Packed.win32.monder.gen
Résolu
chi
-
chi -
chi -
Bonjour,
j'ai un PC windows XP professionnal.
Mon anti virus, firewall a detecte un virus que j arrive pas a` nettoyer, packed.win32.monder.gen, sur C:\WINDOWS\SYSTEM32\AURNARPK.DLL
Aidez moi svp.
j'ai un PC windows XP professionnal.
Mon anti virus, firewall a detecte un virus que j arrive pas a` nettoyer, packed.win32.monder.gen, sur C:\WINDOWS\SYSTEM32\AURNARPK.DLL
Aidez moi svp.
Configuration: Windows XP professionnal centrino firewall 2007
25 réponses
- 1
- 2
Suivant
Résumé de la discussion
Problème central : un PC sous Windows XP Professionnel est infecté par packed.win32.monder.gen, détecté dans C:\WINDOWS\SYSTEM32\AURNARPK.DLL, et les tentatives de nettoyage échouent selon les échanges rapportés. Des éléments de réponse préconisent d’analyser le système avec HijackThis pour repérer les entrées suspectes, puis d’utiliser ComboFix via un fichier CFScript afin de nettoyer l’infection et de générer un rapport sur C:\Combofix.txt. En pratique, ces étapes nécessitent de démarrer en mode sans échec et de suivre l’invite pour exécuter le scan, puis de poster le rapport Combofix.txt. Des échanges ultérieurs indiquent des difficultés pour accéder à certains liens et la nécessité d'adapter les conseils à la configuration XP et à des outils tiers.
-
j'ai essayer une solution sur le forum m'indiquant qu'il faut passer par OTMoveit2, et ça marche pas.
Merci -
Salut
je déplace ton poste dans le forum virus/sécurité !
Télécharge ceci :
Lien : http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis
Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm
Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.
++
-
Merci green day.
Voici le rapport de hijack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:38:16, on 10/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AD59A389-0BC2-42B5-8E94-96BFC9F502D5} - C:\WINDOWS\system32\gebyv.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: {d3241206-a12d-2a99-8c14-2217c7fbc01c} - {c10cbf7c-7122-41c8-99a2-d21a6021423d} - C:\WINDOWS\system32\rmdljhnn.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [38c00411] rundll32.exe "C:\WINDOWS\system32\eunbquxw.dll",b
O4 - HKLM\..\Run: [zzz_ImInstaller_IncrediMail] C:\Documents and Settings\DORRA\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe -startup -product IncrediMail
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [BM3bf3378d] Rundll32.exe "C:\WINDOWS\system32\wxwabpgm.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: gebyv - C:\WINDOWS\system32\gebyv.dll (file missing)
O20 - Winlogon Notify: ljjgged - ljjgged.dll (file missing)
O20 - Winlogon Notify: vtuusqq - vtuusqq.dll (file missing)
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
-
-
ok,
Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
* Démarrer en mode sans echec
* Double cliquer combofix.exe.
* Appuyer sur la touche Y (Yes) pour démarrer le scan
* Le rapport sera crée dans: C:\Combofix.txt, poste le stp
++-
Ci-joint le rapport de Combofix
ComboFix 08-04-09.9 - DORRA 2008-04-10 18:50:48.1 - NTFSx86
Running from: C:\Documents and Settings\DORRA\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006
C:\Documents and Settings\DORRA\Application Data\HbTools
C:\Documents and Settings\DORRA\Application Data\HbTools\HbTools.log
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\dynamic\1.sdf
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\dynamic\TooltipXML\281430
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\dynamic\TooltipXML\346705
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\dynamic\TooltipXML\36735
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\dynamic\TooltipXML\41886
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\dynamic\TooltipXML\541324
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\dynamic\TooltipXML\79721
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\dynamic\ustat\35d2.dat
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\ads.cdf
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\btntrans.idx
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\btntrans1.dat
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\business_promo.htm
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\buttondir.txt
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\components.cdf
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\cursors.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\d_icons_buttons_1000.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\d_icons_buttons_2000.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\d_icons_buttons_3000.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\d_icons_buttons_bar.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\d_icons_buttons_bbar1.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\d_icons_buttons_logos.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\d_icons_buttons_other.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\d_icons_weather.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\default.cdf
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_511745-514279.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz1.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz10.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz11.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz12.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz13.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz14.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz15.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz16.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz17.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz18.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz19.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz2.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz20.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz3.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz4.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz5.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz6.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz7.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz8.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_bidz9.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_categorize.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_comparison.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_em_PROFL_CA_flow_b_IEB.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_explorer-Mails.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_explorer-people.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_favorites.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_Games.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_Hide.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_hotbarcom.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_Hotmail.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_hsskin.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_jemster.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_jemsterie.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_jemsteruk.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_jobsearch.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_Mails.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_new.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_premium.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_reun.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_ringtones.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_SearchBoxTrapper.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_searchfor.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_searchgo.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_weather.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Default_yellowpages.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\email-def-511724-548964.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\email-def-511724-9595.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\email-t1-bg.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\gamesmenu.cdf
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\gamesMenu.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\hb_ie_menu.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\hotbar-premium-hotbar-premium.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\hotbar-premium.cdf
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\hotbar_promo.htm
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\icons2.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\ie_games_icon.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\ie_video.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\keywords.idx
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\keywords1.dat
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\layout.cdf
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\linkpathlegal.txt
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\more.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\new_games.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\progress.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\s_icons_buttons.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\sales_buttons.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\t2_bg.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\theweb.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\top7.cdf
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\Top7_theweb.mnu
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\tsd_bg.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\1\weathericon.res
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\ads.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\BtnTrans.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\BtnTrans1.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\business_promo.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\buttondir.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\cursors.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\d_icons_buttons_1000.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\d_icons_buttons_2000.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\d_icons_buttons_3000.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\d_icons_buttons_bar.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\d_icons_buttons_bbar1.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\d_icons_buttons_logos.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\d_icons_buttons_other.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\d_icons_weather.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\default.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\email-t1-bg.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\gamesmenu.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\hb_ie_menu.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\hotbar-premium.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\hotbar_promo.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\icons2.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\ie_games_icon.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\ie_video.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\keywords.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\keywords1.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\layout.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\linkpathlegal.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\more.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\progress.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\s_icons_buttons.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\sales_buttons.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\samplegroups2.txt
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\samplegroups2.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\t2_bg.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\top7.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\tsd_bg.xip
C:\Documents and Settings\DORRA\Application Data\HbTools\v3.0\hbtools\static\DownLoad\weathericon.xip
C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\log.txt
C:\Program Files\Common Files\companion wizard\WapCHK.dll
C:\Program Files\Common Files\companion wizard\WapCHK{6C67D7B8-A7F8-44E1-9ACB-F49681ACD179}.dll
C:\WA6P
C:\WINDOWS\BM3bf3378d.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pack.epk
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\adrctjpn.dll
C:\WINDOWS\system32\awjaxbln.ini
C:\WINDOWS\system32\bsqqaate.dll
C:\WINDOWS\system32\bxmcengq.dll
C:\WINDOWS\system32\ciwvpdp.dat
c:\windows\system32\ciwvpdp.exe
C:\WINDOWS\system32\ciwvpdp_nav.dat
c:\WINDOWS\system32\ciwvpdp_navps.dat
C:\WINDOWS\system32\ctxvjkum.ini
C:\WINDOWS\system32\eunbquxw.dll
C:\WINDOWS\system32\eynwnpew.ini
C:\WINDOWS\system32\ffeobmys.dll
C:\WINDOWS\system32\fqbafoio.dll
C:\WINDOWS\system32\gxfkgrbj.ini
C:\WINDOWS\system32\gyogfmgs.dll
C:\WINDOWS\system32\hogekxdx.dll
C:\WINDOWS\system32\hrvtycmf_navtmp.dat
C:\WINDOWS\system32\ipfasbim.dll
C:\WINDOWS\system32\irciefsn.ini
C:\WINDOWS\system32\iydjdncp.ini
C:\WINDOWS\system32\jsfttncj.ini
C:\WINDOWS\system32\krqiedml.ini
C:\WINDOWS\system32\lerrjmfa.ini
C:\WINDOWS\system32\lilvwonx.ini
C:\WINDOWS\system32\mceevptu.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\myibarsv.dll
C:\WINDOWS\system32\npjtcrda.ini
C:\WINDOWS\system32\nqpdkmqc.dll
C:\WINDOWS\system32\nsfeicri.dll
C:\WINDOWS\system32\nvbgaljm.dll
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\oiofabqf.ini
C:\WINDOWS\system32\olrhdrum.dll
C:\WINDOWS\system32\pcndjdyi.dll
C:\WINDOWS\system32\pprrtqgk.dll
C:\WINDOWS\system32\qavphvit.ini
C:\WINDOWS\system32\qkiavssm.ini
C:\WINDOWS\system32\rmdljhnn.dll
C:\WINDOWS\system32\rvtekcij.ini
C:\WINDOWS\system32\sgmfgoyg.ini
C:\WINDOWS\system32\stera.job
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\svjxrdfu.ini
C:\WINDOWS\system32\tmsvulhj.dll
C:\WINDOWS\system32\txcgwrxh.dll
C:\WINDOWS\system32\ufdrxjvs.dll
C:\WINDOWS\system32\uqhxhsjb.dll
C:\WINDOWS\system32\utoocmxi.dll
C:\WINDOWS\system32\utpveecm.dll
C:\WINDOWS\system32\vdudwsaj.dll
C:\WINDOWS\system32\vdujdmjp.ini
C:\WINDOWS\system32\vgrwykye.ini
C:\WINDOWS\system32\vybeg.bak1
C:\WINDOWS\system32\vybeg.bak2
C:\WINDOWS\system32\vybeg.ini
C:\WINDOWS\system32\vybeg.ini2
C:\WINDOWS\system32\vybeg.tmp
C:\WINDOWS\system32\wrtfhjrk.dll
C:\WINDOWS\system32\wxuqbnue.ini
C:\WINDOWS\system32\wxwabpgm.dll
C:\WINDOWS\system32\xnowvlil.dll
C:\WINDOWS\system32\yivpuomk.ini
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_FOPN
-------\Legacy_VSPF
-------\Legacy_VSPF_HK
((((((((((((((((((((((((( Files Created from 2008-03-10 to 2008-04-10 )))))))))))))))))))))))))))))))
.
