLM\...\Winlogon\Notify\SiteAdv, continuing.
[02/24/2008, 21:50:52] -  BHO 3: {3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA} (MSEvents Object)
[02/24/2008, 21:50:52] - ALERT: Found MSEvents Object!
[02/24/2008, 21:50:52] -  BHO 4: {3F846292-1922-43B6-8A97-35367D4A8433} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] -  Checking for HKLM\...\Winlogon\Notify\pmnlk
[02/24/2008, 21:50:52] -  Key not found: HKLM\...\Winlogon\Notify\pmnlk, continuing.
[02/24/2008, 21:50:52] -  BHO 5: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[02/24/2008, 21:50:52] -  BHO 6: {6a967332-963e-4923-8ee0-25fedb26f409} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] -  Checking for HKLM\...\Winlogon\Notify
yibobxg
[02/24/2008, 21:50:52] -  Key not found: HKLM\...\Winlogon\Notify
yibobxg, continuing.
[02/24/2008, 21:50:52] -  BHO 7: {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} (SXG Advisor)
[02/24/2008, 21:50:52] -  BHO 8: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/24/2008, 21:50:52] -  BHO 9: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} (scriptproxy)
[02/24/2008, 21:50:52] -  BHO 10: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/24/2008, 21:50:52] -  BHO 11: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/24/2008, 21:50:52] - Finished Searching Browser Helper Objects
[02/24/2008, 21:50:52] - *** Detected MSEvents Object
[02/24/2008, 21:50:52] - Trying to remove MSEvents Object...
[02/24/2008, 21:50:53] -    Terminating Process: IEXPLORE.EXE
[02/24/2008, 21:50:54] -    Terminating Process: RUNDLL32.EXE
[02/24/2008, 21:50:54] -    Disabling Automatic Shell Restart
[02/24/2008, 21:50:54] -    Terminating Process: EXPLORER.EXE
[02/24/2008, 21:50:54] -    Suspending the NT Session Manager System Service
[02/24/2008, 21:50:54] -    Terminating Windows NT Logon/Logoff Manager
[02/24/2008, 21:50:54] -    Re-enabling Automatic Shell Restart
[02/24/2008, 21:50:54] -   File to disable: C:\WINDOWS\system32\jkklkhi.dll
[02/24/2008, 21:50:54] -  Renaming C:\WINDOWS\system32\jkklkhi.dll -> C:\WINDOWS\system32\jkklkhi.dll.vir
[02/24/2008, 21:50:54] -  File successfully renamed!
[02/24/2008, 21:50:54] -   Removing HKLM\...\Browser Helper Objects\{3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA}
[02/24/2008, 21:50:54] -   Removing HKCR\CLSID\{3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA}
[02/24/2008, 21:50:54] -   Adding Kill Bit for ActiveX for GUID: {3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA}
[02/24/2008, 21:50:54] -   Deleting ATLEvents/MSEvents Registry entries
[02/24/2008, 21:50:54] -   Removing HKLM\...\Winlogon\Notify\jkklkhi
[02/24/2008, 21:50:54] - Searching for Browser Helper Objects:
[02/24/2008, 21:50:54] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/24/2008, 21:50:54] -  BHO 2: {089FD14D-132B-48FC-8861-0048AE113215} ()
[02/24/2008, 21:50:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:54] -  Checking for HKLM\...\Winlogon\Notify\SiteAdv
[02/24/2008, 21:50:54] -  Key not found: HKLM\...\Winlogon\Notify\SiteAdv, continuing.
[02/24/2008, 21:50:54] -  BHO 3: {3F846292-1922-43B6-8A97-35367D4A8433} ()
[02/24/2008, 21:50:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:54] -  Checking for HKLM\...\Winlogon\Notify\pmnlk
[02/24/2008, 21:50:54] -  Key not found: HKLM\...\Winlogon\Notify\pmnlk, continuing.
[02/24/2008, 21:50:54] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[02/24/2008, 21:50:54] -  BHO 5: {6a967332-963e-4923-8ee0-25fedb26f409} ()
[02/24/2008, 21:50:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:54] -  Checking for HKLM\...\Winlogon\Notify
yibobxg
[02/24/2008, 21:50:54] -  Key not found: HKLM\...\Winlogon\Notify
yibobxg, continuing.
[02/24/2008, 21:50:54] -  BHO 6: {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} (SXG Advisor)
[02/24/2008, 21:50:54] -  BHO 7: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/24/2008, 21:50:54] -  BHO 8: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} (scriptproxy)
[02/24/2008, 21:50:54] -  BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/24/2008, 21:50:54] -  BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/24/2008, 21:50:54] - Finished Searching Browser Helper Objects
[02/24/2008, 21:50:54] - Finishing up...
[02/24/2008, 21:50:54] - A restart is needed.
[02/24/2008, 21:51:09] - Attempting to Restart via STOP error (Blue Screen!)

[02/24/2008, 21:52:40] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Vincent\Bureau\VirtumundoBeGone.exe" )
[02/24/2008, 21:52:49] - Detected System Information:
[02/24/2008, 21:52:49] -  Windows Version: 5.1.2600, Service Pack 2
[02/24/2008, 21:52:49] -  Current Username: Vincent (Admin)
[02/24/2008, 21:52:49] -  Windows is in SAFE mode with Networking.
[02/24/2008, 21:52:49] - Searching for Browser Helper Objects:
[02/24/2008, 21:52:49] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/24/2008, 21:52:49] -  BHO 2: {089FD14D-132B-48FC-8861-0048AE113215} ()
[02/24/2008, 21:52:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:52:49] -  Checking for HKLM\...\Winlogon\Notify\SiteAdv
[02/24/2008, 21:52:49] -  Key not found: HKLM\...\Winlogon\Notify\SiteAdv, continuing.
[02/24/2008, 21:52:49] -  BHO 3: {3F846292-1922-43B6-8A97-35367D4A8433} ()
[02/24/2008, 21:52:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:52:49] -  Checking for HKLM\...\Winlogon\Notify\pmnlk
[02/24/2008, 21:52:49] -  Key not found: HKLM\...\Winlogon\Notify\pmnlk, continuing.
[02/24/2008, 21:52:49] -  BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[02/24/2008, 21:52:49] -  BHO 5: {6a967332-963e-4923-8ee0-25fedb26f409} ()
[02/24/2008, 21:52:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:52:49] -  Checking for HKLM\...\Winlogon\Notify
yibobxg
[02/24/2008, 21:52:49] -  Key not found: HKLM\...\Winlogon\Notify
yibobxg, continuing.
[02/24/2008, 21:52:49] -  BHO 6: {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} (SXG Advisor)
[02/24/2008, 21:52:49] -  BHO 7: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/24/2008, 21:52:49] -  BHO 8: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} (scriptproxy)
[02/24/2008, 21:52:49] -  BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/24/2008, 21:52:49] -  BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/24/2008, 21:52:49] - Finished Searching Browser Helper Objects
[02/24/2008, 21:52:49] - Finishing up...
[02/24/2008, 21:52:49] - Nothing found! Exiting...

