Sujet Précédent Sujet Suivant

Unknown trojan

Fermé
hotaru24 - 26 mars 2008 à 19:03
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 - 30 mars 2008 à 18:26
Bonjour,
Ma version d'essais d'avast a pris fin il y a peu de temps, et le temps que je la remplace mon PC a été infecté par un trojan win32. J'ai réussis à m'en débarrasser grâce à spybot, mais depuis à chaque foie que j'ouvre un fichier, une fenêtre System Error s'ouvre et me dit "Your computer was infected by unknow trojan. It's dangerous for your system (critical files can be lost)! Click Ok to download the antispyware program to clean your system! (Recommended)"
Je sais que le problème déjà été posé sur le site, mais j'ai ouvert un nouveau sujet pour qu'on s'y retrouve.
Donc j'ai installé "Navilog1", j'ai fais l'analyse, et voila ce que ça donne :

Search Navipromo version 3.5.1 commencé le 07/04/2008 à 18:11:59,20

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Florent"

Mise à jour le 23.03.2008 à 22h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***




*** Recherche dossiers dans "C:\Documents and Settings\Florent\applic~1" ***



*** Recherche dossiers dans "C:\Documents and Settings\Florent\locals~1\applic~1" ***



*** Recherche dossiers dans "C:\Documents and Settings\Florent\menudm~1\progra~1" ***


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans "C:\Documents and Settings\Florent\locals~1\applic~1" *

* Recherche dans "C:\docume~1\Administrateur\locals~1\applic~1" *



*** Recherche fichiers ***


Voila, si quelqun pouvait m'aider pour la suite des opérations, il me sauverait la vie.

MERCI d'avance ^^.
A voir également:

12 réponses

Réponse 1 / 12
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
26 mars 2008 à 19:10
hotaru,

supprime navilog:

post un rapport hijack this

Télécharge HijackThis ici :

-> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

-> http://pageperso.aol.fr/balltrap34/Hijenr.gif

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

Post le rapport généré ici stp...

@+
0
hotaru24
26 mars 2008 à 19:48
Voila:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:45:25, on 07/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.ircfast2.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.generation-nt.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Florent\LOCALS~1\Temp\bridéé£'£'%''msn'è%'fix''.exe
O2 - BHO: Media Player Codec - {3084A75F-5350-4D8B-BC5F-6B378035C133} - C:\WINDOWS\dsaip32b.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\Florent\LOCALS~1\Temp\bridéé£'£'%''msn'è%'fix''.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=www.generation-nt.com
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
0
Réponse 2 / 12
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
26 mars 2008 à 19:54
re,

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message ainsi qu´un nouveau rapport hijack this.

-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

@+
0
hotaru24
26 mars 2008 à 20:13
Voila pour ComboFix :

ComboFix 08-03-25.4 - Florent 2008-03-26 20:06:27.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1400 [GMT 1:00]
Endroit: C:\Documents and Settings\Florent\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

2008-03-22 20:07 . 2008-03-22 20:07 244 --ah----- C:\sqmnoopt04.sqm
2008-03-22 20:07 . 2008-03-22 20:07 232 --ah----- C:\sqmdata05.sqm
2008-03-16 11:28 . 2008-03-16 11:28 <REP> d-------- C:\Program Files\PSCS2Updater
2008-03-08 12:46 . 2008-03-08 12:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3
2008-03-08 12:42 . 2008-03-08 12:45 <REP> d-------- C:\Program Files\Age of Empires III
2008-03-08 12:30 . 2008-03-08 12:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3 YPack Trial
2008-03-07 19:49 . 2008-03-07 19:49 <REP> d-------- C:\Program Files\Aspyr
2008-03-04 11:57 . 2008-03-04 11:57 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-03-04 11:57 . 2008-03-04 11:57 <REP> d-------- C:\Program Files\Microsoft.NET
2008-03-04 11:57 . 2008-03-04 11:57 <REP> d-------- C:\Program Files\Microsoft ActiveSync
2008-03-04 11:57 . 2008-03-04 11:57 379 --a------ C:\WINDOWS\ODBC.INI
2008-03-02 15:53 . 2008-03-02 15:53 <REP> d-------- C:\Program Files\Guitar Pro 5
2008-03-02 00:03 . 2008-03-02 00:03 <REP> d-------- C:\Program Files\VideoLAN
2008-03-02 00:03 . 2008-03-02 00:03 <REP> d-------- C:\Documents and Settings\Florent\Application Data\vlc
2008-03-02 00:03 . 2008-03-02 00:03 <REP> d-------- C:\Documents and Settings\Florent\Application Data\dvdcss
2008-02-29 14:36 . 2008-02-29 14:36 <REP> d-------- C:\Program Files\CDex_170b2
2008-02-26 11:38 . 2008-02-26 11:38 <REP> d-------- C:\Program Files\Foxit Software

