Nouveau problème antispyware-reviews virus

BONJOUR J AI LE MEME PROBLEME AVEC Antispyware-reviews.biz voici le rapport de malware

Malwarebytes' Anti-Malware 1.12
Version de la base de données: 722

Type de recherche: Examen complet (C:\|)
Eléments examinés: 99885
Temps écoulé: 17 minute(s), 40 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 28
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
C:\ProgramData\jkbdyajn\fatwxedc.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\ProgramData\jstclkzm\vkpebwda.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\dpcproxy (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\uninstall (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Classes\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\fwbd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\HolLol (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Golden Palace Casino PT (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jkbdyajn (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BeSrhGTbhx (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{­0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\ProgramData\jkbdyajn\fatwxedc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\ProgramData\jstclkzm\vkpebwda.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Répondre à fafabri
3

Ce message vous semble utile, votez !Signaler ce message aux modérateursEditer (modifier) votre message Par fafabri, le jeudi 8 mai 2008 à 20:35:39
voici le rapport combofix

ComboFix 08-05-07.2 - muriel 2008-05-08 20:24:46.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.216 [GMT 2:00]
Endroit: C:\Users\muriel\Downloads\Combo-Fix.exe
.
[color=purple]The following files were disabled during the run:/color
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll


(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-08 to 2008-05-08 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier cr‚‚ dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 18:09 --------- d-----w C:\ProgramData\jstclkzm
2008-05-08 18:09 --------- d-----w C:\ProgramData\jkbdyajn
2008-05-08 17:30 --------- d-----w C:\Users\muriel\AppData\Roaming\Malwarebytes
2008-05-08 17:30 --------- d-----w C:\ProgramData\Malwarebytes
2008-05-08 17:30 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-05-08 14:48 --------- d-----w C:\Program Files\Enigma Software Group
2008-05-07 20:04 --------- d-----w C:\Program Files\SpyZooka
2008-05-07 19:58 --------- d-----w C:\Users\muriel\AppData\Roaming\Download Manager
2008-05-07 14:54 --------- d-----w C:\Users\muriel\AppData\Roaming\Ahead
2008-05-05 18:46 27,048 ----a-w C:\Windows\system32\drivers\mbamcatchme.sys
2008-05-05 18:46 15,864 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-05-05 13:47 691 ----a-w C:\Users\muriel\AppData\Roaming\GetValue.vbs
2008-05-05 13:47 35 ----a-w C:\Users\muriel\AppData\Roaming\SetValue.bat
2008-04-09 15:44 --------- d-----w C:\Program Files\Windows Mail
2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 06:25 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 06:25 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 06:25 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-02-14 06:25 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 06:25 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2007-11-02 18:22 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 08:19 1232896]
"StartCCC"="c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-11-02 20:07 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 17:37 3772416 C:\Windows\RtHDVCpl.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"snpstd"="C:\Windows\vsnpstd.exe" [2006-08-23 15:36 339968]
"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SHStartup.exe" [2008-01-23 15:48 344064]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{604A8CD6-3481-4BCF-B4B9-7D5CAA7742FD}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{D7024EF5-4768-4C0A-954F-4F7A3399F7AC}"= Disabled:UDP:C:\Program Files\Magentic\bin\Magentic.exe:Magentic
"{631606E0-DD08-4D85-B0EE-A3E7A4654C27}"= Disabled:UDP:C:\Program Files\Magentic\bin\Magentic.exe:Magentic
"{929161B0-4925-4AC2-A5A2-CC6BEF6427BA}"= Disabled:TCP:C:\Program Files\Magentic\bin\Magentic.exe:Magentic
"{AE44EEA3-9B28-4EB5-A07A-C00717E43755}"= Disabled:TCP:C:\Program Files\Magentic\bin\Magentic.exe:Magentic
"{94347935-81D6-44DC-B54D-1F36F499774B}"= Disabled:UDP:C:\Program Files\Magentic\bin\MgApp.exe:Magentic
"{EB1C054E-B147-4669-A97F-3B6C45CB394D}"= Disabled:TCP:C:\Program Files\Magentic\bin\MgApp.exe:Magentic
"{FDF690C1-3B65-4418-B1D5-46B5DBBA312B}"= Disabled:UDP:C:\Program Files\Magentic\bin\MgImp.exe:Magentic
"{B2EE328E-2E92-40C8-AE58-5525F881F08E}"= Disabled:TCP:C:\Program Files\Magentic\bin\MgImp.exe:Magentic

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 O2MDRDR;O2MDRDR;C:\Windows\system32\DRIVERS\o2media.sys [2006-11-20 16:14]
R0 O2SDRDR;O2SDRDR;C:\Windows\system32\DRIVERS\o2sd.sys [2006-11-17 14:58]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]
R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 11:45]
R2 SpyHunter3 Service;SpyHunter3 Service;"C:\Program Files\Enigma Software Group\SpyHunter\SHService.exe" [2008-01-23 15:48]
R2 WcesComm;Windows Mobile-2003-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 11:45]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2006-10-20 23:47]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-12-27 15:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {1B91DBAF-C919-6A57-18E2-C7D7EF4FF08C} /qb
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-08 20:29:23
Windows 6.0.6000 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 42

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\o2flash.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\conime.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\wbem\unsecapp.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-05-08 20:32:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-08 18:32:28

Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associ‚ au num‚ro 0x2379 est introuvable dans le fichier de messages pour Application.

