Trojan-Dropper.win32.purityscan.at

LULAH972 Messages postés 3 Statut Membre -  
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,

J'ai un fichier newloader.exe sur mon ordi qui d'après kaspersky est un cheval de troie "trojan-Dropper.win32.purityscan.at"

Est-ce que quelqu'un connait les risques et ce que c'est exactement parce que je ne trouve rien sur le sujet nulle part et bien sur comment me débarrasser de çà !!!

Merci de votre aide par avance
Configuration: Windows XP
Internet Explorer 7.0

2 réponses

  1. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    slt,

    Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Sauvegarde le sur ton bureau et pas ailleurs !

    Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

    Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
    Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

    _____________

    colle un rapport hijackthis

    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

    manuel :

    https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

    Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

    ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

    Ensuite avec Explorer créer un dossier c:\hijackthis
    Décompresser Hijackthis dans ce dossier.
    C'est important pour les sauvegardes."

    ___________

    colle un rapport kaspersky

    a plus
    0
    1. LULAH972 Messages postés 3 Statut Membre
       
      voilà le résultat de combo fix, désolé mais comme je n'y connais rien, je fais quoi après ?

      ComboFix 08-03-14.4 - lulah972 2008-03-17 17:32:11.1 - NTFSx86
      Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.155 [GMT 0:00]
      Endroit: C:\Documents and Settings\lulah972\Bureau\Combo-Fix.exe
      .

      ((((((((((((((((((((((((((((( Fichiers créés 2008-02-17 to 2008-03-17 ))))))))))))))))))))))))))))))))))))
      .

      2008-03-17 17:18 . 2008-03-17 17:18 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
      2008-03-17 16:22 . 2008-03-17 16:22 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
      2008-03-17 16:22 . 2008-03-17 16:22 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
      2008-03-17 16:21 . 2008-03-17 16:21 <REP> d-------- C:\Program Files\Kaspersky Lab
      2008-03-17 16:21 . 2008-03-17 17:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
      2008-03-17 16:21 . 2008-03-17 17:44 267,040 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
      2008-03-17 16:21 . 2008-03-17 17:44 6,432 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
      2008-03-17 16:21 . 2008-03-17 17:19 3,284 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
      2008-03-17 16:21 . 2008-03-17 17:19 1,436 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
      2008-03-16 01:20 . 2008-03-16 01:21 <REP> d-------- C:\WINDOWS\Album
      2008-03-16 01:20 . 2008-03-16 01:20 <REP> d-------- C:\Program Files\KYE
      2008-03-16 01:20 . 2008-03-16 01:21 <REP> d-------- C:\Program Files\Fichiers communs\snp2std
      2008-03-16 01:20 . 2006-11-08 14:57 12,006,784 --a------ C:\WINDOWS\system32\drivers\snp2sxp.sys
      2008-03-16 01:20 . 2006-09-15 13:21 675,840 --a------ C:\WINDOWS\vsnp2std.exe
      2008-03-16 01:20 . 2006-11-02 14:04 258,048 --a------ C:\WINDOWS\tsnp2std.exe
      2008-03-16 01:20 . 2006-10-03 14:35 249,856 --a------ C:\WINDOWS\vsnp2std.dll
      2008-03-16 01:20 . 2006-10-12 17:21 151,552 --a------ C:\WINDOWS\rsnp2std.dll
      2008-03-16 01:20 . 2006-11-16 15:57 77,824 --a------ C:\WINDOWS\system32\csnp2std.dll