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-07 17:42 --------- d-----w C:\Program Files\Trend Micro
2008-04-07 17:40 --------- d-----w C:\Program Files\Navilog1
2008-04-07 16:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-07 15:59 --------- d-----w C:\Program Files\Trojan Remover
2008-04-07 15:59 --------- d-----w C:\Documents and Settings\Florent\Application Data\Simply Super Software
2008-04-07 15:36 --------- d-----w C:\Program Files\AdVantage
2008-04-07 15:23 --------- d-----w C:\Program Files\Lavasoft
2008-04-07 15:12 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-04-07 15:01 --------- d-----w C:\Program Files\Steam
2008-04-07 13:20 --------- d-----w C:\Program Files\Files-Secure
2008-04-07 13:10 --------- d-----w C:\Program Files\eMule
2008-04-07 12:00 49 ----a-w C:\xmp.bat
2008-04-06 16:32 9,296 ----a-w C:\Documents and Settings\Florent\cqqtoa.exe
2008-04-04 18:20 --------- d-----w C:\Program Files\StepMania
2008-03-19 16:30 --------- d-----w C:\Program Files\e frontier
2008-03-14 17:31 --------- d-----w C:\Program Files\Winamp
2008-03-14 17:31 --------- d-----w C:\Documents and Settings\Florent\Application Data\Winamp
2008-03-11 18:59 --------- d-----w C:\Program Files\BitComet
2008-03-08 17:25 --------- d-----w C:\Program Files\Call of Duty 4 - Modern Warfare
2008-03-08 17:18 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-08 17:18 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-08 14:55 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2008-03-08 12:56 --------- d-----w C:\Documents and Settings\Florent\Application Data\Hamachi
2008-03-07 23:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-24 20:08 --------- d-----w C:\Program Files\Unreal Tournament 3
2008-02-24 20:08 --------- d-----w C:\Program Files\Microsoft Games
2008-02-21 21:17 --------- d-----w C:\Program Files\ImTOO
2008-02-20 21:28 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-20 16:56 --------- d-----w C:\Program Files\iTunes
2008-02-20 16:56 --------- d-----w C:\Documents and Settings\Florent\Application Data\Apple Computer
2008-02-20 16:55 --------- d-----w C:\Program Files\QuickTime
2008-02-20 16:55 --------- d-----w C:\Program Files\iPod
2008-02-20 16:55 --------- d-----w C:\Program Files\Bonjour
2008-02-20 16:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-20 16:54 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-02-20 16:54 --------- d-----w C:\Program Files\Apple Software Update
2008-02-20 16:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-02-19 19:56 --------- d-----w C:\Program Files\VstPlugins
2008-02-19 19:55 --------- d-----w C:\Program Files\Image-Line
2008-02-19 19:49 --------- d-----w C:\Program Files\ASIO4ALL v2
2008-02-19 17:52 --------- d-----w C:\Program Files\Nero
2008-02-19 17:50 --------- d-----w C:\Documents and Settings\Florent\Application Data\Nero
2008-02-19 17:49 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-02-19 17:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-02-18 19:47 --------- d-----w C:\Program Files\VirtualDub-1.7.8
2008-02-16 23:40 --------- d-----w C:\Documents and Settings\Florent\Application Data\InstallShield Installation Information
2008-02-16 23:32 --------- d-----w C:\Program Files\AGEIA Technologies
2008-02-16 19:10 --------- d-----w C:\Documents and Settings\Florent\Application Data\atitray
2008-02-16 19:09 --------- d-----w C:\Program Files\Ray Adams
2008-02-16 19:07 --------- d-----w C:\Program Files\RivaTuner v2.06
2008-02-16 16:28 --------- d-----w C:\Documents and Settings\Florent\Application Data\Lavasoft
2008-02-09 19:20 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-02-09 19:20 --------- d-----w C:\Program Files\Hamachi
2008-02-09 13:25 --------- d-----w C:\Program Files\ATI Technologies
2008-02-09 13:23 --------- d-----w C:\Program Files\Fichiers communs\ATI Technologies
2008-02-09 11:34 71,634 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-02-09 11:34 5,374 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-02-09 10:21 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-02-09 09:56 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-02-08 21:18 1,828,322 ----a-w C:\WINDOWS\Counter-Strike Source LAN Edition Uninstaller.exe
2008-02-08 21:09 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-08 21:09 --------- d--h--r C:\Documents and Settings\Florent\Application Data\SecuROM
2008-02-08 21:08 22,328 ----a-w C:\Documents and Settings\Florent\Application Data\PnkBstrK.sys
2008-02-08 21:07 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-02-08 21:07 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-02-08 21:02 --------- d-----w C:\Program Files\Electronic Arts
2008-02-08 20:57 --------- d-----w C:\Documents and Settings\Florent\Application Data\DAEMON Tools
2008-02-08 20:54 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-08 20:46 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-02-08 15:26 3,120 ----a-w C:\WINDOWS\system32\6ffdbcaf-f6c1-42d3-a4a9-c7957224a70b.dll
2008-02-08 15:26 --------- d-----w C:\Documents and Settings\Florent\Application Data\e frontier
2008-02-08 09:58 --------- d-----w C:\Documents and Settings\Florent\Application Data\Media Player Classic
2008-02-08 09:58 --------- d-----w C:\Documents and Settings\Florent\Application Data\DivX
2008-02-07 21:01 --------- d-----w C:\Documents and Settings\Florent\Application Data\Talkback
2008-02-07 17:34 --------- d-----w C:\Program Files\Futuremark
2008-02-07 17:29 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-07 17:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-07 17:02 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-02-07 16:54 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Lavasoft
2008-02-07 16:47 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\eMule
2008-02-06 21:22 --------- d-----w C:\Program Files\Windows Live
2008-02-06 21:16 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-06 21:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-06 20:36 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-02-06 20:28 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Media Player Classic
2008-02-06 20:27 --------- d-----w C:\Program Files\Satsuki Decoder Pack
2008-02-06 20:26 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Winamp
2008-02-06 20:24 --------- d-----w C:\Program Files\Alwil Software
2008-02-06 18:59 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Talkback
2008-02-06 18:01 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-02-06 18:01 --------- d-----w C:\Program Files\TRENDnet
2008-02-06 00:03 --------- d-----w C:\Program Files\Realtek
2008-02-06 00:02 15,600 ----a-w C:\WINDOWS\gdrv.sys
2008-02-05 23:57 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\InstallShield
2008-02-05 23:52 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-05 23:50 0 ----a-w C:\WINDOWS\system32\drivers\SET76.tmp
2008-02-05 23:49 --------- d-----w C:\Program Files\Intel
2008-02-05 23:45 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 23:43 --------- d-----w C:\Program Files\Services en ligne
2008-02-05 23:41 --------- d-----w C:\Program Files\Windows Plus
.