2008-04-10 18:36 . 2008-04-10 18:36 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 17:57 . 2008-04-10 17:57 <DIR> d-------- C:\_OTMoveIt
2008-04-09 19:23 . 2005-11-18 17:04 70,896 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-04-09 19:23 . 2005-11-18 17:04 33,584 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-04-09 19:22 . 2008-04-09 19:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-04-09 19:17 . 2008-04-09 19:17 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.123-6588780L.exe
2008-04-09 18:53 . 2005-12-29 21:40 49,262 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-04-09 14:08 . 2008-04-09 14:15 90,688 --a------ C:\WINDOWS\system32\EUNBQUXW.DLL.$DIS
2008-04-09 13:09 . 2008-04-10 15:42 1,917 --a------ C:\WINDOWS\imsins.BAK
2008-04-07 10:40 . 2008-04-07 10:40 29,457 --a------ C:\WINDOWS\system32\cjhjcergac.exe
2008-03-31 08:26 . 2008-03-31 08:26 29,457 --a------ C:\WINDOWS\system32\txmhjojbi.exe
2008-03-27 20:56 . 2008-03-27 20:56 29,458 --a------ C:\WINDOWS\system32\isdgta.exe
2008-03-19 20:39 . 2008-03-25 20:56 29,531 --a------ C:\WINDOWS\system32\bbhetmsz.exe
2008-03-17 20:52 . 2008-03-17 20:52 29,017 --a------ C:\WINDOWS\system32\dckzfyedl.exe
2008-03-12 18:46 . 2008-03-12 18:46 28,528 --a------ C:\WINDOWS\system32\fxnath.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 17:06 --------- d-----w C:\Program Files\Wanadoo
2008-04-09 20:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-04-09 17:22 --------- d-----w C:\Program Files\AntivirusFirewall
2008-04-09 16:54 --------- d-----w C:\Program Files\Java
2008-04-09 16:52 --------- d-----w C:\Program Files\IncrediMail
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-09 11:55 29,506 ----a-w C:\WINDOWS\system32\tpxhuba.exe
2008-03-09 11:54 91,200 ------w C:\WINDOWS\system32\quuxcxub.dll
2008-03-09 11:51 89,664 ------w C:\WINDOWS\system32\dkfuypyk.dll
2008-03-07 11:01 96,832 ------w C:\WINDOWS\system32\upvpmgrs.dll
2008-03-07 11:00 94,272 ------w C:\WINDOWS\system32\ytxxwigu.dll
2008-03-05 16:07 28,529 ----a-w C:\WINDOWS\system32\vrloeuz.exe
2008-03-05 14:45 91,712 ------w C:\WINDOWS\system32\cartskrq.dll
2008-03-04 17:21 96,832 ------w C:\WINDOWS\system32\sohtkodg.dll
2008-03-04 17:20 91,712 ------w C:\WINDOWS\system32\xwvybkee.dll
2008-03-04 16:44 97,344 ------w C:\WINDOWS\system32\raslddqg.dll
2008-03-04 16:42 91,712 ------w C:\WINDOWS\system32\bxvgnbqu.dll
2008-03-03 21:43 95,296 ------w C:\WINDOWS\system32\oungwwhl.dll
2008-03-03 21:42 91,712 ------w C:\WINDOWS\system32\svhvydkj.dll
2008-03-03 11:51 29,506 ----a-w C:\WINDOWS\system32\isdtvibixa.exe
2008-03-03 11:45 91,712 ------w C:\WINDOWS\system32\silbviee.dll
2008-03-03 10:07 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-03 09:50 91,712 ------w C:\WINDOWS\system32\bbstyljw.dll
2008-03-02 19:11 --------- d-----w C:\Program Files\DivX
2008-03-02 10:45 89,664 ------w C:\WINDOWS\system32\psllkhhx.dll
2008-03-02 10:45 1,286,021 --sh--w C:\WINDOWS\system32\qkiavssm.tmp
2008-03-02 10:40 91,712 ----a-w C:\WINDOWS\system32\acvmgpum.dll
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-29 12:13 88,640 ------w C:\WINDOWS\system32\niawyiio.dll
2008-02-29 12:10 91,712 ------w C:\WINDOWS\system32\dwlgxjha.dll
2008-02-28 13:27 89,664 ------w C:\WINDOWS\system32\nscodppy.dll
2008-02-28 13:25 91,712 ------w C:\WINDOWS\system32\bmegkowp.dll
2008-02-27 15:53 91,712 ------w C:\WINDOWS\system32\gggxuvkw.dll
2008-02-26 10:35 89,152 ------w C:\WINDOWS\system32\hppqdqsx.dll
2008-02-23 11:45 89,152 ------w C:\WINDOWS\system32\sttqysuh.dll
2008-02-22 15:04 89,664 ------w C:\WINDOWS\system32\nlbxajwa.dll
2008-02-22 15:02 91,712 ------w C:\WINDOWS\system32\wtucqneu.dll
2008-02-21 12:49 93,760 ------w C:\WINDOWS\system32\sfoxjtwk.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-19 12:00 89,152 ----a-w C:\WINDOWS\system32\avekvxqx.dll
2008-02-15 11:07 89,664 ----a-w C:\WINDOWS\system32\aehaykij.dll
2008-02-15 11:06 94,272 ------w C:\WINDOWS\system32\xpjdtjks.dll
2008-01-21 18:44 65,024 ----a-w C:\WINDOWS\IFinst26.exe
2006-10-21 19:01 88,280 ----a-w C:\Documents and Settings\DORRA\Application Data\winantiviruspro2006freeinstall[1].exe
2007-09-27 13:24 14,648 --sh--w C:\WINDOWS\system32\opqss.bak1
2007-09-27 13:24 6,487 --sh--w C:\WINDOWS\system32\opqss.bak2
2007-09-27 10:05 6,440 --sh--w C:\WINDOWS\system32\ttvwa.bak1
.
------- Sigcheck -------
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\dllcache\svchost.exe
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD59A389-0BC2-42B5-8E94-96BFC9F502D5}]
C:\WINDOWS\system32\gebyv.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 14:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 20:40 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 20:38 688218]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-22 20:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-22 20:31 126976]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-11-05 14:52 233534]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-29 21:20 98304]
"hpWirelessAssistant"="C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-01-21 14:40 790528]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CAMTRAY.EXE" [ ]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-14 00:21 185632]
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 17:32 126976]
"MAAgent"="C:\Program Files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 21:36 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"zzz_ImInstaller_IncrediMail"="C:\Documents and Settings\DORRA\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe" [2008-04-09 13:21 525664]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2005-12-29 21:40 36972]
"F-Secure Manager"="C:\Program Files\AntivirusFirewall\Common\FSM32.exe" [2005-10-26 03:51 122929]
"F-Secure TNB"="C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" [2005-07-18 16:51 700416]
"F-Secure Startup Wizard"="C:\Program Files\AntivirusFirewall\FSGUI\FSSW.exe" [2005-10-18 10:29 372736]
"News Service"="C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe" [2005-05-31 14:45 356352]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Antivirus Firewall.lnk - C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe [2008-04-09 19:18:47 32807]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-11-29 20:55:44 569405]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2005-12-30 10:46:16 106560]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyv]
C:\WINDOWS\system32\gebyv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjgged]
ljjgged.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtuusqq]
vtuusqq.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\BASTI\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\WINDOWS\\system32\\muzapp.exe"=
"C:\\Documents and Settings\\DORRA\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe"=
"C:\\Program Files\\AntivirusFirewall\\backweb\\6588780\\Program\\fspex.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 17:04]
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE [2008-04-09 19:18]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 17:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSgk.sys [2008-04-09 19:37]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2004-06-01 11:03]
S3 V0090VID;Creative WebCam Vista Plus;C:\WINDOWS\system32\DRIVERS\V0090Vid.sys [2005-04-14 03:00]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08514d12-c7df-11da-b33a-0010c6c39849}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ba45c92-a6d1-11da-b318-00c09fc21f14}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d726c628-7efc-11db-b414-0010c6c39849}]
\Shell\AutoRun\command - reper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-04-10 08:41:15 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\ANTIVI~1\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ANTIVI~1\ANTI-V~1\report.txt
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 19:05:17
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????3?1?1?6??@???? ?,?B?????????????hLC? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\WINDOWS\system32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\WINDOWS\system32\snmp.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSRW.exe
C:\Program Files\Wanadoo\TaskBarIcon.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSAV32.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\AntivirusFirewall\FWES\program\fsdfwd.exe
C:\WINDOWS\system32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\FSAW.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
.