Autre rapport dans message à suivre.

Slts

vince37 · Answer

Salut, Le fenêtres pop sont toujours là: Ci-dessous le rapport de ComboFix: ComboFix 08-02-24.4 - Vincent 2008-02-24 21:56:32.1 - NTFSx86 MINIMAL Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.812 [GMT 1:00] Endroit: C:\Documents and Settings\Vincent\Bureau\KillBagle.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\Vincent\Application Data\inst.exe C:\WINDOWS\cookies.ini C:\WINDOWS\dat.txt C:\WINDOWS\search_res.txt C:\WINDOWS\system32\acafdbvp.ini C:\WINDOWS\system32\antpcomj.ini C:\WINDOWS\system32\aofkiriu.ini C:\WINDOWS\system32\avfqhymh.ini C:\WINDOWS\system32\debryhdw.ini C:\WINDOWS\system32\kmuvfjkx.ini C:\WINDOWS\system32\myvjhnov.ini C:\WINDOWS\system32 ialwyue.ini C:\WINDOWS\system32\uholcxix.ini ----- BITS: Possible sites infect‚s ----- hxxp://softworldnetwork.com hxxp://onsafepro.com . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-24 to 2008-02-24 )))))))))))))))))))))))))))))))))))) . 2008-02-24 21:16 . 2008-02-24 21:16 d-------- C:\VundoFix Backups 2008-02-24 21:06 . 2008-02-24 21:06 d-------- C:\HijackThis 2008-02-24 15:04 . 2008-02-24 16:30 d-------- C:\Program Files\Navilog1 2008-02-23 17:37 . 2008-02-23 17:37 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-02-23 16:52 . 2008-02-24 17:19 d-------- C:\Program Files\RegCure 2008-02-23 14:07 . 2008-02-23 14:20 d-------- C:\Documents and Settings\Vincent\Application Data\RegClean 2008-02-23 11:25 . 2008-02-23 11:26 d-------- C:\Documents and Settings\Vincent\Shared 2008-02-23 11:24 . 2008-02-23 11:26 d-------- C:\Documents and Settings\Vincent\Incomplete 2008-02-23 11:24 . 2008-02-23 11:27 d-------- C:\Documents and Settings\Vincent\Application Data\LimeWire 2008-02-22 16:44 . 2008-02-22 16:44 37,888 --a------ C:\WINDOWS\system32\jkklkhi.dll.vir 2008-02-22 14:40 . 2008-02-22 15:42 d-------- C:\Program Files\XoftSpySE 2008-02-21 19:14 . 2008-02-20 23:56 315,392 --a------ C:\WINDOWS\dmdvpnslp.dll 2008-02-21 19:14 . 2008-02-20 23:56 282,624 --a------ C:\WINDOWS\bdmanager.dll 2008-02-21 19:14 . 2008-02-20 23:56 90,112 --a------ C:\WINDOWS\fsxloqf.exe 2008-01-30 14:30 . 2008-01-30 14:30 d--h----- C:\WINDOWS\PIF 2008-01-28 23:34 . 2008-01-28 23:34 d-------- C:\Documents and Settings\Vincent\Application Data\Samsung 2008-01-28 23:25 . 2008-01-28 23:25 d-------- C:\Program Files\Samsung 2008-01-27 21:50 . 2008-01-27 21:50 d-------- C:\Program Files\Virtools . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-24 10:21 --------- d-----w C:\Program Files\McAfee 2008-02-23 16:50 --------- d-----w C:\Documents and Settings\Vincent\Application Data\SiteAdvisor 2008-02-23 13:00 --------- d-----w C:\Program Files\BeClean 2008-02-22 15:12 --------- d-----w C:\Program Files\eMule 2008-02-22 14:42 --------- d-----w C:\Program Files\eMedia Codec 2008-01-28 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-22 16:38 --------- d-----w C:\Documents and Settings\Justine\Application Data\SiteAdvisor 2008-01-12 01:05 --------- d-----w C:\Program Files\IZArc 2008-01-12 00:59 --------- d-----w C:\Program Files\Mio Technology 2008-01-05 18:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\InternetFax 2008-01-05 18:33 --------- d-----w C:\Program Files\Alliance MCA 2008-01-05 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data pfmon 2008-01-03 11:11 --------- d-----w C:\Program Files\Webshots 2007-11-20 20:45 47,360 ----a-w C:\Documents and Settings\Vincent\Application Data\pcouffin.sys 2006-08-02 06:37 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2006-06-12 20:56 251 -c--a-w C:\Program Files\wt3d.ini 2006-04-27 12:07 88 -csh--r C:\WINDOWS\system32\BC85CFD0CB.sys 2006-04-27 11:58 104 -csh--r C:\WINDOWS\system32\CBD0CF85BC.sys 2006-04-27 12:07 5,852 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F846292-1922-43B6-8A97-35367D4A8433}] C:\WINDOWS\system32\pmnlk.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6a967332-963e-4923-8ee0-25fedb26f409}] C:\WINDOWS\system32 yibobxg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6FFDE480-14C1-43FC-BEC1-CA97A2541FFD}] 2008-02-20 23:56 315392 --a------ C:\WINDOWS\dmdvpnslp.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360] "SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 18:40 24576 C:\WINDOWS\MIDIDEF.EXE] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400] "IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-01-23 08:06 204843] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-19 09:36 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 03:04 59392] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 08:56 139264] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05 344064] "MBMon"="CTMBHA.DLL" [2005-05-19 09:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL] "VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 08:42 1159168] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 06:20 122940] "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600] "Creative WebCam Tray"="C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE" [1999-04-27 02:00 18944] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920] "ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44 249856] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-04-11 00:44 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2006-12-25 11:53 185896] "MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 17:30 152144] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-05 20:10 36904] "AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 16:57 81408] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 01:20 339968 C:\WINDOWS\stsystra.exe] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 08:47 57344] "94695790"="C:\WINDOWS\system32\pvbdfaca.dll" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "VundoFix"="C:\Documents and Settings\Vincent\Bureau\vundofix.exe" [2008-02-24 20:59 132608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "bdmanager"= {784C03F7-BBBA-470B-833B-60D54E49685B} - C:\WINDOWS\bdmanager.dll [2008-02-20 23:56 282624] [HKLM\~\startupfolder\C:^Documents and Settings^Vincent^Menu Démarrer^Programmes^Démarrage^Registration-Studio 8.lnk] backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\IncrediMail\bin\IMApp.exe"= "C:\Program Files\IncrediMail\bin\IncMail.exe"= "C:\Program Files\IncrediMail\bin\ImpCnt.exe"= "C:\Program Files\eMule\emule.exe"= "C:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00] S3 CTL511Plus;Video Blaster WebCam 3/WebCam Plus (WDM);C:\WINDOWS\system32\DRIVERS\webc3vid.sys [2000-09-14 13:00] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-10-14 23:24:39 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe' "2007-09-01 07:16:24 C:\WINDOWS\Tasks\McQcTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2008-02-23 13:49:39 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job" - C:\Program Files\RegClean\RegClean.ex - C:\Program Files\RegClean "2008-02-24 16:00:01 C:\WINDOWS\Tasks\RegCure Program Check.job" - C:\Program Files\RegCure\RegCure.exe "2008-02-23 15:52:16 C:\WINDOWS\Tasks\RegCure.job" - C:\Program Files\RegCure\RegCure.exe "2008-02-24 16:00:04 C:\WINDOWS\Tasks\XoftSpySE 2.job" - C:\Program Files\XoftSpySE\XoftSpy.exe "2008-02-23 09:38:13 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-24 22:01:13 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe . ************************************************************************** . Temps d'accomplissement: 2008-02-24 22:04:23 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-24 21:04:20 . 2008-02-13 07:15:57 --- E O F --- et le rapport de Hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:07:23, on 24/02/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\WINDOWS\explorer.exe C:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.mcafee.com/StaticGenericPage.aspx?page=cookienotsupported&url=%2froot%2fcampaign.aspx%3fcid%3d16972%26culture%3dfr-FR%26ctst%3d1 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: (no name) - {3F846292-1922-43B6-8A97-35367D4A8433} - C:\WINDOWS\system32\pmnlk.dll (file missing) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: {904f62bd-ef52-0ee8-3294-e369233769a6} - {6a967332-963e-4923-8ee0-25fedb26f409} - C:\WINDOWS\system32 yibobxg.dll (file missing) O2 - BHO: SXG Advisor - {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} - C:\WINDOWS\dmdvpnslp.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [94695790] rundll32.exe "C:\WINDOWS\system32\pvbdfaca.dll",b O4 - HKLM\..\RunOnce: [VundoFix] "C:\Documents and Settings\Vincent\Bureau\vundofix.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe O4 - Global Startup: Lancement Application Fax.lnk = C:\Program Files\Alliance MCA\SafeFax\faxtray.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe O21 - SSODL: bdmanager - {784C03F7-BBBA-470B-833B-60D54E49685B} - C:\WINDOWS\bdmanager.dll O21 - SSODL: admgcx - {F7E375DD-024C-452F-80A3-A52E12B1EFD2} - (no file) O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee edirsvc edirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