------- Sigcheck -------

2004-11-25 22:20 506368 048cb871e6f98e41f072b85c67c30925 C:\WINDOWS\system32\winlogon.exe

2007-06-13 14:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\explorer.exe
2007-06-13 14:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-10 12:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 14:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3084A75F-5350-4D8B-BC5F-6B378035C133}]
2008-04-07 13:00 212480 --a------ C:\WINDOWS\dsaip32b.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 12:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-02-08 22:22 1266936]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2007-12-15 11:02 482760]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2007-05-22 10:04 521128]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 04:04 59392]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 09:08 16380416 C:\WINDOWS\RTHDCPL.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 14:18 267048]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-01-15 17:28 108160]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2007-03-16 12:44 296544]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 12:00 15360]

C:\Documents and Settings\Florent\Menu D‚marrer\Programmes\D‚marrage\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Wireless Configuration Utility HW.14.lnk - C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe [2007-07-09 15:43:00 634880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Counter-Strike Source LAN Edition\\hl2.exe"=
"C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Age of Empires III\\age3x.exe"=
"C:\\Program Files\\Aspyr\\Guitar Hero III\\GH3.exe"=
"C:\\DOCUME~1\\Florent\\LOCALS~1\\Temp\\bridéé£'£'%''msn'è%'fix''.exe"=

R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2007-05-22 10:04]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2007-07-20 18:40]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-02-06 01:02]
S3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-05-04 20:40]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27b5639a-d4d5-11dc-926f-001d7d9ee6c6}]
\Shell\AutoRun\command - F:\setupSNK.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - SJYPKT
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-03-19 20:32:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 20:07:28
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