**************************************************************************
.
Completion time: 2008-04-10 19:11:03 - machine was rebooted [DORRA]
ComboFix-quarantined-files.txt 2008-04-10 17:10:00
Pre-Run: 26,009,968,640 bytes free
Post-Run: 25,914,769,408 bytes free
.
2008-04-09 11:23:26 --- E O F ---
-
-
très bien !
# Télécharger Vundofix.exe (par Atribune) sur votre Bureau : http://www.atribune.org/ccount/click.php?id=4
* Double-cliquer sur VundoFix.exe afin de le lancer.
* Cliquer sur le bouton Scan for Vundo.
* Lorsque le scan est complété, cliquer sur le bouton Fix Vundo.
* Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES
* Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers. * Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.
* Le contenu du rapport est situé dans C:\vundofix.txt, poste le stp
++ -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
ok,
1/ # Télécharge RavAntivirus d'Evosla :
http://ww25.evosla.com/compteur.php?soft=rav_antivirus
# Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX
# Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau
# Doucle-clique sur >> RAV.exe << afin de lancer l'outil.
# Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles)
# Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain .
# Retire tes disques amovibles et redémarrez votre ordinateur.
# Poste le rapport, si infection!
2/ Télécharge sur le bureau Flash Disinfector (de SUBS) à cette adresse : http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
Double-clique sur l’icône.
Les icônes vont disparaître. C’est normal.
Si un rapport est généré en cas d'infection, sauvegarde-le sur le bureau, et poste le ensuite
Redémarre ensuite le PC.
++ -
ok,
Télécharge SDFix sur ton bureau
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
Redémarre ton ordinateur en mode sans échec
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !
++ -
-
desole ca a pris beaucoup de temps. voici le rapport
[b]SDFix: Version 1.168 [/b]
Run by DORRA on 10/04/2008 at 22:24
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\DORRA\Desktop\SDFix
[b]Checking Services [/b]:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\DOCUME~1\DORRA\APPLIC~1\WINANT~1.EXE - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 22:34:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"DhcpNameServer"="84.103.237.141 86.64.145.141"
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000047
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 276
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\BASTI\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\BASTI\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\WINDOWS\\system32\\muzapp.exe"="C:\\WINDOWS\\system32\\muzapp.exe:*:Enabled:MUZ AOD APP player"
"C:\\Documents and Settings\\DORRA\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe"="C:\\Documents and Settings\\DORRA\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe:*:Enabled:IncrediMail Installer"
"C:\\Program Files\\AntivirusFirewall\\backweb\\6588780\\Program\\fspex.exe"="C:\\Program Files\\AntivirusFirewall\\backweb\\6588780\\Program\\fspex.exe:*:Enabled:Antivirus Firewall"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\AntivirusFirewall\\backweb\\6588780\\Program\\fspex.exe"="C:\\Program Files\\AntivirusFirewall\\backweb\\6588780\\Program\\fspex.exe:*:Enabled:Antivirus Firewall"
[b]Remaining Files [/b]:
File Backups: - C:\DOCUME~1\DORRA\Desktop\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Tue 27 Nov 2007 4,434 ..SH. --- "C:\WINDOWS\system32\cwdlsqmg.tmp"
Thu 27 Sep 2007 14,648 ..SH. --- "C:\WINDOWS\system32\opqss.bak1"
Thu 27 Sep 2007 6,487 ..SH. --- "C:\WINDOWS\system32\opqss.bak2"
Sun 2 Mar 2008 1,286,021 ..SH. --- "C:\WINDOWS\system32\qkiavssm.tmp"
Thu 27 Sep 2007 6,440 ..SH. --- "C:\WINDOWS\system32\ttvwa.bak1"
Sat 22 Apr 2006 598,016 ...H. --- "C:\Documents and Settings\DORRA\Desktop\~WRL1603.tmp"
Fri 8 Dec 2006 22,528 ...H. --- "C:\Documents and Settings\DORRA\My Documents\~WRL0004.tmp"
Wed 1 Aug 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 19 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\778fd2fc3fe6b905e366b5ddbba384c8\BIT6.tmp"
Wed 16 Nov 2005 63,488 A..H. --- "C:\BASTI\Documents and Settings\dora\Bureau\memoire\~WRL0004.tmp"
Mon 21 Nov 2005 63,488 A..H. --- "C:\BASTI\Documents and Settings\dora\Bureau\memoire\~WRL0095.tmp"
Mon 21 Nov 2005 64,000 A..H. --- "C:\BASTI\Documents and Settings\dora\Bureau\memoire\~WRL2938.tmp"
Mon 21 Nov 2005 62,976 A..H. --- "C:\BASTI\Documents and Settings\dora\Bureau\memoire\~WRL3639.tmp"
Thu 14 Dec 2006 65,024 A..H. --- "C:\Documents and Settings\DORRA\My Documents\dorra\cours 1\Eco\~WRL2535.tmp"
Tue 11 Dec 2007 487,424 A.SH. --- "C:\Documents and Settings\DORRA\My Documents\My Pictures\pictures\dorra\enfants de dorra\SIV3D.tmp"
[b]Finished![/b] -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:50:12, on 10/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AD59A389-0BC2-42B5-8E94-96BFC9F502D5} - C:\WINDOWS\system32\gebyv.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zzz_ImInstaller_IncrediMail] C:\Documents and Settings\DORRA\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe -startup -product IncrediMail
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: gebyv - C:\WINDOWS\system32\gebyv.dll (file missing)
O20 - Winlogon Notify: ljjgged - ljjgged.dll (file missing)
O20 - Winlogon Notify: vtuusqq - vtuusqq.dll (file missing)
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\shared\hpqwmi.exe
-
-
ok, pas de soucis ! ;-)
poste un nouveau combo stp
++-
ComboFix 08-04-09.9 - DORRA 2008-04-10 22:54:51.2 - NTFSx86
Running from: C:\Documents and Settings\DORRA\Desktop\ComboFix.exe
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\DORRA\err.log
.
((((((((((((((((((((((((( Files Created from 2008-03-10 to 2008-04-10 )))))))))))))))))))))))))))))))
.