jlpjlp · Answer

slt,


Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 


R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: (no name) - {3F846292-1922-43B6-8A97-35367D4A8433} - C:\WINDOWS\system32\pmnlk.dll (file missing)
O2 - BHO: {904f62bd-ef52-0ee8-3294-e369233769a6} - {6a967332-963e-4923-8ee0-25fedb26f409} - C:\WINDOWS\system32
yibobxg.dll (file missing)
O2 - BHO: SXG Advisor - {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} - C:\WINDOWS\dmdvpnslp.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [94695790] rundll32.exe "C:\WINDOWS\system32\pvbdfaca.dll",b
O4 - HKLM\..\RunOnce: [VundoFix] "C:\Documents and Settings\Vincent\Bureau\vundofix.exe"
O
O21 - SSODL: bdmanager - {784C03F7-BBBA-470B-833B-60D54E49685B} - C:\WINDOWS\bdmanager.dll
O21 - SSODL: admgcx - {F7E375DD-024C-452F-80A3-A52E12B1EFD2} - (no file) 



__________________



Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :






File::
C:\WINDOWS\system32
yibobxg.dll
C:\WINDOWS\system32\pvbdfaca.dll
C:\WINDOWS\dmdvpnslp.dll
C:\WINDOWS\system32\pmnlk.dll
C:\WINDOWS\dmdvpnslp.dll
C:\WINDOWS\system32\jkklkhi.dll.vir 

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F846292-1922-43B6-8A97-35367D4A8433}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6a967332-963e-4923-8ee0-25fedb26f409}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6FFDE480-14C1-43FC-BEC1-CA97A2541FFD}]









Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt


_________________


 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

___________________
Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord) 

Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche comme demandé, le blocnote va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt) 




pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

vince37 · Answer

Salut, L'analyse Bit Defender est en cours. Trouves ci-dessous les rapports Combo fix (en premier) et ensuite Hijackthis: ComboFix 08-02-24.4 - Vincent 2008-02-24 23:26:25.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.557 [GMT 1:00] Endroit: C:\Documents and Settings\Vincent\Bureau\KillBagle.exe Command switches used :: C:\Documents and Settings\Vincent\Bureau\CFscript.txt * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: C:\WINDOWS\dmdvpnslp.dll C:\WINDOWS\system32\jkklkhi.dll.vir C:\WINDOWS\system32 yibobxg.dll C:\WINDOWS\system32\pmnlk.dll C:\WINDOWS\system32\pvbdfaca.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\WINDOWS\dat.txt C:\WINDOWS\search_res.txt C:\WINDOWS\system32\jkklkhi.dll.vir ----- BITS: Possible sites infectés ----- hxxp://softworldnetwork.com . ((((((((((((((((((((((((((((( Fichiers créés 2008-01-24 to 2008-02-24 )))))))))))))))))))))))))))))))))))) . 2008-02-24 22:15 . 2008-02-24 22:15 d-------- C:\Documents and Settings\NetworkService\Menu Démarrer 2008-02-24 22:15 . 2008-02-24 22:15 d-------- C:\Documents and Settings\LocalService\Menu Démarrer 2008-02-24 21:16 . 2008-02-24 22:15 d-------- C:\VundoFix Backups 2008-02-24 21:06 . 2008-02-24 23:22 d-------- C:\HijackThis 2008-02-24 15:04 . 2008-02-24 16:30 d-------- C:\Program Files\Navilog1 2008-02-23 17:37 . 2008-02-23 17:37 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-02-23 16:52 . 2008-02-24 17:19 d-------- C:\Program Files\RegCure 2008-02-23 14:07 . 2008-02-23 14:20 d-------- C:\Documents and Settings\Vincent\Application Data\RegClean 2008-02-23 11:25 . 2008-02-23 11:26 d-------- C:\Documents and Settings\Vincent\Shared 2008-02-23 11:24 . 2008-02-23 11:26 d-------- C:\Documents and Settings\Vincent\Incomplete 2008-02-23 11:24 . 2008-02-23 11:27 d-------- C:\Documents and Settings\Vincent\Application Data\LimeWire 2008-02-22 14:40 . 2008-02-22 15:42 d-------- C:\Program Files\XoftSpySE 2008-02-21 19:14 . 2008-02-20 23:56 282,624 --a------ C:\WINDOWS\bdmanager.dll 2008-02-21 19:14 . 2008-02-20 23:56 90,112 --a------ C:\WINDOWS\fsxloqf.exe 2008-02-03 10:00 . 2008-02-03 10:00 d-------- C:\Documents and Settings\Valérie\Application Data\Samsung 2008-01-30 14:30 . 2008-01-30 14:30 d--h----- C:\WINDOWS\PIF 2008-01-28 23:34 . 2008-01-28 23:34 d-------- C:\Documents and Settings\Vincent\Application Data\Samsung 2008-01-28 23:25 . 2008-01-28 23:25 d-------- C:\Program Files\Samsung 2008-01-27 21:50 . 2008-01-27 21:50 d-------- C:\Program Files\Virtools . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-24 10:21 --------- d-----w C:\Program Files\McAfee 2008-02-23 16:50 --------- d-----w C:\Documents and Settings\Vincent\Application Data\SiteAdvisor 2008-02-23 13:00 --------- d-----w C:\Program Files\BeClean 2008-02-22 15:12 --------- d-----w C:\Program Files\eMule 2008-02-22 14:42 --------- d-----w C:\Program Files\eMedia Codec 2008-01-29 12:16 --------- d-----w C:\Documents and Settings\Valérie\Application Data\SiteAdvisor 2008-01-28 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-22 16:38 --------- d-----w C:\Documents and Settings\Justine\Application Data\SiteAdvisor 2008-01-12 01:05 --------- d-----w C:\Program Files\IZArc 2008-01-12 00:59 --------- d-----w C:\Program Files\Mio Technology 2008-01-05 18:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\InternetFax 2008-01-05 18:33 --------- d-----w C:\Program Files\Alliance MCA 2008-01-05 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data pfmon 2008-01-03 11:11 --------- d-----w C:\Program Files\Webshots 2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-11-20 20:45 47,360 ----a-w C:\Documents and Settings\Vincent\Application Data\pcouffin.sys 2006-08-02 06:37 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2006-06-12 20:56 251 -c--a-w C:\Program Files\wt3d.ini 2006-04-27 12:07 88 -csh--r C:\WINDOWS\system32\BC85CFD0CB.sys 2006-04-27 11:58 104 -csh--r C:\WINDOWS\system32\CBD0CF85BC.sys 2006-04-27 12:07 5,852 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360] "SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 18:40 24576 C:\WINDOWS\MIDIDEF.EXE] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400] "IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-01-23 08:06 204843] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-19 09:36 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 03:04 59392] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 08:56 139264] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05 344064] "MBMon"="CTMBHA.DLL" [2005-05-19 09:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL] "VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 08:42 1159168] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 06:20 122940] "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600] "Creative WebCam Tray"="C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE" [1999-04-27 02:00 18944] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920] "ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44 249856] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2006-12-25 11:53 185896] "MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 17:30 152144] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-05 20:10 36904] "AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 16:57 81408] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 01:20 339968 C:\WINDOWS\stsystra.exe] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 08:47 57344] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09 15360] C:\Documents and Settings\Val‚rie\Menu D‚marrer\Programmes\D‚marrage\ Webshots.lnk - C:\Program Files\Webshots\WebshotsTray.exe [2007-12-02 11:51:17 192512] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ EPSON SMART PANEL for Scanner.lnk - C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe [2006-03-10 00:37:22 180224] Lancement Application Fax.lnk - C:\Program Files\Alliance MCA\SafeFax\faxtray.exe [2008-01-05 19:33:23 823296] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "bdmanager"= {A58D46CE-4F12-46E7-80D5-47414FD651E0} - C:\WINDOWS\bdmanager.dll [2008-02-20 23:56 282624] [HKLM\~\startupfolder\C:^Documents and Settings^Vincent^Menu Démarrer^Programmes^Démarrage^Registration-Studio 8.lnk] backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\IncrediMail\bin\IMApp.exe"= "C:\Program Files\IncrediMail\bin\IncMail.exe"= "C:\Program Files\IncrediMail\bin\ImpCnt.exe"= "C:\Program Files\eMule\emule.exe"= "C:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00] S3 CTL511Plus;Video Blaster WebCam 3/WebCam Plus (WDM);C:\WINDOWS\system32\DRIVERS\webc3vid.sys [2000-09-14 13:00] . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-10-14 23:24:39 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe' "2007-09-01 07:16:24 C:\WINDOWS\Tasks\McQcTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2008-02-23 13:49:39 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job" - C:\Program Files\RegClean\RegClean.ex - C:\Program Files\RegClean "2008-02-24 22:11:50 C:\WINDOWS\Tasks\RegCure Program Check.job" - C:\Program Files\RegCure\RegCure.exe "2008-02-23 15:52:16 C:\WINDOWS\Tasks\RegCure.job" - C:\Program Files\RegCure\RegCure.exe "2008-02-24 22:11:51 C:\WINDOWS\Tasks\XoftSpySE 2.job" - C:\Program Files\XoftSpySE\XoftSpy.exe "2008-02-23 09:38:13 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-24 23:29:10 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-02-24 23:29:48 ComboFix-quarantined-files.txt 2008-02-24 22:29:46 ComboFix2.txt 2008-02-24 22:08:35 ComboFix3.txt 2008-02-24 21:04:23 . 2008-02-13 07:15:57 --- E O F --- Rapport Hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:37:41, on 24/02/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Creative\VoiceCenter\AndreaVC.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE C:\DOCUME~1\Vincent\LOCALS~1\Temp\clclean.0001 C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe C:\Program Files\McAfee\MSK\MskAgent.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\WINDOWS\stsystra.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\PROGRA~1\INCRED~1\bin\IMApp.exe C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe C:\Program Files\Alliance MCA\SafeFax\faxtray.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\FICHIE~1\mcafee edirsvc edirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\McAfee\MPS\mpsevh.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\INCRED~1\bin\IncMail.exe C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.mcafee.com/StaticGenericPage.aspx?page=cookienotsupported&url=%2froot%2fcampaign.aspx%3fcid%3d16972%26culture%3dfr-FR%26ctst%3d1 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe O4 - Global Startup: Lancement Application Fax.lnk = C:\Program Files\Alliance MCA\SafeFax\faxtray.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe O21 - SSODL: bdmanager - {A58D46CE-4F12-46E7-80D5-47414FD651E0} - C:\WINDOWS\bdmanager.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee edirsvc edirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