? [592]

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
.
Temps d'accomplissement: 2008-03-26 20:08:03
ComboFix-quarantined-files.txt 2008-03-26 19:07:48
.
2008-03-20 21:23:02 --- E O F ---

Et voila pour hijack this :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:12:35, on 26/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.ircfast2.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Florent\LOCALS~1\Temp\bridéé£'£'%''msn'è%'fix''.exe
O2 - BHO: Media Player Codec - {3084A75F-5350-4D8B-BC5F-6B378035C133} - C:\WINDOWS\dsaip32b.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=www.generation-nt.com
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
0
Réponse 3 / 12
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
26 mars 2008 à 20:30
re,

Copie le texte ci-dessous :

File::
C:\Documents and Settings\Florent\cqqtoa.exe
C:\xmp.bat
C:\WINDOWS\dsaip32b.dll

Collect::
C:\WINDOWS\dsaip32b.dll
C:\xmp.bat

Folder::
C:\Program Files\Navilog1

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3084A75F-5350-4D8B-BC5F-6B378035C133}]

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

@+
0
hotaru24
26 mars 2008 à 20:51
Avant tout je ne sais pas si ça change quelque chose, mais avast qui jusque là ne c'était pas manifesté, m'a dit après les deux scans qu'il avait trouvé un cheval de troie (Win32:Small-JMH [Trj]) dans C:\Documents and Settings\Florent\Local Settings\Temporary Internet Files\Content.IE5\VVTVFD8S\6736f989[1].exe\[UPX]. J'ai laissé la fenêtre d'avast ouverte sans effectuer d'opération.
Sinon voila le scan ComboFix :

ComboFix 08-03-25.4 - Florent 2008-03-26 20:40:20.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1412 [GMT 1:00]
Endroit: C:\Documents and Settings\Florent\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Florent\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\Documents and Settings\Florent\cqqtoa.exe
C:\WINDOWS\dsaip32b.dll
C:\xmp.bat
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Florent\cqqtoa.exe
C:\Program Files\Navilog1
C:\Program Files\Navilog1\recherok.txt
C:\WINDOWS\dsaip32b.dll
C:\xmp.bat

.
((((((((((((((((((((((((((((( Fichiers créés 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))))))))
.

2008-03-26 20:36 . 2008-03-26 20:36 244 --ah----- C:\sqmnoopt05.sqm
2008-03-26 20:36 . 2008-03-26 20:36 232 --ah----- C:\sqmdata06.sqm
2008-03-22 20:07 . 2008-03-22 20:07 244 --ah----- C:\sqmnoopt04.sqm
2008-03-22 20:07 . 2008-03-22 20:07 232 --ah----- C:\sqmdata05.sqm
2008-03-16 11:28 . 2008-03-16 11:28 <REP> d-------- C:\Program Files\PSCS2Updater
2008-03-08 12:46 . 2008-03-08 12:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3
2008-03-08 12:42 . 2008-03-08 12:45 <REP> d-------- C:\Program Files\Age of Empires III
2008-03-08 12:30 . 2008-03-08 12:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Age of Empires 3 YPack Trial
2008-03-07 19:49 . 2008-03-07 19:49 <REP> d-------- C:\Program Files\Aspyr
2008-03-04 11:57 . 2008-03-04 11:57 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-03-04 11:57 . 2008-03-04 11:57 <REP> d-------- C:\Program Files\Microsoft.NET
2008-03-04 11:57 . 2008-03-04 11:57 <REP> d-------- C:\Program Files\Microsoft ActiveSync
2008-03-04 11:57 . 2008-03-04 11:57 379 --a------ C:\WINDOWS\ODBC.INI
2008-03-02 15:53 . 2008-03-02 15:53 <REP> d-------- C:\Program Files\Guitar Pro 5
2008-03-02 00:03 . 2008-03-02 00:03 <REP> d-------- C:\Program Files\VideoLAN
2008-03-02 00:03 . 2008-03-02 00:03 <REP> d-------- C:\Documents and Settings\Florent\Application Data\vlc
2008-03-02 00:03 . 2008-03-02 00:03 <REP> d-------- C:\Documents and Settings\Florent\Application Data\dvdcss
2008-02-29 14:36 . 2008-02-29 14:36 <REP> d-------- C:\Program Files\CDex_170b2
2008-02-26 11:38 . 2008-02-26 11:38 <REP> d-------- C:\Program Files\Foxit Software