2008-04-10 22:20 . 2008-04-10 22:21 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 21:02 . 2008-04-10 21:03 1,416,084 --a------ C:\SDFix.exe
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\VundoFix Backups
2008-04-10 18:36 . 2008-04-10 18:36 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 17:57 . 2008-04-10 17:57 <DIR> d-------- C:\_OTMoveIt
2008-04-09 19:23 . 2005-11-18 17:04 70,896 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-04-09 19:23 . 2005-11-18 17:04 33,584 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-04-09 19:22 . 2008-04-09 19:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-04-09 19:17 . 2008-04-09 19:17 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.123-6588780L.exe
2008-04-09 18:53 . 2005-12-29 21:40 49,262 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-04-09 14:08 . 2008-04-09 14:15 90,688 --a------ C:\WINDOWS\system32\EUNBQUXW.DLL.$DIS
2008-04-09 13:09 . 2008-04-10 15:42 1,917 --a------ C:\WINDOWS\imsins.BAK
2008-04-07 10:40 . 2008-04-07 10:40 29,457 --a------ C:\WINDOWS\system32\cjhjcergac.exe
2008-03-31 08:26 . 2008-03-31 08:26 29,457 --a------ C:\WINDOWS\system32\txmhjojbi.exe
2008-03-27 20:56 . 2008-03-27 20:56 29,458 --a------ C:\WINDOWS\system32\isdgta.exe
2008-03-19 20:39 . 2008-03-25 20:56 29,531 --a------ C:\WINDOWS\system32\bbhetmsz.exe
2008-03-17 20:52 . 2008-03-17 20:52 29,017 --a------ C:\WINDOWS\system32\dckzfyedl.exe
2008-03-12 18:46 . 2008-03-12 18:46 28,528 --a------ C:\WINDOWS\system32\fxnath.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 20:44 --------- d-----w C:\Program Files\Wanadoo
2008-04-09 20:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-04-09 17:22 --------- d-----w C:\Program Files\AntivirusFirewall
2008-04-09 16:54 --------- d-----w C:\Program Files\Java
2008-04-09 16:52 --------- d-----w C:\Program Files\IncrediMail
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-09 11:55 29,506 ----a-w C:\WINDOWS\system32\tpxhuba.exe
2008-03-09 11:54 91,200 ------w C:\WINDOWS\system32\quuxcxub.dll
2008-03-09 11:51 89,664 ------w C:\WINDOWS\system32\dkfuypyk.dll
2008-03-07 11:01 96,832 ------w C:\WINDOWS\system32\upvpmgrs.dll
2008-03-07 11:00 94,272 ------w C:\WINDOWS\system32\ytxxwigu.dll
2008-03-05 16:07 28,529 ----a-w C:\WINDOWS\system32\vrloeuz.exe
2008-03-05 14:45 91,712 ------w C:\WINDOWS\system32\cartskrq.dll
2008-03-04 17:21 96,832 ------w C:\WINDOWS\system32\sohtkodg.dll
2008-03-04 17:20 91,712 ------w C:\WINDOWS\system32\xwvybkee.dll
2008-03-04 16:44 97,344 ------w C:\WINDOWS\system32\raslddqg.dll
2008-03-04 16:42 91,712 ------w C:\WINDOWS\system32\bxvgnbqu.dll
2008-03-03 21:43 95,296 ------w C:\WINDOWS\system32\oungwwhl.dll
2008-03-03 21:42 91,712 ------w C:\WINDOWS\system32\svhvydkj.dll
2008-03-03 11:51 29,506 ----a-w C:\WINDOWS\system32\isdtvibixa.exe
2008-03-03 11:45 91,712 ------w C:\WINDOWS\system32\silbviee.dll
2008-03-03 10:07 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-03 09:50 91,712 ------w C:\WINDOWS\system32\bbstyljw.dll
2008-03-02 19:11 --------- d-----w C:\Program Files\DivX
2008-03-02 10:45 89,664 ------w C:\WINDOWS\system32\psllkhhx.dll
2008-03-02 10:45 1,286,021 --sh--w C:\WINDOWS\system32\qkiavssm.tmp
2008-03-02 10:40 91,712 ----a-w C:\WINDOWS\system32\acvmgpum.dll
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-29 12:13 88,640 ------w C:\WINDOWS\system32\niawyiio.dll
2008-02-29 12:10 91,712 ------w C:\WINDOWS\system32\dwlgxjha.dll
2008-02-28 13:27 89,664 ------w C:\WINDOWS\system32\nscodppy.dll
2008-02-28 13:25 91,712 ------w C:\WINDOWS\system32\bmegkowp.dll
2008-02-27 15:53 91,712 ------w C:\WINDOWS\system32\gggxuvkw.dll
2008-02-26 10:35 89,152 ------w C:\WINDOWS\system32\hppqdqsx.dll
2008-02-23 11:45 89,152 ------w C:\WINDOWS\system32\sttqysuh.dll
2008-02-22 15:04 89,664 ------w C:\WINDOWS\system32\nlbxajwa.dll
2008-02-22 15:02 91,712 ------w C:\WINDOWS\system32\wtucqneu.dll
2008-02-21 12:49 93,760 ------w C:\WINDOWS\system32\sfoxjtwk.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-19 12:00 89,152 ----a-w C:\WINDOWS\system32\avekvxqx.dll
2008-02-15 11:07 89,664 ----a-w C:\WINDOWS\system32\aehaykij.dll
2008-02-15 11:06 94,272 ------w C:\WINDOWS\system32\xpjdtjks.dll
2008-01-21 18:44 65,024 ----a-w C:\WINDOWS\IFinst26.exe
2007-09-27 13:24 14,648 --sh--w C:\WINDOWS\system32\opqss.bak1
2007-09-27 13:24 6,487 --sh--w C:\WINDOWS\system32\opqss.bak2
2007-09-27 10:05 6,440 --sh--w C:\WINDOWS\system32\ttvwa.bak1
.
------- Sigcheck -------
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\dllcache\svchost.exe
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((( snapshot@2008-04-10_19.09.37.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-09 08:45:49 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-04-10 20:21:21 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-04-10 20:21:21 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-09 08:45:49 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-04-10 20:21:02 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-04-10 20:21:02 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-04-10 17:03:49 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-10 21:00:46 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-10 20:33:05 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_554.dat
+ 2008-04-10 20:34:33 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_660.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD59A389-0BC2-42B5-8E94-96BFC9F502D5}]
C:\WINDOWS\system32\gebyv.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 14:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 20:40 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 20:38 688218]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-22 20:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-22 20:31 126976]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-11-05 14:52 233534]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-29 21:20 98304]
"hpWirelessAssistant"="C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-01-21 14:40 790528]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CAMTRAY.EXE" [ ]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-14 00:21 185632]
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 17:32 126976]
"MAAgent"="C:\Program Files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 21:36 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"zzz_ImInstaller_IncrediMail"="C:\Documents and Settings\DORRA\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2005-12-29 21:40 36972]
"F-Secure Manager"="C:\Program Files\AntivirusFirewall\Common\FSM32.exe" [2005-10-26 03:51 122929]
"F-Secure TNB"="C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" [2005-07-18 16:51 700416]
"F-Secure Startup Wizard"="C:\Program Files\AntivirusFirewall\FSGUI\FSSW.exe" [2005-10-18 10:29 372736]
"News Service"="C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe" [2005-05-31 14:45 356352]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Antivirus Firewall.lnk - C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe [2008-04-09 19:18:47 32807]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-11-29 20:55:44 569405]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2005-12-30 10:46:16 106560]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyv]
C:\WINDOWS\system32\gebyv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjgged]
ljjgged.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtuusqq]
vtuusqq.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\BASTI\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\WINDOWS\\system32\\muzapp.exe"=
"C:\\Program Files\\AntivirusFirewall\\backweb\\6588780\\Program\\fspex.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 17:04]
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE [2008-04-09 19:18]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 17:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSgk.sys [2008-04-09 19:37]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2004-06-01 11:03]
S3 V0090VID;Creative WebCam Vista Plus;C:\WINDOWS\system32\DRIVERS\V0090Vid.sys [2005-04-14 03:00]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08514d12-c7df-11da-b33a-0010c6c39849}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ba45c92-a6d1-11da-b318-00c09fc21f14}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d726c628-7efc-11db-b414-0010c6c39849}]
\Shell\AutoRun\command - reper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-04-10 08:41:15 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\ANTIVI~1\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ANTIVI~1\ANTI-V~1\report.txt
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 23:01:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????3?1?1?6??????? ?,?B?????????????hLC? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-10 23:05:53
ComboFix-quarantined-files.txt 2008-04-10 21:05:34
ComboFix2.txt 2008-04-10 17:11:04
Pre-Run: 26,169,253,888 bytes free
Post-Run: 26,157,211,648 bytes free
.
2008-04-09 11:23:26 --- E O F ---
-
-
ok, beaucoup de saletés encore ...
télécharge ceci :https://www.commentcamarche.net/telecharger/ 34055379 malwarebyte s anti malware
* Installez le programme sur le bureau :
o S'il manque le fichier COMCTL32.OCX, vous pourrez le télécharger ici
* Faites les mises à jour (clic sur Mises à jour puis Recherche de mises à jour)
* Démarrez en mode sans échec
* Lancez le MalwareByte's Anti-Malware, cliquez sur Exécuter un examen complet puis Rechercher et sélectionnez tous tes disques durs
* Une fois le scan terminé, cliquez sur supprimer (si un message demande à redémarrer le PC, acceptez !)
* Un rapport sera généré, enregistrez le de manière à le retrouver
==> poste le stp !
++
-
-
la page que vous m avez indiquer ne se trouve plus sur le site. (https://www.commentcamarche.net/telecharger/
Merci de vouloir m aider. -
-
-
Salut
oups, désolée pour le lien cassé ! :/
http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
@+
;-)-
salut green,
merci de continuer a m'aider.
l'analyse a été longue.
je ne sais pas si vous êtes dispo maintenant. j attendrai un peu sinon, si j ai bien compris vous êtes sur le forum plutôt a partir de 18h00. Si vous ne me répondez pas maintenant, on continuera la discussion demain, si vous le souhaitez.
merci
voici le rapport
Malwarebytes' Anti-Malware 1.11
Version de la base de données: 633
Type de recherche: Examen complet (C:\|)
Eléments examinés: 143886
Temps écoulé: 2 hour(s), 39 minute(s), 50 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> No action taken.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\system32\aehaykij.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\jikyahea.ini (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{2C1CC1AC-4BAE-4496-A88D-862B5934011E}\RP381\A0097223.exe (Rogue.Spyware-Secure) -> No action taken.