vince37 · Answer

Salut,

Rapport BitDefender:

Fichier analysé
  Statut
 
C:\HijackThis\backups\backup-20080224-232239-293.dll
 Détecté avec: Adware.NetAdware.EF
 
C:\HijackThis\backups\backup-20080224-232239-293.dll
 Supprimé
 
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP10\A0000183.dll
 Détecté avec: Adware.NetAdware.EF
 
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP10\A0000183.dll
 Supprimé
 
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP11\A0000235.dll
 Détecté avec: Adware.NetAdware.EF
 
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP11\A0000235.dll
 Supprimé
 
  
Rapport Navilog1:

Search Navipromo version 3.4.7 commencé le 25/02/2008 à  0:08:59,50

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 23.02.2008 à 20h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***




*** Recherche dossiers dans "C:\Documents and Settings\Vincent\applic~1" *** 



*** Recherche dossiers dans "C:\Documents and Settings\Vincent\locals~1\applic~1" *** 



*** Recherche dossiers dans "C:\Documents and Settings\Vincent\MENUDM~1\PROGRA~1" *** 


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUD?~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans "C:\Documents and Settings\Vincent\locals~1\applic~1" * 



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans C:\WINDOWS\system32 :


* Dans "C:\Documents and Settings\Vincent\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !

4)Recherche fichiers connus :



*** Analyse terminée le 25/02/2008 à  0:13:41,71 ***

J'espère que tout est OK maintenant.

Slts

jlpjlp · Answer

ok

vire hijakchits de ton ordi

__________


desactive la restauration syteme pour purger les virus qui seraient dedans
puis redemarre ton ordi
 puis reactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis parametre)

____________

encore des soucis?????



fait smitfraud fix

 http://siri.urz.free.fr/Fix/   (colle le rapport


double clique sur smitfraudfix.cmd. puis selectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes.

vince37 · Answer

Salut,

Je n'avais donc pas besoin d'écrire mon petit mot sur l'autre forum vu que vous avez déjà trouver cette discussion.

J'ai bien avancé avec l'aide de Jlpjlp. Je vais faire les dernières actions demandées et vous tiendrai au courant.

J'ai déjà noté la disparitio des fenêtres Pop, ce qui est déjà une bonne avancée.

Merci pour votre aide.

vince37 · Answer

Salut, voir mon message suite à réponse de Green day.

Slts

green day · Answer

Merci de continuer sur un poste afin de ne pas mobiliser plusieurs personnes pour le même problème ! ;-)

vince37 · Answer

Salut jlpjlp,

Mon intention n'était absolument de faire travailler 2 personnes en parallèle et encore de juger de la pertinence des réponses. Je n'ai pas les compétences nécessaires pour cela.
Tu remarqueras que les 2 discussions n'étaient pas vraiment en parallèle.

Dans tous les cas, j'ai été impressioné par le niveau des compétences et la clarté des réponses qui m'ont permis de résoudre mon problème.

Merci pour m'avoir permis de sauver mes données et d'éviter un formatage de ma machine.

Bonne continuation à tous. Je ne manquerai pas de faire connaître ce site.

Slts

green day · Answer

re

 on n'en doute pas ! mais ce n'est pas encore fini, on continue ici

 
Télécharge SDFix sur ton bureau

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
Redémarre ton ordinateur en mode sans échec
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

++

vince37 · Answer

Salut,

Est ce que je dois faire smitfraud fix avant car je n'ai pas fait cette partie pensant que mon pb était résolu.

Slts

green day · Answer

oui, tu peux !

++

vince37 · Answer

Salut,

Rapport smitfraud fix:

SmitFraudFix v2.296

Rapport fait à 22:28:01,62, 25/02/2008
Executé à partir de C:\Documents and Settings\Vincent\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\DOCUME~1\Vincent\LOCALS~1\Temp\clclean.0001
C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\fsxloqf.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\1024\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Vincent


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Vincent\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Vincent\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\eMedia Codec\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

[!] Suspicious: bdmanager.dll
SSODL: bdmanager - {A58D46CE-4F12-46E7-80D5-47414FD651E0}


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/1000 PL Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

green day · Answer

ok, demarrer en mode sans echec et passe à l'option 2 !

++

vince37 · Answer

Ci-dessous rapport suite à nettoyage. Dois je passer à SDFix?

SmitFraudFix v2.296

Rapport fait à 22:37:06,82, 25/02/2008
Executé à partir de C:\Documents and Settings\Vincent\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
C:\WINDOWS\bdmanager.dll deleted.


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\fsxloqf.exe supprimé
C:\WINDOWS\system32\1024\ supprimé
C:\Program Files\eMedia Codec\ supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

vince37 · Answer

Ci-dessous rapports SDFix et Hijackthis:
Est ce que tout semble OK?