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-07 17:42 --------- d-----w C:\Program Files\Trend Micro
2008-04-07 16:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-07 15:59 --------- d-----w C:\Program Files\Trojan Remover
2008-04-07 15:59 --------- d-----w C:\Documents and Settings\Florent\Application Data\Simply Super Software
2008-04-07 15:36 --------- d-----w C:\Program Files\AdVantage
2008-04-07 15:23 --------- d-----w C:\Program Files\Lavasoft
2008-04-07 15:12 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-04-07 15:01 --------- d-----w C:\Program Files\Steam
2008-04-07 13:20 --------- d-----w C:\Program Files\Files-Secure
2008-04-07 13:10 --------- d-----w C:\Program Files\eMule
2008-04-04 18:20 --------- d-----w C:\Program Files\StepMania
2008-03-19 16:30 --------- d-----w C:\Program Files\e frontier
2008-03-14 17:31 --------- d-----w C:\Program Files\Winamp
2008-03-14 17:31 --------- d-----w C:\Documents and Settings\Florent\Application Data\Winamp
2008-03-11 18:59 --------- d-----w C:\Program Files\BitComet
2008-03-08 17:25 --------- d-----w C:\Program Files\Call of Duty 4 - Modern Warfare
2008-03-08 17:18 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-08 17:18 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-08 14:55 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2008-03-08 12:56 --------- d-----w C:\Documents and Settings\Florent\Application Data\Hamachi
2008-03-07 23:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-24 20:08 --------- d-----w C:\Program Files\Unreal Tournament 3
2008-02-24 20:08 --------- d-----w C:\Program Files\Microsoft Games
2008-02-21 21:17 --------- d-----w C:\Program Files\ImTOO
2008-02-20 21:28 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-20 16:56 --------- d-----w C:\Program Files\iTunes
2008-02-20 16:56 --------- d-----w C:\Documents and Settings\Florent\Application Data\Apple Computer
2008-02-20 16:55 --------- d-----w C:\Program Files\QuickTime
2008-02-20 16:55 --------- d-----w C:\Program Files\iPod
2008-02-20 16:55 --------- d-----w C:\Program Files\Bonjour
2008-02-20 16:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-20 16:54 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-02-20 16:54 --------- d-----w C:\Program Files\Apple Software Update
2008-02-20 16:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-02-19 19:56 --------- d-----w C:\Program Files\VstPlugins
2008-02-19 19:55 --------- d-----w C:\Program Files\Image-Line
2008-02-19 19:49 --------- d-----w C:\Program Files\ASIO4ALL v2
2008-02-19 17:52 --------- d-----w C:\Program Files\Nero
2008-02-19 17:50 --------- d-----w C:\Documents and Settings\Florent\Application Data\Nero
2008-02-19 17:49 --------- d-----w C:\Program Files\Fichiers communs\Nero
2008-02-19 17:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-02-18 19:47 --------- d-----w C:\Program Files\VirtualDub-1.7.8
2008-02-16 23:40 --------- d-----w C:\Documents and Settings\Florent\Application Data\InstallShield Installation Information
2008-02-16 23:32 --------- d-----w C:\Program Files\AGEIA Technologies
2008-02-16 19:10 --------- d-----w C:\Documents and Settings\Florent\Application Data\atitray
2008-02-16 19:09 --------- d-----w C:\Program Files\Ray Adams
2008-02-16 19:07 --------- d-----w C:\Program Files\RivaTuner v2.06
2008-02-16 16:28 --------- d-----w C:\Documents and Settings\Florent\Application Data\Lavasoft
2008-02-09 19:20 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-02-09 19:20 --------- d-----w C:\Program Files\Hamachi
2008-02-09 13:25 --------- d-----w C:\Program Files\ATI Technologies
2008-02-09 13:23 --------- d-----w C:\Program Files\Fichiers communs\ATI Technologies
2008-02-09 11:34 71,634 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-02-09 11:34 5,374 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-02-09 10:21 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-02-09 09:56 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-02-08 21:18 1,828,322 ----a-w C:\WINDOWS\Counter-Strike Source LAN Edition Uninstaller.exe
2008-02-08 21:09 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-08 21:09 --------- d--h--r C:\Documents and Settings\Florent\Application Data\SecuROM
2008-02-08 21:08 22,328 ----a-w C:\Documents and Settings\Florent\Application Data\PnkBstrK.sys
2008-02-08 21:07 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-02-08 21:07 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-02-08 21:02 --------- d-----w C:\Program Files\Electronic Arts
2008-02-08 20:57 --------- d-----w C:\Documents and Settings\Florent\Application Data\DAEMON Tools
2008-02-08 20:54 715,248 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-08 20:46 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-02-08 15:26 3,120 ----a-w C:\WINDOWS\system32\6ffdbcaf-f6c1-42d3-a4a9-c7957224a70b.dll
2008-02-08 15:26 --------- d-----w C:\Documents and Settings\Florent\Application Data\e frontier
2008-02-08 09:58 --------- d-----w C:\Documents and Settings\Florent\Application Data\Media Player Classic
2008-02-08 09:58 --------- d-----w C:\Documents and Settings\Florent\Application Data\DivX
2008-02-07 21:01 --------- d-----w C:\Documents and Settings\Florent\Application Data\Talkback
2008-02-07 17:34 --------- d-----w C:\Program Files\Futuremark
2008-02-07 17:29 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-07 17:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-07 17:02 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-02-07 16:54 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Lavasoft
2008-02-07 16:47 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\eMule
2008-02-06 21:22 --------- d-----w C:\Program Files\Windows Live
2008-02-06 21:16 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-06 21:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-06 20:36 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-02-06 20:28 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Media Player Classic
2008-02-06 20:27 --------- d-----w C:\Program Files\Satsuki Decoder Pack
2008-02-06 20:26 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Winamp
2008-02-06 20:24 --------- d-----w C:\Program Files\Alwil Software
2008-02-06 18:59 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Talkback
2008-02-06 18:01 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-02-06 18:01 --------- d-----w C:\Program Files\TRENDnet
2008-02-06 00:03 --------- d-----w C:\Program Files\Realtek
2008-02-06 00:02 15,600 ----a-w C:\WINDOWS\gdrv.sys
2008-02-05 23:57 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\InstallShield
2008-02-05 23:52 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-05 23:50 0 ----a-w C:\WINDOWS\system32\drivers\SET76.tmp
2008-02-05 23:49 --------- d-----w C:\Program Files\Intel
2008-02-05 23:45 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-05 23:43 --------- d-----w C:\Program Files\Services en ligne
2008-02-05 23:41 --------- d-----w C:\Program Files\Windows Plus
2008-02-05 22:13 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
.