      2008-03-16 01:20 . 2006-11-13 17:27 24,832 --a------ C:\WINDOWS\system32\drivers\sncamd.sys
      2008-03-16 01:20 . 2004-12-09 17:23 15,497 --a------ C:\WINDOWS\snp2std.ini
      2008-03-16 01:20 . 2004-12-09 17:23 13,022 --a------ C:\WINDOWS\snp2std.src
      2008-03-15 22:31 . 2008-03-15 22:32 <REP> d-------- C:\Documents and Settings\lulah972\Application Data\Image Zone Express
      2008-03-15 22:26 . 2008-03-15 22:27 <REP> d-------- C:\Program Files\Fichiers communs\HP
      2008-03-15 22:25 . 2008-03-15 22:25 <REP> d-------- C:\Program Files\Hewlett-Packard
      2008-03-15 21:12 . 2008-03-15 22:28 128,313 --a------ C:\WINDOWS\hpoins11.dat
      2008-03-14 00:52 . 2008-03-15 23:14 <REP> d-------- C:\CV
      2008-03-13 23:51 . 2008-03-17 17:20 <REP> d-------- C:\Documents and Settings\lulah972\Application Data\OpenOffice.org2
      2008-03-13 23:49 . 2008-03-13 23:49 <REP> d-------- C:\Program Files\OpenOffice.org 2.3
      2008-03-13 23:48 . 2008-03-13 23:48 <REP> d-------- C:\Program Files\open office
      2008-03-13 23:46 . 2008-03-13 23:46 113,353,152 --a------ C:\Program Files\OOo_2.3.1_Win32Intel_install_fr.exe
      2008-03-13 22:21 . 2008-03-17 15:53 <REP> d-------- C:\WINDOWS\MVUNINST
      2008-03-13 20:46 . 2008-03-13 20:46 <REP> d-------- C:\Program Files\Antadis
      2008-03-12 02:06 . 2008-03-12 02:06 <REP> d-------- C:\MARJO
      2008-03-09 03:54 . 2008-03-17 17:20 <REP> d-------- C:\Program Files\DAP
      2008-03-09 03:53 . 2008-03-09 03:52 1,762,947 --a------ C:\Program Files\Download Accelarator Crack.zip
      2008-03-08 00:01 . 2008-03-08 00:01 <REP> d-------- C:\Program Files\FreezeSMS
      2008-03-07 23:54 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
      2008-03-07 23:11 . 2008-03-07 23:11 3,858,985 --a------ C:\Program Files\eMule0.48a-Installer.exe
      2008-03-07 21:38 . 2008-03-07 21:38 3,105,263 --a------ C:\Program Files\emule046c.exe
      2008-03-01 01:37 . 2008-03-01 01:37 <REP> d-------- C:\Program Files\VirtualDJ
      2008-03-01 01:27 . 2008-03-15 07:00 <REP> d-------- C:\Documents and Settings\lulah972\Application Data\U3
      2008-02-29 22:53 . 2008-02-29 22:53 6,222,193 --a------ C:\Program Files\Setup_FreeConverter.exe
      2008-02-29 22:30 . 2008-02-29 22:30 <REP> d-------- C:\WINDOWS\Downloaded Installations
      2008-02-29 15:00 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
      2008-02-29 15:00 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
      2008-02-29 15:00 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
      2008-02-29 02:06 . 2008-02-29 02:06 <REP> d-------- C:\Documents and Settings\lulah972\Application Data\Windows Live Writer
      2008-02-29 02:05 . 2008-02-29 02:05 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
      2008-02-29 02:05 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
      2008-02-29 02:02 . 2008-02-29 02:02 <REP> d-------- C:\Program Files\Windows Live Favorites
      2008-02-29 02:01 . 2008-02-29 02:02 <REP> d-------- C:\Program Files\Windows Live Toolbar
      2008-02-29 01:37 . 2008-02-29 01:56 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
      2008-02-29 01:37 . 2008-02-29 02:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
      2008-02-28 00:46 . 2008-02-28 00:46 664,829 --a------ C:\Program Files\MobAmrCon14-setup.zip
      2008-02-28 00:34 . 2008-02-28 00:34 <REP> d-------- C:\Program Files\MIKSOFT
      2008-02-28 00:33 . 2008-02-28 00:33 151,609 --a------ C:\Program Files\amrUp15.exe
      2008-02-18 23:17 . 2008-02-18 23:17 1,583,640 --a------ C:\Program Files\va22.exe