[b]SDFix: Version 1.147 [/b]

Run by Vincent on 25/02/2008 at 22:55

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Vincent\Bureau\SDFAX\SDFix

[b]Checking Services [/b]:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat - Deleted
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 23:02:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"ScheduledInstallDate"="2008-02-25 22:00:00"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\IncrediMail\bin\IMApp.exe"="C:\Program Files\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\IncMail.exe"="C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\ImpCnt.exe"="C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe"="C:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Wed  6 Dec 2006           276 A.SHR --- "C:\BOOT.BAK"
Fri 10 Mar 2006            56 A.SHR --- "C:\i386\CBD0CF85BC.sys"
Fri 10 Mar 2006         2,516 A.SH. --- "C:\i386\KGyGaAvL.sys"
Fri 12 Mar 2004        54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Fri 12 Mar 2004       156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Fri 12 Mar 2004        31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Thu 27 Apr 2006            88 ..SHR --- "C:\WINDOWS\system32\BC85CFD0CB.sys"
Thu 27 Apr 2006           104 ..SHR --- "C:\WINDOWS\system32\CBD0CF85BC.sys"
Thu 27 Apr 2006         5,852 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu  9 Mar 2006         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu  3 Jan 2008        71,168 ..SHR --- "C:\Program Files\Mio Technology\SpeedCAM Tool\Setup.exe"
Sat  9 Jul 2005        16,384 A.SHR --- "C:\Program Files\Mio Technology\SpeedCAM Tool\_Setup.dll"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT106.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT112.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT11B.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT124.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT12E.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT136.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT140.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT149.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT157.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT15F.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT168.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT174.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT17D.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT18C.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT19A.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT1A2.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT1AB.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT87.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BIT92.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITA3.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITB0.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITBC.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITC8.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITD4.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITE1.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITEC.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITF3.tmp"
Mon 25 Feb 2008             0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings	emp\BITFD.tmp"

[b]Finished![/b]


Rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:07:58, on 25/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\FICHIE~1\mcafeeedirsvcedirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
otepad.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\DOCUME~1\Vincent\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.mcafee.com/StaticGenericPage.aspx?page=cookienotsupported&url=%2froot%2fcampaign.aspx%3fcid%3d16972%26culture%3dfr-FR%26ctst%3d1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
O4 - Global Startup: Lancement Application Fax.lnk = C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafeeedirsvcedirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

green day · Answer

Salut

ok, poste un nouveau combo stp

++

vince37 · Answer

Salut,

Trouves ci-dessous le rapport du combo:

ComboFix 08-02-24.4 - Vincent 2008-02-26 21:21:50.4 - NTFSx86 MINIMAL
Endroit: C:\Documents and Settings\Vincent\Bureau\KillBagle.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-01-26 to 2008-02-26 ))))))))))))))))))))))))))))))))))))
.

2008-02-26 15:40 . 2008-02-26 15:40 <REP> d-------- C:\WINDOWS\LastGood
2008-02-25 22:53 . 2008-02-25 22:53 <REP> d-------- C:\WINDOWS\ERUNT
2008-02-25 22:49 . 2008-02-25 23:07 <REP> d-------- C:\HijackThis
2008-02-25 22:28 . 2008-02-25 22:37 3,708 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-24 23:34 . 2008-02-24 23:37 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-02-24 22:15 . 2008-02-24 22:15 <REP> d-------- C:\Documents and Settings\NetworkService\Menu Démarrer
2008-02-24 22:15 . 2008-02-24 22:15 <REP> d-------- C:\Documents and Settings\LocalService\Menu Démarrer
2008-02-24 21:16 . 2008-02-24 22:15 <REP> d-------- C:\VundoFix Backups
2008-02-24 15:04 . 2008-02-25 00:15 <REP> d-------- C:\Program Files\Navilog1
2008-02-23 17:37 . 2008-02-23 17:37 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-02-23 16:52 . 2008-02-24 17:19 <REP> d-------- C:\Program Files\RegCure
2008-02-23 14:07 . 2008-02-23 14:20 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\RegClean
2008-02-23 11:25 . 2008-02-23 11:26 <REP> d-------- C:\Documents and Settings\Vincent\Shared
2008-02-23 11:24 . 2008-02-23 11:26 <REP> d-------- C:\Documents and Settings\Vincent\Incomplete
2008-02-23 11:24 . 2008-02-23 11:27 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\LimeWire
2008-02-22 14:40 . 2008-02-22 15:42 <REP> d-------- C:\Program Files\XoftSpySE
2008-02-03 10:00 . 2008-02-03 10:00 <REP> d-------- C:\Documents and Settings\Valérie\Application Data\Samsung
2008-01-30 14:30 . 2008-01-30 14:30 <REP> d--h----- C:\WINDOWS\PIF
2008-01-28 23:34 . 2008-01-28 23:34 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\Samsung
2008-01-28 23:25 . 2008-01-28 23:25 <REP> d-------- C:\Program Files\Samsung
2008-01-27 21:50 . 2008-01-27 21:50 <REP> d-------- C:\Program Files\Virtools

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-26 14:40 --------- d-----w C:\Program Files\McAfee
2008-02-23 16:50 --------- d-----w C:\Documents and Settings\Vincent\Application Data\SiteAdvisor
2008-02-23 13:00 --------- d-----w C:\Program Files\BeClean
2008-02-22 15:12 --------- d-----w C:\Program Files\eMule
2008-01-29 12:16 --------- d-----w C:\Documents and Settings\Valérie\Application Data\SiteAdvisor
2008-01-28 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-22 16:38 --------- d-----w C:\Documents and Settings\Justine\Application Data\SiteAdvisor
2008-01-12 01:05 --------- d-----w C:\Program Files\IZArc
2008-01-12 00:59 --------- d-----w C:\Program Files\Mio Technology
2008-01-05 18:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\InternetFax
2008-01-05 18:33 --------- d-----w C:\Program Files\Alliance MCA
2008-01-05 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\tpfmon
2008-01-03 11:11 --------- d-----w C:\Program Files\Webshots
2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-20 20:45 47,360 ----a-w C:\Documents and Settings\Vincent\Application Data\pcouffin.sys
2006-08-02 06:37 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-06-12 20:56 251 -c--a-w C:\Program Files\wt3d.ini
2006-04-27 12:07 88 -csh--r C:\WINDOWS\system32\BC85CFD0CB.sys
2006-04-27 11:58 104 -csh--r C:\WINDOWS\system32\CBD0CF85BC.sys
2006-04-27 12:07 5,852 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 18:40 24576 C:\WINDOWS\MIDIDEF.EXE]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-01-23 08:06 204843]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-19 09:36 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 03:04 59392]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 08:56 139264]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05 344064]
"MBMon"="CTMBHA.DLL" [2005-05-19 09:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 08:42 1159168]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 06:20 122940]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600]
"Creative WebCam Tray"="C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE" [1999-04-27 02:00 18944]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920]
"ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44 249856]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-12-25 11:53 185896]
"MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 17:30 152144]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-05 20:10 36904]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 16:57 81408]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 01:20 339968 C:\WINDOWS\stsystra.exe]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 08:47 57344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09 15360]