------- Sigcheck -------

2004-11-25 22:20 506368 048cb871e6f98e41f072b85c67c30925 C:\WINDOWS\system32\winlogon.exe

2007-06-13 14:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\explorer.exe
2007-06-13 14:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-10 12:00 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 14:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 12:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-02-08 22:22 1266936]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2007-12-15 11:02 482760]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2007-05-22 10:04 521128]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 04:04 59392]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 09:08 16380416 C:\WINDOWS\RTHDCPL.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28 36352]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 14:18 267048]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-01-15 17:28 108160]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2007-03-16 12:44 296544]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 12:00 15360]

C:\Documents and Settings\Florent\Menu D‚marrer\Programmes\D‚marrage\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Wireless Configuration Utility HW.14.lnk - C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe [2007-07-09 15:43:00 634880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Counter-Strike Source LAN Edition\\hl2.exe"=
"C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Age of Empires III\\age3x.exe"=
"C:\\Program Files\\Aspyr\\Guitar Hero III\\GH3.exe"=
"C:\\DOCUME~1\\Florent\\LOCALS~1\\Temp\\bridéé£'£'%''msn'è%'fix''.exe"=

R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2007-05-22 10:04]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;C:\WINDOWS\system32\drivers\AtiHdmi.sys [2007-07-20 18:40]
R3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 09:57]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-02-06 01:02]
S3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-05-04 20:40]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27b5639a-d4d5-11dc-926f-001d7d9ee6c6}]
\Shell\AutoRun\command - F:\setupSNK.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - SJYPKT
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-03-19 20:32:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-26 20:40:47
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

? [592]

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-26 20:41:14
ComboFix-quarantined-files.txt 2008-03-26 19:41:00
ComboFix2.txt 2008-03-26 19:08:03
.
2008-03-20 21:23:02 --- E O F ---