-
-
Salut
je ne laisse tomber personne ! ;-))
c'est juste que je ne suis pas dispo la journée ! mais en début de soirée oui ! je suis étudiante ! :)
et tu peux me tutoyer !
est-ce que tu as supprimé tout ce que Malwarebytes' Anti-Malware a trouvé ??
@+
-
ok, c'est pas encore fini, mais il faudrait que tu me dise où est-ce qu'il te le détecte, dans quel fichier ?
++-
- Nom de l'ordinateur : BASTI
Type d'analyse : Rechercher des virus sur la cible
Cible : C:\WINDOWS\system32
Résultat : 28 antiprogramme(s) détecté(s)
Packed.Win32.Monder.gen (virus)
* C:\WINDOWS\system32\acvmgpum.dll
* C:\WINDOWS\system32\avekvxqx.dll
* C:\WINDOWS\system32\bbstyljw.dll
* C:\WINDOWS\system32\bmegkowp.dll
* C:\WINDOWS\system32\bxvgnbqu.dll
* C:\WINDOWS\system32\cartskrq.dll
* C:\WINDOWS\system32\dkfuypyk.dll
* C:\WINDOWS\system32\dwlgxjha.dll
* C:\WINDOWS\system32\gggxuvkw.dll
* C:\WINDOWS\system32\hppqdqsx.dll
* C:\WINDOWS\system32\jsutrmlh.dll
* C:\WINDOWS\system32\niawyiio.dll
* C:\WINDOWS\system32\nlbxajwa.dll
* C:\WINDOWS\system32\nscodppy.dll
* C:\WINDOWS\system32\oungwwhl.dll
* C:\WINDOWS\system32\psllkhhx.dll
* C:\WINDOWS\system32\quuxcxub.dll
* C:\WINDOWS\system32\raslddqg.dll
* C:\WINDOWS\system32\sfoxjtwk.dll
* C:\WINDOWS\system32\silbviee.dll
* C:\WINDOWS\system32\sohtkodg.dll
* C:\WINDOWS\system32\sttqysuh.dll
* C:\WINDOWS\system32\svhvydkj.dll
* C:\WINDOWS\system32\upvpmgrs.dll
* C:\WINDOWS\system32\wtucqneu.dll
* C:\WINDOWS\system32\xpjdtjks.dll
* C:\WINDOWS\system32\xwvybkee.dll
* C:\WINDOWS\system32\ytxxwigu.dll
Statistiques
Analysés :
* Fichiers : 4826
* Registre système : 0
* Non analysés : 1
Résultat :
* Virus : 28
* Logiciel espion : 0
* Eléments suspects: 0
Actions :
* Désinfectés : 0
* Renommés : 0
* Supprimés : 0
* Quarantaine : 0
* Echec : 56
Secteurs d'amorçage :
* Analysés : 0
* Infectés : 0
* Eléments suspects: 0
* Désinfectés : 0
Fichiers non analysés :
* Erreur d'ouverture du fichier C:\WINDOWS\system32\config\default.
Options
Version des définitions :
* Virus : 2008-04-16_04
* Logiciel espion : 2008-04-07_07
Moteurs d'analyse :
* F-Secure AVP: 6.00.169, 2008-04-16
* F-Secure Libra: 2.04.04, 2008-04-15
* F-Secure Orion: 1.02.37, 2008-04-16
* F-Secure Draco: 1.00.35, 2008-04-02
Options d'analyse :
* Analyser les fichiers définis : COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
* Analyser le contenu des archives
Actions :
* Virus : Interroger l'utilisateur après l'analyse
* Logiciel espion : Interroger l'utilisateur après l'analyse
-
-
ok,
# Télécharger Vundofix.exe (par Atribune) sur votre Bureau : http://www.atribune.org/ccount/click.php?id=4
* Double-cliquer sur VundoFix.exe afin de le lancer.
* Cliquer sur le bouton Scan for Vundo.
* Lorsque le scan est complété, cliquer sur le bouton Fix Vundo.
* Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES
* Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers. * Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.
* Le contenu du rapport est situé dans C:\vundofix.txt, poste le stp
++ -
ah ! oui, c'est vrai qu'il n'avait rien trouvé ...
télécharge OTMoveIt (de Old_Timer) sur ton Bureau :
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
C:\WINDOWS\system32\acvmgpum.dll
C:\WINDOWS\system32\avekvxqx.dll
C:\WINDOWS\system32\bbstyljw.dll
C:\WINDOWS\system32\bmegkowp.dll
C:\WINDOWS\system32\bxvgnbqu.dll
C:\WINDOWS\system32\cartskrq.dll
C:\WINDOWS\system32\dkfuypyk.dll
C:\WINDOWS\system32\dwlgxjha.dll
C:\WINDOWS\system32\gggxuvkw.dll
C:\WINDOWS\system32\hppqdqsx.dll
C:\WINDOWS\system32\jsutrmlh.dll
C:\WINDOWS\system32\niawyiio.dll
C:\WINDOWS\system32\nlbxajwa.dll
C:\WINDOWS\system32\nscodppy.dll
C:\WINDOWS\system32\oungwwhl.dll
C:\WINDOWS\system32\psllkhhx.dll
C:\WINDOWS\system32\quuxcxub.dll
C:\WINDOWS\system32\raslddqg.dll
C:\WINDOWS\system32\sfoxjtwk.dll
C:\WINDOWS\system32\silbviee.dll
C:\WINDOWS\system32\sohtkodg.dll
C:\WINDOWS\system32\sttqysuh.dll
C:\WINDOWS\system32\svhvydkj.dll
C:\WINDOWS\system32\upvpmgrs.dll
C:\WINDOWS\system32\wtucqneu.dll
C:\WINDOWS\system32\xpjdtjks.dll
C:\WINDOWS\system32\xwvybkee.dll
C:\WINDOWS\system32\ytxxwigu.dll
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.
si c'est le cas accepte par Yes.
@+-
LoadLibrary failed for C:\WINDOWS\system32\acvmgpum.dll
C:\WINDOWS\system32\acvmgpum.dll NOT unregistered.
C:\WINDOWS\system32\acvmgpum.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\avekvxqx.dll
C:\WINDOWS\system32\avekvxqx.dll NOT unregistered.
C:\WINDOWS\system32\avekvxqx.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\bbstyljw.dll
C:\WINDOWS\system32\bbstyljw.dll NOT unregistered.
C:\WINDOWS\system32\bbstyljw.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\bmegkowp.dll
C:\WINDOWS\system32\bmegkowp.dll NOT unregistered.
C:\WINDOWS\system32\bmegkowp.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\bxvgnbqu.dll
C:\WINDOWS\system32\bxvgnbqu.dll NOT unregistered.
C:\WINDOWS\system32\bxvgnbqu.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\cartskrq.dll
C:\WINDOWS\system32\cartskrq.dll NOT unregistered.
C:\WINDOWS\system32\cartskrq.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\dkfuypyk.dll
C:\WINDOWS\system32\dkfuypyk.dll NOT unregistered.
C:\WINDOWS\system32\dkfuypyk.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\dwlgxjha.dll
C:\WINDOWS\system32\dwlgxjha.dll NOT unregistered.
C:\WINDOWS\system32\dwlgxjha.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\gggxuvkw.dll
C:\WINDOWS\system32\gggxuvkw.dll NOT unregistered.
C:\WINDOWS\system32\gggxuvkw.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\hppqdqsx.dll
C:\WINDOWS\system32\hppqdqsx.dll NOT unregistered.
C:\WINDOWS\system32\hppqdqsx.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\jsutrmlh.dll
C:\WINDOWS\system32\jsutrmlh.dll NOT unregistered.
C:\WINDOWS\system32\jsutrmlh.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\niawyiio.dll
C:\WINDOWS\system32\niawyiio.dll NOT unregistered.
C:\WINDOWS\system32\niawyiio.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\nlbxajwa.dll
C:\WINDOWS\system32\nlbxajwa.dll NOT unregistered.
C:\WINDOWS\system32\nlbxajwa.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\nscodppy.dll
C:\WINDOWS\system32\nscodppy.dll NOT unregistered.
C:\WINDOWS\system32\nscodppy.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\oungwwhl.dll
C:\WINDOWS\system32\oungwwhl.dll NOT unregistered.
C:\WINDOWS\system32\oungwwhl.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\psllkhhx.dll
C:\WINDOWS\system32\psllkhhx.dll NOT unregistered.
C:\WINDOWS\system32\psllkhhx.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\quuxcxub.dll
C:\WINDOWS\system32\quuxcxub.dll NOT unregistered.
C:\WINDOWS\system32\quuxcxub.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\raslddqg.dll
C:\WINDOWS\system32\raslddqg.dll NOT unregistered.
C:\WINDOWS\system32\raslddqg.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\sfoxjtwk.dll
C:\WINDOWS\system32\sfoxjtwk.dll NOT unregistered.
C:\WINDOWS\system32\sfoxjtwk.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\silbviee.dll
C:\WINDOWS\system32\silbviee.dll NOT unregistered.