124 --- E O F --- 2008-05-06 19:01:22
Répondre à fafabri
4

Ce message vous semble utile, votez !Signaler ce message aux modérateursEditer (modifier) votre message Par fafabri, le jeudi 8 mai 2008 à 20:38:52
et voici hisjacking

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:37:32, on 08/05/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\vsnpstd.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SHStartup.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: O2Micro Flash Memory (O2Flash) - O2Micro International - c:\Windows\system32\o2flash.exe
O23 - Service: SpyHunter3 Service - Enigma Software Group, Inc. - C:\Program Files\Enigma Software Group\SpyHunter\SHService.exe

End of file - 4131 bytes
Répondre à fafabri
5

Ce message vous semble utile, votez !Signaler ce message aux modérateursEditer (modifier) votre message Par fafabri, le jeudi 8 mai 2008 à 20:40:45
bonsoir apres avoir fait tous ce qui est decrit dans le texte au dessus je ne sais pas a quoi servent tous ces rapports et surtout si je suis toujours infecte aidez moi s il vous plait

fafabri

bonsoir voici le rapport combofix
ComboFix 08-05-07.2 - muriel 2008-05-08 23:03:18.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.353 [GMT 2:00]
Endroit: C:\Users\muriel\Downloads\ComboFix.exe
Command switches used :: C:\Users\muriel\Downloads\CFscript.txt

FILE ::
C:\Program Files\Enigma Software Group\SpyHunter
C:\Program Files\Enigma Software Group\SpyHunter\SHService.exe
C:\Program Files\Enigma Software Group\SpyHunter\SHStartup.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-04-08 to 2008-05-08 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-08 18:37 --------- d-----w C:\Program Files\Trend Micro
2008-05-08 18:09 --------- d-----w C:\ProgramData\jstclkzm
2008-05-08 18:09 --------- d-----w C:\ProgramData\jkbdyajn
2008-05-08 17:30 --------- d-----w C:\Users\muriel\AppData\Roaming\Malwarebytes
2008-05-08 17:30 --------- d-----w C:\ProgramData\Malwarebytes
2008-05-08 17:30 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-05-08 14:48 --------- d-----w C:\Program Files\Enigma Software Group
2008-05-07 20:14 2,920 ----a-w C:\Windows\System32\tmp.reg
2008-05-07 20:04 --------- d-----w C:\Program Files\SpyZooka
2008-05-07 19:58 --------- d-----w C:\Users\muriel\AppData\Roaming\Download Manager
2008-05-07 14:54 --------- d-----w C:\Users\muriel\AppData\Roaming\Ahead
2008-05-05 18:46 27,048 ----a-w C:\Windows\system32\drivers\mbamcatchme.sys
2008-05-05 18:46 15,864 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-05-05 13:47 691 ----a-w C:\Users\muriel\AppData\Roaming\GetValue.vbs
2008-05-05 13:47 35 ----a-w C:\Users\muriel\AppData\Roaming\SetValue.bat
2008-04-28 06:03 82,944 ----a-w C:\Windows\System32\IEDFix.exe
2008-04-28 06:03 82,944 ----a-w C:\Windows\System32\404Fix.exe
2008-04-24 06:10 86,528 ----a-w C:\Windows\System32\VACFix.exe
2008-04-09 15:44 --------- d-----w C:\Program Files\Windows Mail
2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-02-21 04:43 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-02-21 04:43 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-21 04:43 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-02-21 04:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-19 05:10 620,088 ----a-w C:\Windows\System32\ci.dll
2008-02-14 23:19 944,184 ----a-w C:\Windows\System32\winload.exe
2008-02-14 06:27 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-14 06:26 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-14 06:26 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-14 06:25 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 06:25 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 06:25 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 06:25 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-14 06:25 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-14 06:25 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-02-14 06:25 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 06:25 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 06:25 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-14 06:25 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2007-11-02 18:22 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((( snapshot@2008-05-08_20.32.02.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-08 18:28:40 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-05-08 18:45:21 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-05-08 18:45:22 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-05-08 18:45:22 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-05-08 18:21:20 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-05-08 21:00:31 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-05-08 18:29:12 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-05-08 18:48:02 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-05-08 18:48:02 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-05-08 18:24:33 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-05-08 21:03:08 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-05-08 18:29:12 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-05-08 18:47:57 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-05-08 18:47:57 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-05-08 18:29:32 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-05-08 18:46:04 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-08 18:29:32 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-08 18:46:04 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-08 18:29:32 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-08 18:46:04 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-05-08 17:30:40 103,924 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-05-08 18:50:03 103,924 ----a-w C:\Windows\System32\perfc009.dat
- 2008-05-08 17:30:40 117,572 ----a-w C:\Windows\System32\perfc00C.dat
+ 2008-05-08 18:50:03 117,572 ----a-w C:\Windows\System32\perfc00C.dat
- 2008-05-08 17:30:40 610,142 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-05-08 18:50:03 610,142 ----a-w C:\Windows\System32\perfh009.dat
- 2008-05-08 17:30:40 690,832 ----a-w C:\Windows\System32\perfh00C.dat
+ 2008-05-08 18:50:03 690,832 ----a-w C:\Windows\System32\perfh00C.dat
- 2008-05-08 15:08:49 11,966 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-772610907-3071680514-330990349-1000_UserData.bin
+ 2008-05-08 18:48:58 12,444 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-772610907-3071680514-330990349-1000_UserData.bin
- 2008-05-08 15:08:49 52,370 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-05-08 18:48:58 52,534 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-05-08 15:08:48 35,862 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-05-08 18:48:56 36,510 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 08:19 1232896]
"StartCCC"="c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-11-02 20:07 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 17:37 3772416 C:\Windows\RtHDVCpl.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"snpstd"="C:\Windows\vsnpstd.exe" [2006-08-23 15:36 339968]
"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{604A8CD6-3481-4BCF-B4B9-7D5CAA7742FD}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{D7024EF5-4768-4C0A-954F-4F7A3399F7AC}"= Disabled:UDP:C:\Program Files\Magentic\bin\Magentic.exe:Magentic
"{631606E0-DD08-4D85-B0EE-A3E7A4654C27}"= Disabled:UDP:C:\Program Files\Magentic\bin\Magentic.exe:Magentic
"{929161B0-4925-4AC2-A5A2-CC6BEF6427BA}"= Disabled:TCP:C:\Program Files\Magentic\bin\Magentic.exe:Magentic
"{AE44EEA3-9B28-4EB5-A07A-C00717E43755}"= Disabled:TCP:C:\Program Files\Magentic\bin\Magentic.exe:Magentic
"{94347935-81D6-44DC-B54D-1F36F499774B}"= Disabled:UDP:C:\Program Files\Magentic\bin\MgApp.exe:Magentic
"{EB1C054E-B147-4669-A97F-3B6C45CB394D}"= Disabled:TCP:C:\Program Files\Magentic\bin\MgApp.exe:Magentic
"{FDF690C1-3B65-4418-B1D5-46B5DBBA312B}"= Disabled:UDP:C:\Program Files\Magentic\bin\MgImp.exe:Magentic
"{B2EE328E-2E92-40C8-AE58-5525F881F08E}"= Disabled:TCP:C:\Program Files\Magentic\bin\MgImp.exe:Magentic