Et le scan HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:41:29, on 26/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.ircfast2.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Florent\LOCALS~1\Temp\bridéé£'£'%''msn'è%'fix''.exe
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=www.generation-nt.com
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
0
Réponse 4 / 12
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
26 mars 2008 à 20:56
re,

ok bien joué.

instale ce par feu :

Online armor :

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

tuto : https://forum.pcastuces.com/sujet.asp?f=25&s=35606

puis

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instales l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php
http://speedweb1.free.fr/frames2.php?page=tuto5
<- tutoriel configuration du scanner...

une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes :
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

Je te dis tous ca car j´aimerais que tu performes un scan entier de ta machine a l´aide d´antivir avec les reglages stipulés ci dessus et que tu post le rapport généré ici stp

@+
0
hotaru24
26 mars 2008 à 21:58
Voila j'ai fais tout ce que tu m'a dit de faire (je précise que je n'avais pas supprimé le cheval de troie avec avast) et ça donne ça :



AntiVir PersonalEdition Classic
Report file date: mercredi 26 mars 2008 21:40

Scanning for 1167464 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Florent
Computer name: MCE2005

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 20:30:22
ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 21/03/2008 20:30:22
ANTIVIR3.VDF : 7.0.3.79 91648 Bytes 26/03/2008 20:30:22
AVEWIN32.DLL : 7.6.0.75 3334656 Bytes 26/03/2008 20:30:23
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 26/03/2008 20:30:23
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922

Start of the scan: mercredi 26 mars 2008 21:40

Starting search for hidden objects.
'528171' objects were checked, '0' hidden objects were found.


End of the scan: mercredi 26 mars 2008 21:46
Used time: 06:04 min

The scan has been done completely.

0 Scanning directories
0 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
0 Files not concerned
0 Archives were scanned
0 Warnings
0 Notes
528171 Objects were scanned with rootkit scan
0 Hidden objects were found
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 12
hotaru24
26 mars 2008 à 22:04
Non en fait c'est bon , Antivir viens de trouver le cheval de troie.
0
Réponse 6 / 12
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
26 mars 2008 à 23:52
re,

ok mais peux tu recommencer le scan complet a l´aide d´antivir, car la i a scanner que les fichiers a la recherche de rootkit...

click sur l´icone d´antivir dans la barre des taches et puis dans la fenetre du programme click sur "scan system now".

post le rapport a la fin

@+
0
Réponse 7 / 12
hotaru24
27 mars 2008 à 20:23
re
Dsl pour le retard mais j'étais en cours

AntiVir PersonalEdition Classic
Report file date: jeudi 27 mars 2008 18:20

Scanning for 1167464 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: MCE2005

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 20:30:22
ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 21/03/2008 20:30:22
ANTIVIR3.VDF : 7.0.3.79 91648 Bytes 26/03/2008 20:30:22
AVEWIN32.DLL : 7.6.0.75 3334656 Bytes 26/03/2008 20:30:23
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 26/03/2008 20:30:23
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: jeudi 27 mars 2008 18:20

Starting search for hidden objects.
'78818' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'RocketDock.exe' - '1' Module(s) have been scanned
Scan process 'WlanCU.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'atitray.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'oaui.exe' - '0' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'WgaTray.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'ehmsas.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrB.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'ehSched.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'ehRecvr.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'ehtray.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'bridéé£'£'%''msn'è%'fix''.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'oasrv.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
44 processes with 44 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[NOTE] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
C:\Documents and Settings\Florent\Local Settings\Temp\bridéé£'£'%''msn'è%'fix''.exe
[WARNING] The file could not be opened!
The registry was scanned ( '38' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Florent\Local Settings\Temp\bridéé£'£'%''msn'è%'fix''.exe
[WARNING] The file could not be opened!
C:\Documents and Settings\Florent\Local Settings\Temporary Internet Files\Content.IE5\0RB3IWPP\17PHolmes[1].cmt
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was deleted!
C:\Documents and Settings\Florent\Local Settings\Temporary Internet Files\Content.IE5\P0CV1HGH\6736f989[1].exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[WARNING] The file could not be deleted!
C:\Program Files\BitComet\Downloads\AntiVirus - Avast Profesional 4.7 + Serials [2008]\setupengpro.exe
[DETECTION] Is the Trojan horse TR/Buzus.pf
[INFO] The file was deleted!
C:\QooBox\Quarantine\C\Documents and Settings\Florent\cqqtoa.exe.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP82\A0029457.exe
[DETECTION] Contains detection pattern of the dropper DR/FraudTool.IeDefender.CE.1
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP82\A0029463.exe
[DETECTION] Contains detection pattern of the dropper DR/FraudTool.IeDefender.CE.1
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP82\A0029465.exe
[DETECTION] Contains detection pattern of the dropper DR/Tool.Reboot.F.71
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP82\A0029466.com
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP83\A0029550.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP84\A0030258.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP84\A0030260.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP84\A0030261.exe
[DETECTION] Is the Trojan horse TR/Drop.VB.SE
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP84\A0030266.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was deleted!
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP85\A0030270.exe
[DETECTION] Is the Trojan horse TR/Buzus.pf
[INFO] The file was deleted!
C:\WINDOWS\system32\huxncj.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was deleted!
C:\WINDOWS\system32\kernel32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ntdll.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ntkrnlpa.exe
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ntoskrnl.exe
[WARNING] The file could not be opened!
C:\WINDOWS\system32\user32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\win32k.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\ndisrd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\OADriver.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\OAmon.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!