C:\Documents and Settings\Val‚rie\Menu D‚marrer\Programmes\D‚marrage\
Webshots.lnk - C:\Program Files\Webshots\WebshotsTray.exe [2007-12-02 11:51:17 192512]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
EPSON SMART PANEL for Scanner.lnk - C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe [2006-03-10 00:37:22 180224]
Lancement Application Fax.lnk - C:\Program Files\Alliance MCA\SafeFax\faxtray.exe [2008-01-05 19:33:23 823296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKLM\~\startupfolder\C:^Documents and Settings^Vincent^Menu Démarrer^Programmes^Démarrage^Registration-Studio 8.lnk]
backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00]
S2 0126621204036847mcinstcleanup;McAfee Application Installer Cleanup (0126621204036847);C:\WINDOWS\TEMP\[u]0[/u]12662~1.EXE C:\PROGRA~1\FICHIE~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog []
S3 CTL511Plus;Video Blaster WebCam 3/WebCam Plus (WDM);C:\WINDOWS\system32\DRIVERS\webc3vid.sys [2000-09-14 13:00]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

*Newly Created Service* - 0126621204036847MCINSTCLEANUP
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-10-14 23:24:39 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2007-09-01 07:16:24 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2008-02-25 02:30:01 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean
"2008-02-26 16:00:04 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-02-23 15:52:16 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-02-26 16:00:02 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-02-23 09:38:13 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-26 21:24:50
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-02-26 21:25:26
ComboFix-quarantined-files.txt 2008-02-26 20:25:24
ComboFix2.txt 2008-02-24 22:29:49
ComboFix3.txt 2008-02-24 22:08:35
ComboFix4.txt 2008-02-24 21:04:23
.
2008-02-13 07:15:57 --- E O F ---

green day · Answer

Salut 

ok, fais analyser ces deux fichiers en gras stp : ( un après l'autre )

C:\WINDOWS\system32\BC85CFD0CB.sys
C:\WINDOWS\system32\CBD0CF85BC.sys 

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche le fichier 

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note, poste le stp

++

vince37 · Answer

Bonsoir,

Je ne peux pas faire ce que tu me demandes car les 2 fichiers en question ne sont pas présents sous c:/Windows/System32.

Slts

green day · Answer

Salut

ils sont peut être cachés !

fais ceci avant :

    *  Ouvrir le Poste de travail :
    * Menu : Outils => Options des dossiers
    * Affichage => zone Paramètres avancés
    * Cochez : Afficher le contenu des dossiers système
    * Cochez : Afficher les fichiers et dossiers cachés
    * Décochez : Masquer les extensions des fichiers dont le type est connu
    * Décochez : Masquer les fichiers protégés du système d'exploitation (recommandé)
    * Répondre Oui au message d'alerte
    * Cliquez sur Appliquer à tous les dossiers
    * Cliquez sur OK 

++

vince37 · Answer

Résultat 1er fichier:

Fichier BC85CFD0CB.sys reçu le 2008.02.28 23:42:57 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 0/31 (0%)

  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.2.28.2 2008.02.28 - 
AntiVir 7.6.0.67 2008.02.28 - 
Authentium 4.93.8 2008.02.28 - 
Avast 4.7.1098.0 2008.02.28 - 
AVG 7.5.0.516 2008.02.28 - 
BitDefender 7.2 2008.02.28 - 
CAT-QuickHeal 9.50 2008.02.28 - 
ClamAV 0.92.1 2008.02.28 - 
DrWeb 4.44.0.09170 2008.02.28 - 
eSafe 7.0.15.0 2008.02.28 - 
eTrust-Vet 31.3.5571 2008.02.28 - 
Ewido 4.0 2008.02.28 - 
FileAdvisor 1 2008.02.28 - 
Fortinet 3.14.0.0 2008.02.28 - 
F-Prot 4.4.2.54 2008.02.28 - 
F-Secure 6.70.13260.0 2008.02.28 - 
Ikarus T3.1.1.20 2008.02.28 - 
Kaspersky 7.0.0.125 2008.02.28 - 
McAfee 5241 2008.02.28 - 
Microsoft 1.3301 2008.02.28 - 
NOD32v2 2910 2008.02.28 - 
Norman 5.80.02 2008.02.28 - 
Panda 9.0.0.4 2008.02.28 - 
Prevx1 V2 2008.02.28 - 
Rising 20.33.32.00 2008.02.28 - 
Sophos 4.27.0 2008.02.28 - 
Sunbelt 3.0.906.0 2008.02.28 - 
TheHacker 6.2.9.229 2008.02.25 - 
VBA32 3.12.6.2 2008.02.27 - 
VirusBuster 4.3.26:9 2008.02.28 - 
Webwasher-Gateway 6.6.2 2008.02.28 - 
Information additionnelle 
File size: 88 bytes 
MD5: 7e45afe3dacebe49b4b986a240919cd2 
SHA1: 0849ca5a4c0aef0b67d228f47b7cefe7bb5a9f41 
PEiD: -

vince37 · Answer

Résultat 2ème fichier:

Fichier CBD0CF85BC.sys reçu le 2008.02.28 23:57:29 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 0/32 (0%)
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.2.28.2 2008.02.28 - 
AntiVir 7.6.0.67 2008.02.28 - 
Authentium 4.93.8 2008.02.28 - 
Avast 4.7.1098.0 2008.02.28 - 
AVG 7.5.0.516 2008.02.28 - 
BitDefender 7.2 2008.02.28 - 
CAT-QuickHeal 9.50 2008.02.28 - 
ClamAV 0.92.1 2008.02.28 - 
DrWeb 4.44.0.09170 2008.02.28 - 
eSafe 7.0.15.0 2008.02.28 - 
eTrust-Vet 31.3.5571 2008.02.28 - 
Ewido 4.0 2008.02.28 - 
FileAdvisor 1 2008.02.28 - 
Fortinet 3.14.0.0 2008.02.28 - 
F-Prot 4.4.2.54 2008.02.28 - 
F-Secure 6.70.13260.0 2008.02.28 - 
Ikarus T3.1.1.20 2008.02.28 - 
Kaspersky 7.0.0.125 2008.02.28 - 
McAfee 5241 2008.02.28 - 
Microsoft 1.3301 2008.02.28 - 
NOD32v2 2910 2008.02.28 - 
Norman 5.80.02 2008.02.28 - 
Panda 9.0.0.4 2008.02.28 - 
Prevx1 V2 2008.02.29 - 
Rising 20.33.32.00 2008.02.28 - 
Sophos 4.27.0 2008.02.28 - 
Sunbelt 3.0.906.0 2008.02.28 - 
Symantec 10 2008.02.28 - 
TheHacker 6.2.9.229 2008.02.25 - 
VBA32 3.12.6.2 2008.02.27 - 
VirusBuster 4.3.26:9 2008.02.28 - 
Webwasher-Gateway 6.6.2 2008.02.28 - 
Information additionnelle 
File size: 104 bytes 
MD5: 207f6bb1d4cbd6ccd01f15cc36def857 
SHA1: 063d049b7242a0e1ba9aceaf281eb9eada5d622e 
PEiD: -

green day · Answer

Salut

c'est encore plus suspect ! :/

où en sont tes soucis ??

++

vince37 · Answer

Salut,

C'est plutôt clean depuis Dimanche. Pas de fenêtre pop, ni de pubs intempestives.
Par contre, mon email est bourré de SPAM.

Qu'en penses tu?

Slts

green day · Answer

Salut

ok, fais ce qui est indiqué ici stp :

http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

++

vince37 · Answer

Salut,

J'ai pour ma par les programmes suivants RegCure (enregistré) et XoftSpySE.
J'ai néanmoins chargé les programmes tels que définis dans la procédure.

J'ai lancé l'analyse dans CCleaner et le nettoyage. Pas d'onglet spécial pour les erreurs apparaît. J'imagine que cela veut dire que je n'en ai pas.

Ci-dessous le contenu du fichier historique:

CCleaner v2.05
--------------------------------------------
- Updated Index.dat cleaning in Vista.
- File scanning performance increase on NTFS drives.
- Improved exception handling methods.
- Fixed IE cache folder location bug.
- Uninstaller tool now exports foreign languages correctly.
- Fixed bug where IE temp files could be incorrectly listed.
- Performance improvements to secure deletion.
- Tweaks to Uninstall tool detection.
- Minor GUI changes.
- Minor bug fixes.

--------------------------------------------
www.ccleaner.com
www.piriform.com

J'ai ensuite lancé AVG Anti-Spyware. Je n'ai pas de rapport car je n'avis pas déselctionner l'édition du rapport seulement en cas de menaces. Au final seul 8 cookies int été trouvés:
TrackingCookie.Skype
TrackingCookie.Adtech
TrackingCookie.Advertising
TrackingCookie.Doubleclick
TrackingCookie.Hitbox
TrackingCookie.Estat
TrackingCookie.Tradedoubler
TrackingCookie.Weborama


Ci-dessous le rapport BitDefender:

BitDefender Online Scanner
Rapport d'analyse généré à: Sat, Mar 01, 2008 - 14:56:16
Voie d'analyse: C:\;D:\;E:\;F:\;G:\;H:\;
   
Statistiques
Temps 00:26:42
Fichiers 89021
Directoires 7946
Secteurs de boot 4
Archives 1284
Paquets programmes 6473
 
Résultats
Virus identifiés 0
Fchiers infectés 0
Fichiers suspects 0
Avertissements 0
Désinfectés 0
Fichiers effacés 0
   
 
Info sur les moteurs
Définition virus 984696
Version des moteurs AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
Analyse des plugins 16
Archive des plugins 41
Unpack des plugins 7
E-mail plugins 6
Système plugins 5
 
Paramètres d'analyse
Première action Désinfecté
Seconde Action Supprimé
Heuristique Oui
Acceptez les avertissements Oui
Extensions analysées exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
 
Excludez les extensions
  
Analyse d'emails Oui
Analyse des Archives Oui
Analyser paquets programmes Oui
Analyse des fichiers Oui
Analyse de boot Oui
 
Fichier analysé
Statut
Aucun virus trouvé.


 
Enfin le rapport HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:06:11, on 01/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\DOCUME~1\Vincent\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.mcafee.com/StaticGenericPage.aspx?page=cookienotsupported&url=%2froot%2fcampaign.aspx%3fcid%3d16972%26culture%3dfr-FR%26ctst%3d1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-21-1541142099-1641886930-723556591-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Valérie')
O4 - HKUS\S-1-5-21-1541142099-1641886930-723556591-1006\..\Run: [SetDefaultMIDI] MIDIDef.exe (User 'Valérie')
O4 - HKUS\S-1-5-21-1541142099-1641886930-723556591-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Valérie')
O4 - HKUS\S-1-5-21-1541142099-1641886930-723556591-1006\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c (User 'Valérie')
O4 - HKUS\S-1-5-21-1541142099-1641886930-723556591-1006\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" /SCB (User 'Valérie')
O4 - HKUS\S-1-5-21-1541142099-1641886930-723556591-1006\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe (User 'Valérie')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-1541142099-1641886930-723556591-1006 Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe (User 'Valérie')
O4 - S-1-5-21-1541142099-1641886930-723556591-1006 User Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe (User 'Valérie')
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
O4 - Global Startup: Lancement Application Fax.lnk = C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O23 - Service: McAfee Application Installer Cleanup (0080271204356527) (0080271204356527mcinstcleanup) - McAfee, Inc. - C:\WINDOWS\TEMP\008027~1.EXE
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

green day · Answer

Très bien, je pense que c'est tout bon à présent ! ;-))

@+

vince37 · Answer

Ok merci beaucoup pour votre aide "green day" et "jlpjlp".

Comment puis je mettre ce post en problème résolu?

Slts

green day · Answer

pas d'quoi ;-))

 c'est déjà fait !

@+

vince37 · Answer

Non ??

Résultat Hijackthis suite à virus VundoTrojan - Page 2

Discussions similaires

Newsletters