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 O2MDRDR;O2MDRDR;C:\Windows\system32\DRIVERS\o2media.sys [2006-11-20 16:14]
R0 O2SDRDR;O2SDRDR;C:\Windows\system32\DRIVERS\o2sd.sys [2006-11-17 14:58]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]
R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 11:45]
R2 WcesComm;Windows Mobile-2003-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 11:45]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2006-10-20 23:47]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-12-27 15:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {1B91DBAF-C919-6A57-18E2-C7D7EF4FF08C} /qb
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-08 23:05:34
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 42

**************************************************************************
.
Temps d'accomplissement: 2008-05-08 23:06:28
ComboFix-quarantined-files.txt 2008-05-08 21:06:25
ComboFix2.txt 2008-05-08 18:32:46

Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.

171 --- E O F --- 2008-05-06 19:01:22






v

Salut jlpjlp

je ne sais pas ou t'as ete cherche que spyhunter etait un espion, il est edite par enigmasoftwaregroup qui de plus appartient a Google, et en plus son systeme de protection est integre a Googlemail ou Gmail comme tu prefere, il faut etre assez prudent, du fait que leur algorithme est en permanence modifié, il peut ne pas etre reconnu par un antispiware ou un autre antivirus, c'est pourquoi on recommande de ne jamais installé 2 anti en meme temps, pour te donner un exemple, on a eu des plaintes du fait que AVG7 a mis en quarantaine smitfraufix il y'a de ca 4 mois.
en plus spyhunter a trouve le probleme de fafabri:

"il me trouve 4 infections de type : registry key
object name : vividence connector
golden palace casino
media update
media update

localisation
hkcu "

j'ai l'impression que vous perdez tu temps inutilement, il y'a d'autres qui attendent.

je te laisse continuer
BOB3

Salut fafabri

dis donc tu pose la meme question sur plusieurs pages, c'est la meilleures facon de ne pas resoudre ton probleme,
et de nous faire perdre tu temps, il faut penser aux autres, en plus ton probleme il est connu, demande a ceux qui ont eu le meme de venir t'aider.

BOB3

bonjour plus de problemes merci mille fois

fafabri