End of the scan: jeudi 27 mars 2008 19:21
Used time: 1:00:54 min

The scan has been done completely.

11605 Scanning directories
447818 Files were scanned
15 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
14 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
13 Files cannot be scanned
447803 Files not concerned
2978 Archives were scanned
14 Warnings
0 Notes
78818 Objects were scanned with rootkit scan
0 Hidden objects were found
0
Réponse 8 / 12
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
27 mars 2008 à 20:43
ok

evite les cracks !

passe encore ceci :

Fais un scan avec cet antispyware :

Telecharge malwarebytes

-> http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/anti-malware-sujet_197382_1.htm

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

@+
0
Réponse 9 / 12
hotaru24
27 mars 2008 à 21:44
re
voila :

Malwarebytes' Anti-Malware 1.09
Version de la base de données: 556

Type de recherche: Examen complet (A:\|C:\|)
Eléments examinés: 207420
Temps écoulé: 46 minute(s), 1 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\FilesSecure (Rogue.Files-Secure) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Files Secure (Rogue.Files-Secure) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runner1 (Trojan.Downloader) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Files-Secure (Rogue.Files-Secure) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP28\A0005335.dll (Worm.Voterai) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{83661998-27F8-4CD3-A875-C4EE3EEDB4AE}\RP29\A0007249.dll (Worm.Voterai) -> Quarantined and deleted successfully.
C:\Program Files\Files-Secure\secure.exe (Rogue.Files-Secure) -> Quarantined and deleted successfully.
0
Réponse 10 / 12
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
28 mars 2008 à 05:45
Hotarus,

Télécharge Clean:

-> http://www.malekal.com/download/clean.zip

-> Dézippe tout le contenu dans un dossier que tu auras cré au préalable (sur ton bureau par exemple). Double clic sur clean ou clean.cmd choisie l'option 1.

Un rapport va s'ouvrir, copie et colle le contenu sur le forum.

-> pour ceux ou celles qui auraient un doute sur comment deziper un fichier :

http://www.tutopat.com/viewtopic.php?t=933&sid=34215b238376bfb22ef9e8eca9995914

precise tes soucis.

@+
0
Réponse 11 / 12
hotaru24
29 mars 2008 à 10:30
29/03/2008 a 10:29:18,50

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !
0
Réponse 12 / 12
g!rly Messages postés 18209 Date d'inscription vendredi 17 août 2007 Statut Contributeur Dernière intervention 30 novembre 2014 406
30 mars 2008 à 18:26
Salut hotaru24,

performe ce scan en ligne :

Fais un scan en ligne Kaspersky avec Internet Explorer :
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
-> Click sur Démarrer Online-Scanner
-> Click maintenant sur J'accepte.
-> Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
-> Patiente pendant l'installation des Mises à jour.
-> Choisis par la suite l'analyse du Poste de travail.
-> Sauvegarde puis colle le rapport généré en fin d'analyse.

@+
0

Discussions similaires

Comment supprimer le virus Trojan
vitsou -
vitsou -

18 réponses
Aide pour un virus
cerise92700 -
MisteryBean -

41 réponses
Trojan impossible à supprimer!
Gridouu -
Malekal_morte- -

12 réponses
Virus : trojan:win32/wacatac.h!ml
Alky09 -
bazfile -

8 réponses
Comment éliminer manuellement virus trojan?
ballag -
RClog -

12 réponses