C:\WINDOWS\system32\silbviee.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\sohtkodg.dll
C:\WINDOWS\system32\sohtkodg.dll NOT unregistered.
C:\WINDOWS\system32\sohtkodg.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\sttqysuh.dll
C:\WINDOWS\system32\sttqysuh.dll NOT unregistered.
C:\WINDOWS\system32\sttqysuh.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\svhvydkj.dll
C:\WINDOWS\system32\svhvydkj.dll NOT unregistered.
C:\WINDOWS\system32\svhvydkj.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\upvpmgrs.dll
C:\WINDOWS\system32\upvpmgrs.dll NOT unregistered.
C:\WINDOWS\system32\upvpmgrs.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\wtucqneu.dll
C:\WINDOWS\system32\wtucqneu.dll NOT unregistered.
C:\WINDOWS\system32\wtucqneu.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\xpjdtjks.dll
C:\WINDOWS\system32\xpjdtjks.dll NOT unregistered.
C:\WINDOWS\system32\xpjdtjks.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\xwvybkee.dll
C:\WINDOWS\system32\xwvybkee.dll NOT unregistered.
C:\WINDOWS\system32\xwvybkee.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\ytxxwigu.dll
C:\WINDOWS\system32\ytxxwigu.dll NOT unregistered.
C:\WINDOWS\system32\ytxxwigu.dll moved successfully.
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04162008_212341
-
-
très bien, fais un nouveau combo stp
je te donne la suite demain ! ;-)
@+-
- ComboFix 08-04-09.9 - DORRA 2008-04-16 21:45:27.3 - NTFSx86 MINIMAL
Running from: C:\Documents and Settings\DORRA\Desktop\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-03-16 to 2008-04-16 )))))))))))))))))))))))))))))))
.
2008-04-15 22:29 . 2008-04-15 22:29 <DIR> d-------- C:\Documents and Settings\DORRA\Application Data\Malwarebytes
2008-04-15 22:28 . 2008-04-15 22:28 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-15 22:28 . 2008-04-15 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-15 11:31 . 2006-10-05 04:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-04-15 11:31 . 2006-10-05 04:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-04-15 11:30 . 2008-04-15 11:31 <DIR> d-------- C:\Program Files\Picasa2
2008-04-10 23:39 . 2008-04-10 23:39 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Talkback
2008-04-10 22:20 . 2008-04-10 22:21 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 21:02 . 2008-04-10 21:03 1,416,084 --a------ C:\SDFix.exe
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\VundoFix Backups
2008-04-10 18:36 . 2008-04-10 18:36 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 17:57 . 2008-04-10 17:57 <DIR> d-------- C:\_OTMoveIt
2008-04-09 19:23 . 2005-11-18 17:04 70,896 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-04-09 19:23 . 2005-11-18 17:04 33,584 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-04-09 19:22 . 2008-04-09 19:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-04-09 19:17 . 2008-04-09 19:17 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.123-6588780L.exe
2008-04-09 18:53 . 2005-12-29 21:40 49,262 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-04-09 14:08 . 2008-04-09 14:15 90,688 --a------ C:\WINDOWS\system32\EUNBQUXW.DLL.$DIS
2008-04-09 13:09 . 2008-04-10 15:42 1,917 --a------ C:\WINDOWS\imsins.BAK
2008-04-07 10:40 . 2008-04-07 10:40 29,457 --a------ C:\WINDOWS\system32\cjhjcergac.exe
2008-03-31 08:26 . 2008-03-31 08:26 29,457 --a------ C:\WINDOWS\system32\txmhjojbi.exe
2008-03-27 20:56 . 2008-03-27 20:56 29,458 --a------ C:\WINDOWS\system32\isdgta.exe
2008-03-19 20:39 . 2008-03-25 20:56 29,531 --a------ C:\WINDOWS\system32\bbhetmsz.exe
2008-03-17 20:52 . 2008-03-17 20:52 29,017 --a------ C:\WINDOWS\system32\dckzfyedl.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-16 14:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-04-16 14:27 --------- d-----w C:\Program Files\Wanadoo
2008-04-09 17:22 --------- d-----w C:\Program Files\AntivirusFirewall
2008-04-09 16:54 --------- d-----w C:\Program Files\Java
2008-04-09 16:52 --------- d-----w C:\Program Files\IncrediMail
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-12 16:46 28,528 ----a-w C:\WINDOWS\system32\fxnath.exe
2008-03-09 11:55 29,506 ----a-w C:\WINDOWS\system32\tpxhuba.exe
2008-03-05 16:07 28,529 ----a-w C:\WINDOWS\system32\vrloeuz.exe
2008-03-03 11:51 29,506 ----a-w C:\WINDOWS\system32\isdtvibixa.exe
2008-03-03 10:07 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-02 19:11 --------- d-----w C:\Program Files\DivX
2008-03-02 10:45 1,286,021 --sh--w C:\WINDOWS\system32\qkiavssm.tmp
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-23 02:38 43,872 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-01-21 18:44 65,024 ----a-w C:\WINDOWS\IFinst26.exe
2007-09-27 13:24 14,648 --sh--w C:\WINDOWS\system32\opqss.bak1
2007-09-27 13:24 6,487 --sh--w C:\WINDOWS\system32\opqss.bak2
2007-09-27 10:05 6,440 --sh--w C:\WINDOWS\system32\ttvwa.bak1
.
------- Sigcheck -------
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\dllcache\svchost.exe
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((( snapshot@2008-04-10_19.09.37.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-09 08:45:49 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-04-10 20:21:21 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-04-10 20:21:21 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-09 08:45:49 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-04-10 20:21:02 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-04-10 20:21:02 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-04-10 17:03:49 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-16 19:48:20 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD59A389-0BC2-42B5-8E94-96BFC9F502D5}]
C:\WINDOWS\system32\gebyv.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 14:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 20:40 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 20:38 688218]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-22 20:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-22 20:31 126976]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-11-05 14:52 233534]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-29 21:20 98304]
"hpWirelessAssistant"="C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-01-21 14:40 790528]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CAMTRAY.EXE" [ ]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-14 00:21 185632]
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 17:32 126976]
"MAAgent"="C:\Program Files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 21:36 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"zzz_ImInstaller_IncrediMail"="C:\Documents and Settings\DORRA\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2005-12-29 21:40 36972]
"F-Secure Manager"="C:\Program Files\AntivirusFirewall\Common\FSM32.exe" [2005-10-26 03:51 122929]
"F-Secure TNB"="C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" [2005-07-18 16:51 700416]
"F-Secure Startup Wizard"="C:\Program Files\AntivirusFirewall\FSGUI\FSSW.exe" [2005-10-18 10:29 372736]
"News Service"="C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe" [2005-05-31 14:45 356352]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-11-29 20:55:44 569405]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2005-12-30 10:46:16 106560]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyv]
C:\WINDOWS\system32\gebyv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjgged]
ljjgged.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtuusqq]
vtuusqq.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\BASTI\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\WINDOWS\\system32\\muzapp.exe"=
"C:\\Program Files\\AntivirusFirewall\\backweb\\6588780\\Program\\fspex.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 17:04]
S2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE [2008-04-09 19:18]
S2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 17:14]
S2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSgk.sys [2008-04-09 19:37]
S2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2004-06-01 11:03]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 V0090VID;Creative WebCam Vista Plus;C:\WINDOWS\system32\DRIVERS\V0090Vid.sys [2005-04-14 03:00]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08514d12-c7df-11da-b33a-0010c6c39849}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ba45c92-a6d1-11da-b318-00c09fc21f14}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d726c628-7efc-11db-b414-0010c6c39849}]
\Shell\AutoRun\command - reper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-04-16 14:26:01 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\ANTIVI~1\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ANTIVI~1\ANTI-V~1\report.txt
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-16 21:48:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????3?1?1?6??`???? ?,?B?????????????hLC? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-16 21:50:56
ComboFix-quarantined-files.txt 2008-04-16 19:50:45
ComboFix2.txt 2008-04-10 21:05:53
ComboFix3.txt 2008-04-10 17:11:04
Pre-Run: 26,622,500,864 bytes free
Post-Run: 26,609,860,608 bytes free
.
2008-04-09 11:23:26 --- E O F ---
-
-
Salut
ok,
Crée un nouveau document texte et nomme le CFScript.txt ( attention très important ! ) : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes en gras :
file::
C:\WINDOWS\system32\opqss.bak1
C:\WINDOWS\system32\opqss.bak2
C:\WINDOWS\system32\ttvwa.bak1
C:\WINDOWS\system32\qkiavssm.tmp
C:\WINDOWS\system32\fxnath.exe
C:\WINDOWS\system32\tpxhuba.exe
C:\WINDOWS\system32\vrloeuz.exe
C:\WINDOWS\system32\isdtvibixa.exe
C:\WINDOWS\system32\dckzfyedl.exe
C:\WINDOWS\system32\txmhjojbi.exe
C:\WINDOWS\system32\isdgta.exe
C:\WINDOWS\system32\bbhetmsz.exe
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\gebyv.dll
C:\WINDOWS\system32\ljjgged.dll
C:\WINDOWS\system32\vtuusqq.dll
registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD59A389-0BC2-42B5-8E94-96BFC9F502D5}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyv]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjgged]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtuusqq]
ensuite fais glisser le fichier texte sur combo.exe comme sur l'animation :
http://img.bleepingcomputer.com/combofix/usage/rc.gif
Dans la fenêtre qui suit, choisie l'option 1 puis valide
Patiente un peu, si le bureau disparait parfois durant le scan : c'est normal !