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-03-17 17:21 --------- d-----w C:\Program Files\SpeedBit Video Accelerator
      2008-03-16 01:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-03-16 01:00 --------- d-----w C:\Program Files\eMule
      2008-03-15 22:25 --------- d-----w C:\Program Files\HP
      2008-03-04 21:45 --------- d-----w C:\Program Files\free-downloads.net
      2008-02-29 22:29 --------- d-----w C:\Program Files\Sony
      2008-02-29 02:45 490,095 ----a-w C:\Program Files\Longhorn-Theme-skin-0.1.2.plsk
      2008-02-29 02:05 --------- d-----w C:\Program Files\Windows Live
      2008-02-29 01:38 --------- d-----w C:\Program Files\MSN Messenger
      2008-02-10 11:50 --------- d-----w C:\Program Files\Sony Setup
      2008-02-10 11:49 --------- d-----w C:\Documents and Settings\lulah972\Application Data\Sony
      2008-02-10 11:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony
      2008-02-10 11:43 --------- d-----w C:\Program Files\Microsoft SQL Server
      2008-02-08 20:42 1,991,722 ----a-w C:\Program Files\RIB.bmp
      2008-02-08 18:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll
      2008-02-08 18:35 23,604 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
      2008-02-03 20:49 664,862 ----a-w C:\Program Files\convertor - convertisseur d'images.zip
      2008-01-29 11:57 --------- d-----w C:\Documents and Settings\lulah972\Application Data\DivX
      2008-01-28 13:47 --------- d-----w C:\Program Files\XBudget
      2008-01-28 13:46 1,243,358 ----a-w C:\Program Files\install_xbudget.exe
      2008-01-27 23:42 --------- d-----w C:\Program Files\EtiketaGoGo
      2008-01-26 23:03 --------- d-----w C:\Program Files\DivX
      2008-01-26 23:02 17,021,984 ----a-w C:\Program Files\DivXInstaller.exe
      2008-01-26 22:52 --------- d-----w C:\Program Files\TEMP
      2008-01-26 22:50 --------- d-----w C:\Program Files\WinASPI
      2008-01-26 22:32 --------- d-----w C:\Program Files\Zylom Games
      2008-01-26 22:32 --------- d-----w C:\Program Files\Google
      2008-01-26 22:32 --------- d-----w C:\Documents and Settings\lulah972\Application Data\Zylom
      2008-01-26 22:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
      2008-01-26 22:31 9,211,720 ----a-w C:\Program Files\zumadownload.exe
      2008-01-25 02:35 --------- d-----w C:\Program Files\Office 2003
      2008-01-25 01:31 149,157 ----a-w C:\Program Files\sfdrvrem.zip
      2008-01-25 01:16 --------- d-----w C:\Program Files\Micro Application
      2008-01-24 19:51 --------- d-----w C:\Program Files\Alcohol Soft
      2008-01-24 19:47 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
      2008-01-24 19:45 9,868,672 ----a-w C:\Program Files\Alcohol120_trial_1.9.7.6022.exe
      2008-01-23 10:06 --------- d-----w C:\Program Files\Boonty
      2008-01-22 07:21 --------- d-----w C:\Documents and Settings\lulah972\Application Data\ma-config.com
      2008-01-22 07:18 --------- d-----w C:\Documents and Settings\lulah972\Application Data\HP
      2008-01-22 07:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
      2008-01-22 07:14 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
      2008-01-21 19:51 --------- d-----w C:\Program Files\ma-config.com
      2008-01-20 19:10 --------- d-----w C:\Program Files\VideoLAN
      2008-01-20 19:10 --------- d-----w C:\Documents and Settings\lulah972\Application Data\vlc
      2008-01-20 18:45 171,520 ----a-w C:\WINDOWS\system32\cncs32.dll
      2008-01-20 17:45 --------- d-----w C:\Program Files\Fichiers communs\BOONTY Shared
      2008-01-20 17:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\BOONTY
      2008-01-20 15:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
      2008-01-20 04:38 --------- d-----w C:\Documents and Settings\lulah972\Application Data\AlauxSoft
      2008-01-20 04:31 --------- d-----w C:\Program Files\Messenger Plus! Live
      2008-01-20 04:18 --------- d-----w C:\Program Files\Fichiers communs\Ahead
      2008-01-20 04:18 --------- d-----w C:\Program Files\Ahead
      2008-01-20 03:45 --------- d-----w C:\Program Files\Olitec
      2008-01-20 03:32 --------- d-----w C:\Program Files\USBADSLV3
      2008-01-19 21:59 524,288 ----a-w C:\WINDOWS\system32\drivers\CnxE2FS.bin
      2008-01-19 16:11 --------- d-----w C:\Program Files\Marvell
      2008-01-19 16:11 --------- d-----w C:\Documents and Settings\lulah972\Application Data\TMP
      2008-01-19 16:08 --------- d-----w C:\Program Files\Realtek
      2008-01-19 15:55 32,768 ----a-w C:\WINDOWS\system32\MWLPS.dll
      2008-01-19 15:55 --------- d-----w C:\Program Files\Acer WLAN 11g USB Dongle
      2008-01-19 15:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
      2008-01-19 15:44 --------- d-----w C:\Program Files\DIFX
      2008-01-19 15:38 --------- d-----w C:\Documents and Settings\lulah972\Application Data\InstallShield
      2008-01-19 15:36 --------- d-----w C:\Program Files\Conexant
      2008-01-19 15:26 --------- d---a-w C:\Documents and Settings\lulah972\Application Data\gtopala
      2008-01-19 15:26 --------- d---a-w C:\Documents and Settings\lulah972\Application Data\aignes
      2008-01-19 15:22 --------- d-----w C:\Program Files\Java
      2008-01-19 15:22 --------- d-----w C:\Program Files\Fichiers communs\Java
      2008-01-19 15:21 --------- d-----w C:\Program Files\WMV9_VCM
      2008-01-19 15:21 --------- d-----w C:\Program Files\Windows Media Connect 2
      2008-01-19 15:12 --------- d-----w C:\Program Files\MSXML 4.0
      2008-01-19 15:11 --------- d-----w C:\Program Files\WSTARTUP
      2008-01-19 15:11 --------- d-----w C:\Program Files\UTILS
      2008-01-19 15:11 --------- d-----w C:\Program Files\JEUX
      2008-01-19 15:05 --------- d-----w C:\Program Files\microsoft frontpage
      2008-01-17 01:38 2,474,300 ----a-w C:\Program Files\usbadslv3ep.exe
      2008-01-04 21:59 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
      2008-01-04 21:58 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
      2008-01-04 21:58 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
      2008-01-04 21:58 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
      2008-01-04 21:58 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
      2008-01-04 21:58 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
      2008-01-04 21:58 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
      2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
      2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
      2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
      2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
      2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
      2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
      2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
      2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
      2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
      2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
      2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
      2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
      2008-01-04 21:56 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
      2008-01-04 21:56 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
      .