A la fin du scan, un rapport va s'afficher : poste le stp ( sinon il se situe dans ici : C:\ComboFix.txt )
@+
;-)-
- besoin d'aide.
Un collègue de travail m'a conseiller de télécharger un anti virus s'appelant ESET Smart securite.
J'ai donc désinstaller mon firewall et je l'ai téléchargé. J'ai ensuite fais une analyse qui a retrouve le rapport suivant:
& fichiers infectes et 7 fichiers nettoyes.
J arrive pas a avoir le rapport complet.
Est ce que je poursuit ce que tu m'as demande de faire ou changement de strategie?
-
-
continue ! ;-)
tu désactive ton parefeu pour télécharger ??
++-
je ne sais pas si j ai reussi ou pas. J'ai pas eu d'option 1?
Voici l'analyse combot comme sur l'animation.
Merci- ComboFix 08-04-09.9 - DORRA 2008-04-17 21:11:39.5 - NTFSx86 MINIMAL
Running from: C:\Documents and Settings\DORRA\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\DORRA\Desktop\CFScript.txt
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 )))))))))))))))))))))))))))))))
.
2008-04-17 19:09 . 2008-04-17 19:09 <DIR> d-------- C:\Documents and Settings\DORRA\Application Data\ESET
2008-04-17 19:07 . 2008-04-17 19:11 <DIR> d-------- C:\Program Files\ESET
2008-04-17 19:07 . 2008-04-17 19:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-04-15 22:29 . 2008-04-15 22:29 <DIR> d-------- C:\Documents and Settings\DORRA\Application Data\Malwarebytes
2008-04-15 22:28 . 2008-04-15 22:28 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-15 22:28 . 2008-04-15 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-15 11:31 . 2006-10-05 04:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-04-15 11:31 . 2006-10-05 04:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-04-15 11:30 . 2008-04-15 11:31 <DIR> d-------- C:\Program Files\Picasa2
2008-04-10 23:39 . 2008-04-10 23:39 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Talkback
2008-04-10 22:20 . 2008-04-10 22:21 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 21:02 . 2008-04-10 21:03 1,416,084 --a------ C:\SDFix.exe
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\VundoFix Backups
2008-04-10 18:36 . 2008-04-10 18:36 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 17:57 . 2008-04-10 17:57 <DIR> d-------- C:\_OTMoveIt
2008-04-09 18:53 . 2005-12-29 21:40 49,262 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-04-09 14:08 . 2008-04-09 14:15 90,688 --a------ C:\WINDOWS\system32\EUNBQUXW.DLL.$DIS
2008-04-09 13:09 . 2008-04-10 15:42 1,917 --a------ C:\WINDOWS\imsins.BAK
2008-04-07 10:40 . 2008-04-07 10:40 29,457 --a------ C:\WINDOWS\system32\cjhjcergac.exe
2008-03-31 08:26 . 2008-03-31 08:26 29,457 --a------ C:\WINDOWS\system32\txmhjojbi.exe
2008-03-27 20:56 . 2008-03-27 20:56 29,458 --a------ C:\WINDOWS\system32\isdgta.exe
2008-03-19 20:39 . 2008-03-25 20:56 29,531 --a------ C:\WINDOWS\system32\bbhetmsz.exe
2008-03-17 20:52 . 2008-03-17 20:52 29,017 --a------ C:\WINDOWS\system32\dckzfyedl.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 19:06 --------- d-----w C:\Program Files\Wanadoo
2008-04-17 16:58 --------- d-----w C:\Program Files\AntivirusFirewall
2008-04-17 16:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-04-09 16:54 --------- d-----w C:\Program Files\Java
2008-04-09 16:52 --------- d-----w C:\Program Files\IncrediMail
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-12 16:46 28,528 ----a-w C:\WINDOWS\system32\fxnath.exe
2008-03-09 11:55 29,506 ----a-w C:\WINDOWS\system32\tpxhuba.exe
2008-03-05 16:07 28,529 ----a-w C:\WINDOWS\system32\vrloeuz.exe
2008-03-03 11:51 29,506 ----a-w C:\WINDOWS\system32\isdtvibixa.exe
2008-03-03 10:07 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-02 19:11 --------- d-----w C:\Program Files\DivX
2008-03-02 10:45 1,286,021 --sh--w C:\WINDOWS\system32\qkiavssm.tmp
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-23 02:38 43,872 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-20 09:11 71,176 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2008-02-20 09:11 54,280 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2008-02-20 09:11 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2008-02-20 09:02 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2008-02-20 09:01 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-01-21 18:44 65,024 ----a-w C:\WINDOWS\IFinst26.exe
2007-09-27 13:24 14,648 --sh--w C:\WINDOWS\system32\opqss.bak1
2007-09-27 13:24 6,487 --sh--w C:\WINDOWS\system32\opqss.bak2
2007-09-27 10:05 6,440 --sh--w C:\WINDOWS\system32\ttvwa.bak1
.
------- Sigcheck -------
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\dllcache\svchost.exe
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((( snapshot@2008-04-10_19.09.37.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-09 08:45:49 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-04-10 20:21:21 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-04-10 20:21:21 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-09 08:45:49 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-04-10 20:21:02 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-04-10 20:21:02 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-17 17:09:20 10,134 ----a-r C:\WINDOWS\Installer\{6EEF0EA7-391F-4CBF-9047-C4C85F6A930F}\callmsi.exe
+ 2008-04-17 17:09:20 140,544 ----a-r C:\WINDOWS\Installer\{6EEF0EA7-391F-4CBF-9047-C4C85F6A930F}\egui.exe
- 2008-04-10 17:03:49 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-17 19:14:17 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD59A389-0BC2-42B5-8E94-96BFC9F502D5}]
C:\WINDOWS\system32\gebyv.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 14:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 20:40 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 20:38 688218]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-22 20:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-22 20:31 126976]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-11-05 14:52 233534]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-29 21:20 98304]
"hpWirelessAssistant"="C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-01-21 14:40 790528]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CAMTRAY.EXE" [ ]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-14 00:21 185632]
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 17:32 126976]
"MAAgent"="C:\Program Files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 21:36 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"zzz_ImInstaller_IncrediMail"="C:\Documents and Settings\DORRA\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2005-12-29 21:40 36972]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-11-29 20:55:44 569405]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2005-12-30 10:46:16 106560]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyv]
C:\WINDOWS\system32\gebyv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjgged]
ljjgged.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtuusqq]
vtuusqq.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\BASTI\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\WINDOWS\\system32\\muzapp.exe"=
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 V0090VID;Creative WebCam Vista Plus;C:\WINDOWS\system32\DRIVERS\V0090Vid.sys [2005-04-14 03:00]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08514d12-c7df-11da-b33a-0010c6c39849}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ba45c92-a6d1-11da-b318-00c09fc21f14}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d726c628-7efc-11db-b414-0010c6c39849}]
\Shell\AutoRun\command - reper.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 21:14:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????3?1?1?6??????? ?,?B?????????????hLC? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-17 21:16:42
ComboFix-quarantined-files.txt 2008-04-17 19:16:29
ComboFix2.txt 2008-04-16 19:50:57
ComboFix3.txt 2008-04-10 21:05:53
ComboFix4.txt 2008-04-10 17:11:04
Pre-Run: 26,671,992,832 bytes free
Post-Run: 26,659,422,208 bytes free
.
2008-04-09 11:23:26 --- E O F ---
-
-
ça ne semble pas avoir fonctionner !
refais la manip stp !
++-
Pareil. Pas d'option 1.
Je l'ai fait 1 fois en mode sans echec et 1 fois en mode normal.
voici le dernier rapport.
ComboFix 08-04-09.9 - DORRA 2008-04-17 21:28:14.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.137 [GMT 2:00]
Running from: C:\Documents and Settings\DORRA\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\DORRA\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 )))))))))))))))))))))))))))))))
.