      ------- Sigcheck -------

      2006-11-11 14:02 359808 8d8949936913b041c6a0e184fbf1030b C:\WINDOWS\system32\drivers\tcpip.sys

      2006-11-18 23:59 1035264 7ba68df484b550c1f75dd80ae1d7ef67 C:\WINDOWS\explorer.exe
      .
      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 17:09 15360]
      "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
      "ares"="C:\Program Files\Ares\Ares.exe" [ ]
      "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 07:20 222080]
      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-11 20:59 68856]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 05:19 7626752]
      "nwiz"="nwiz.exe" [2006-07-12 05:19 1519616 C:\WINDOWS\system32\nwiz.exe]
      "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 05:19 86016]
      "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 07:48 16208384 C:\WINDOWS\RTHDCPL.exe]
      "SkyTel"="SkyTel.EXE" [2006-05-16 09:04 2879488 C:\WINDOWS\SkyTel.exe]
      "CnxDslTaskBar"="C:\Program Files\Olitec\USB ADSL\CnxDslTb.exe" [2002-07-24 11:48 397312]
      "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
      "SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2008-02-18 23:18 2283120]
      "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
      "tsnp2std"="C:\WINDOWS\tsnp2std.exe" [2006-11-02 14:04 258048]
      "snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-09-15 13:21 675840]
      "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36 227856]

      C:\Documents and Settings\lulah972\Menu D‚marrer\Programmes\D‚marrage\
      IcoSauve.lnk - C:\WINDOWS\system32\IcoSauve.exe [2008-01-19 15:11:55 112128]
      OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

      C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
      Acer WLAN 11g USB Dongle.lnk - C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 19:25:14 745472]
      HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "SynchronousMachineGroupPolicy"= 0 (0x0)
      "SynchronousUserGroupPolicy"= 0 (0x0)

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
      "ForceClassicControlPanel"= 1 (0x1)
      "NoSimpleStartMenu"= 0 (0x0)

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
      "NoStrCmpLogical"= 0 (0x0)
      "LockTaskbar"= 0 (0x0)
      "NoResolveTrack"= 0 (0x0)
      "NoResolveSearch"= 0 (0x0)
      "NoSMMyPictures"= 0 (0x0)
      "NoStartMenuMFUprogramsList"= 0 (0x0)
      "NoUserNameInStartMenu"= 0 (0x0)
      "NoStartMenuMorePrograms"= 0 (0x0)
      "MaxRecentDocs"= 15 (0xf)
      "NoInstrumentation"= 0 (0x0)
      "MemCheckBoxInRunDlg"= 1 (0x1)
      "NoSMBalloonTip"= 0 (0x0)
      "DisallowCpl"= 1 (0x1)

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)
      "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "%windir%\\system32\\sessmgr.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
      "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

      R2 sbbotdi;sbbotdi;C:\PROGRA~1\SPEEDB~1\sbbotdi.sys [2008-02-18 23:18]
      R2 VideoAcceleratorService;VideoAcceleratorService;C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe [2008-02-18 23:18]
      R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys [2002-07-23 17:20]
      R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys [2002-07-23 17:20]
      R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgN.sys [2002-07-24 11:40]
      R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
      S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2008-01-20 17:45]
      S3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2006-11-08 14:57]
      S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-10-28 10:38]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41dc893c-df23-11dc-8e25-0019215a8ecc}]
      \Shell\AutoRun\command - K:\LaunchU3.exe -a

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41dc893d-df23-11dc-8e25-0019215a8ecc}]
      \Shell\Auto\command - L:\UFO.exe
      \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

      .
      Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
      "2008-03-17 17:13:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
      - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
      .
      **************************************************************************

      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-03-17 17:44:46
      Windows 5.1.2600 Service Pack 2 NTFS

      Balayage processus cachés ...

      Balayage caché autostart entries ...

      Balayage des fichiers cachés ...

      Scan terminé avec succès
      Les fichiers cachés: 0

      **************************************************************************
      .
      Temps d'accomplissement: 2008-03-17 17:46:51
      0
  2. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    colle un rapport hijackthis

    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

    manuel :

    https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

    Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

    ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

    Ensuite avec Explorer créer un dossier c:\hijackthis
    Décompresser Hijackthis dans ce dossier.
    C'est important pour les sauvegardes."

    ___________

    colle un rapport kaspersky

    a plus
    0