2008-04-17 19:09 . 2008-04-17 19:09 <DIR> d-------- C:\Documents and Settings\DORRA\Application Data\ESET
2008-04-17 19:07 . 2008-04-17 19:11 <DIR> d-------- C:\Program Files\ESET
2008-04-17 19:07 . 2008-04-17 19:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-04-15 22:29 . 2008-04-15 22:29 <DIR> d-------- C:\Documents and Settings\DORRA\Application Data\Malwarebytes
2008-04-15 22:28 . 2008-04-15 22:28 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-15 22:28 . 2008-04-15 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-15 11:31 . 2006-10-05 04:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-04-15 11:31 . 2006-10-05 04:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-04-15 11:30 . 2008-04-15 11:31 <DIR> d-------- C:\Program Files\Picasa2
2008-04-10 23:39 . 2008-04-10 23:39 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Talkback
2008-04-10 22:20 . 2008-04-10 22:21 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-10 21:02 . 2008-04-10 21:03 1,416,084 --a------ C:\SDFix.exe
2008-04-10 19:25 . 2008-04-10 19:25 <DIR> d-------- C:\VundoFix Backups
2008-04-10 18:36 . 2008-04-10 18:36 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-10 17:57 . 2008-04-10 17:57 <DIR> d-------- C:\_OTMoveIt
2008-04-09 18:53 . 2005-12-29 21:40 49,262 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-04-09 14:08 . 2008-04-09 14:15 90,688 --a------ C:\WINDOWS\system32\EUNBQUXW.DLL.$DIS
2008-04-09 13:09 . 2008-04-10 15:42 1,917 --a------ C:\WINDOWS\imsins.BAK
2008-04-07 10:40 . 2008-04-07 10:40 29,457 --a------ C:\WINDOWS\system32\cjhjcergac.exe
2008-03-31 08:26 . 2008-03-31 08:26 29,457 --a------ C:\WINDOWS\system32\txmhjojbi.exe
2008-03-27 20:56 . 2008-03-27 20:56 29,458 --a------ C:\WINDOWS\system32\isdgta.exe
2008-03-19 20:39 . 2008-03-25 20:56 29,531 --a------ C:\WINDOWS\system32\bbhetmsz.exe
2008-03-17 20:52 . 2008-03-17 20:52 29,017 --a------ C:\WINDOWS\system32\dckzfyedl.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 19:18 --------- d-----w C:\Program Files\Wanadoo
2008-04-17 16:58 --------- d-----w C:\Program Files\AntivirusFirewall
2008-04-17 16:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-04-09 16:54 --------- d-----w C:\Program Files\Java
2008-04-09 16:52 --------- d-----w C:\Program Files\IncrediMail
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-12 16:46 28,528 ----a-w C:\WINDOWS\system32\fxnath.exe
2008-03-09 11:55 29,506 ----a-w C:\WINDOWS\system32\tpxhuba.exe
2008-03-05 16:07 28,529 ----a-w C:\WINDOWS\system32\vrloeuz.exe
2008-03-03 11:51 29,506 ----a-w C:\WINDOWS\system32\isdtvibixa.exe
2008-03-03 10:07 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-02 19:11 --------- d-----w C:\Program Files\DivX
2008-03-02 10:45 1,286,021 --sh--w C:\WINDOWS\system32\qkiavssm.tmp
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-23 02:38 43,872 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-20 09:11 71,176 ----a-w C:\WINDOWS\system32\drivers\epfw.sys
2008-02-20 09:11 54,280 ----a-w C:\WINDOWS\system32\drivers\epfwtdi.sys
2008-02-20 09:11 30,728 ----a-w C:\WINDOWS\system32\drivers\epfwndis.sys
2008-02-20 09:02 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2008-02-20 09:01 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-01-21 18:44 65,024 ----a-w C:\WINDOWS\IFinst26.exe
2007-09-27 13:24 14,648 --sh--w C:\WINDOWS\system32\opqss.bak1
2007-09-27 13:24 6,487 --sh--w C:\WINDOWS\system32\opqss.bak2
2007-09-27 10:05 6,440 --sh--w C:\WINDOWS\system32\ttvwa.bak1
.
------- Sigcheck -------
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
2004-08-04 14:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\dllcache\svchost.exe
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
2004-08-04 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe
2004-08-04 14:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\dllcache\winlogon.exe
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys
2004-08-04 14:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\dllcache\ip6fw.sys
2004-08-04 14:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((( snapshot@2008-04-10_19.09.37.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-09 08:45:49 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-04-10 20:21:21 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-04-10 20:21:21 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-09 08:45:49 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-04-10 20:21:02 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-04-10 20:21:02 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-04-17 17:09:20 10,134 ----a-r C:\WINDOWS\Installer\{6EEF0EA7-391F-4CBF-9047-C4C85F6A930F}\callmsi.exe
+ 2008-04-17 17:09:20 140,544 ----a-r C:\WINDOWS\Installer\{6EEF0EA7-391F-4CBF-9047-C4C85F6A930F}\egui.exe
- 2008-04-10 17:03:49 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-17 19:30:44 53,248 ----a-w C:\WINDOWS\PSEXESVC.EXE
+ 2008-04-17 19:18:33 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_758.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD59A389-0BC2-42B5-8E94-96BFC9F502D5}]
C:\WINDOWS\system32\gebyv.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 14:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 14:00 455168]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 20:40 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 20:38 688218]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-22 20:36 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-22 20:31 126976]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-11-05 14:52 233534]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-29 21:20 98304]
"hpWirelessAssistant"="C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-01-21 14:40 790528]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CAMTRAY.EXE" [ ]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-14 00:21 185632]
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 17:32 126976]
"MAAgent"="C:\Program Files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 21:36 57344]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"zzz_ImInstaller_IncrediMail"="C:\Documents and Settings\DORRA\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0\bin\jusched.exe" [2005-12-29 21:40 36972]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-02-20 11:06 1443072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-11-29 20:55:44 569405]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2005-12-30 10:46:16 106560]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 17:51 192512]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyv]
C:\WINDOWS\system32\gebyv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjgged]
ljjgged.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtuusqq]
vtuusqq.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\BASTI\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\WINDOWS\\system32\\muzapp.exe"=
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 V0090VID;Creative WebCam Vista Plus;C:\WINDOWS\system32\DRIVERS\V0090Vid.sys [2005-04-14 03:00]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08514d12-c7df-11da-b33a-0010c6c39849}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8ba45c92-a6d1-11da-b318-00c09fc21f14}]
\Shell\AutoRun\command - RavMon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d726c628-7efc-11db-b414-0010c6c39849}]
\Shell\AutoRun\command - reper.exe
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 21:30:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????3?1?1?6??@???? ?,?B?????????????hLC? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-17 21:33:02
ComboFix-quarantined-files.txt 2008-04-17 19:32:56
ComboFix2.txt 2008-04-17 19:16:43
ComboFix3.txt 2008-04-16 19:50:57
ComboFix4.txt 2008-04-10 21:05:53
ComboFix5.txt 2008-04-10 17:11:04
Pre-Run: 26,161,823,744 bytes free
Post-Run: 26,150,432,768 bytes free
.
2008-04-09 11:23:26 --- E O F ---
-
-
ok, tant pie, on peut passer par autre chose, ça ne semble pas fonctionner ... :/
télécharge OTMoveIt (de Old_Timer) sur ton Bureau :
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
C:\WINDOWS\system32\opqss.bak1
C:\WINDOWS\system32\opqss.bak2
C:\WINDOWS\system32\ttvwa.bak1
C:\WINDOWS\system32\qkiavssm.tmp
C:\WINDOWS\system32\fxnath.exe
C:\WINDOWS\system32\tpxhuba.exe
C:\WINDOWS\system32\vrloeuz.exe
C:\WINDOWS\system32\isdtvibixa.exe
C:\WINDOWS\system32\dckzfyedl.exe
C:\WINDOWS\system32\txmhjojbi.exe
C:\WINDOWS\system32\isdgta.exe
C:\WINDOWS\system32\bbhetmsz.exe
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\gebyv.dll
C:\WINDOWS\system32\ljjgged.dll
C:\WINDOWS\system32\vtuusqq.dll
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.
si c'est le cas accepte par Yes.
-
File/Folder C:\WINDOWS\system32\opqss.bak1 not found.
File/Folder C:\WINDOWS\system32\opqss.bak2 not found.
File/Folder C:\WINDOWS\system32\ttvwa.bak1 not found.
File/Folder C:\WINDOWS\system32\qkiavssm.tmp not found.
File/Folder C:\WINDOWS\system32\fxnath.exe not found.
File/Folder C:\WINDOWS\system32\tpxhuba.exe not found.
File/Folder C:\WINDOWS\system32\vrloeuz.exe not found.
File/Folder C:\WINDOWS\system32\isdtvibixa.exe not found.
File/Folder C:\WINDOWS\system32\dckzfyedl.exe not found.
File/Folder C:\WINDOWS\system32\txmhjojbi.exe not found.
File/Folder C:\WINDOWS\system32\isdgta.exe not found.
File/Folder C:\WINDOWS\system32\bbhetmsz.exe not found.
File/Folder C:\WINDOWS\imsins.BAK not found.
File/Folder C:\WINDOWS\system32\gebyv.dll not found.
File/Folder C:\WINDOWS\system32\ljjgged.dll not found.
File/Folder C:\WINDOWS\system32\vtuusqq.dll not found.
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04172008_220332
- 1
- 2
Suivant
