Troyen Vundo - cbXOEwVl.dll toujours présente Résolu

Question

Bonjour à tous,

Je sollicite votre aide car depuis quelque jours j'ai une page explorer qui s'ouvre au moins 4 fois en 15 min, à chaque fois que je navigue sur le net via internet explorer. Pour information je suis sous Windows 2000 Pro SP4. J'ai essayé d'éradiquer en mode sans échec à l'aide des logiciels suivants (mis à jour bien entendu) :

NOD32 Antivirus, Spybot Search & Destroy, VundoFix, MalwareBytes AntiMalware v1.11, CCleaner v2.0

mais la dll cbXOEwVl.dll résiste et les solutions données dans les autres sujets ne m'ont pas permis de l'éradiquer...

Mon antivirus (NOD 32) a beau mettre en quarantaine toutes les 2 secondes cbXOEwVl.dll, ce fichier revient en force.

Voici ci-dessous les rapports d'analyse des logiciels HiJackThis v2.02 et MalwareBytes AntiMalware v1.11. D'avance merci pour votre aide précieuse !

Laurent.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:28:39, on 30/04/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\WINNT\system32\crypserv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\WINNT\system32\oodag.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32egsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINNT\System32\winss.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\MyProg.exe
C:\WINNT\system32	askmgr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {162983F6-01AA-4006-B8FD-800F9D7791FC} - C:\WINNT\system32\cbXOEwVl.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Eye On Network] C:\Program Files\Eye On Network\Eye On Network.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\system32\shdocvw.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/software
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
O16 - DPF: {A06BE318-C096-11D4-964F-0010A4D06F69} (TeleTVA Control) - https://tva.dgi.minefi.gouv.fr/activeX/TeleTVA.tva
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f003.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.streamload.com/Upload/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{8DC60D79-CF22-408D-AFC4-BA3892DB2549}: NameServer = 212.27.54.252,212.27.53.252
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Program Files\Fichiers communs\Mediafour\MacDriveiTunesPatch.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINNT\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Windows service sysklog - Dreamy - C:\WINNT\System32\winss.exe

jlpjlp · Accepted Answer

colle un rapport combofix comme déjà demandé svp

gen-hackman · Answer

bonjour ...je l ai eu aussi et j ai trouve le moyen de m en debarasser de cette saloperie....
il faut que tu devoiles les fichiers caches et que tu ailles a l adresse indiquee du fichier infecte mais lis bien car le nom de la dll est indique a l'envers.....il faut inverser toutes les lettres avant .dll et tu la supprimes......voila c est comme ca que j ai fait....
c est une saloperie qui vient s'incruster dans windows et qui ouvre des pages sans ton consentement et qui t embrouillle le pc

jlpjlp · Answer

slt, relance hijakchtis, fais do a system scan only puis selectionne ces lignes puis fais : FIX CHEKED


R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {162983F6-01AA-4006-B8FD-800F9D7791FC} - C:\WINNT\system32\cbXOEwVl.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')

_______________



Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport. 


_______________

télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :
C:\WINNT\system32\cbXOEwVl.dll

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

dou-l · Answer

jte laisse finir ^^

gen-hackman · Answer

ah bon ben moi j ai essaye avec hijackthis et ben ca marche pas.....

silverknight · Answer

Merci à tous pour vos réponse, malheureusement la dll cbXOEwVl.dll persiste !

Comme vous me l'avez conseillé, j'ai recherché les fichiers lVwEOXbc et j'ai trouvé dans WINNT/System32 :

lVwEOXbc.ini et lVwEOXbc.ini2

que j'ai supprimés (à la main et avec le logiciel OTMoveIt2 en mode sans échec) mais sans succès, ces fichiers sont revenus après redémarrage.

J'ai également tente en mode sans échec de supprimer avec le logiciel OTMoveIt2 le fichier C:\WINNT\system32\cbXOEwVl.dll  mais il est revenu, voici le rapport généré par OTMoveIt2 :



DllUnregisterServer procedure not found in C:\WINNT\system32\cbXOEwVl.dll
C:\WINNT\system32\cbXOEwVl.dll NOT unregistered.
File move failed. C:\WINNT\system32\cbXOEwVl.dll scheduled to be moved on reboot.
C:\WINNT\system32\lVwEOXbc.ini moved successfully.
C:\WINNT\system32\lVwEOXbc.ini2 moved successfully. 
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04302008_200937

Files moved on Reboot...
DllUnregisterServer procedure not found in C:\WINNT\system32\cbXOEwVl.dll
C:\WINNT\system32\cbXOEwVl.dll NOT unregistered.
File move failed. C:\WINNT\system32\cbXOEwVl.dll scheduled to be moved on reboot.



J'ai également relancé HiJackThis v2.02 en tentant de fixer :

R3 - Default URLSearchHook is missing 
O2 - BHO: (no name) - {162983F6-01AA-4006-B8FD-800F9D7791FC} - C:\WINNT\system32\cbXOEwVl.dll 
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user') 


Voici le nouveau rapport HiJackThis :




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:07:23, on 30/04/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\MyProg.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {6EB41F76-A6AB-4AFB-86DB-70DFB5094129} - C:\WINNT\system32\cbXOEwVl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Eye On Network] C:\Program Files\Eye On Network\Eye On Network.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\system32\shdocvw.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/software
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
O16 - DPF: {A06BE318-C096-11D4-964F-0010A4D06F69} (TeleTVA Control) - https://tva.dgi.minefi.gouv.fr/activeX/TeleTVA.tva
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f003.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.streamload.com/Upload/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{8DC60D79-CF22-408D-AFC4-BA3892DB2549}: NameServer = 212.27.54.252,212.27.53.252
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Program Files\Fichiers communs\Mediafour\MacDriveiTunesPatch.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINNT\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Windows service sysklog - Dreamy - C:\WINNT\System32\winss.exe

gen-hackman · Answer

tu devrais regarder s'il n'y en a pas la trace aussi dans les dossiers temporaires dans docs and settins/administrateur(ou ton nom)/Local service/temp et supprime au cas ou.....

jlpjlp · Answer

il faut le rapport combofix pour virer cette infection

gen-hackman · Answer

sinon essaies de les supprimer en restant appuyé sur shift(fleche en haut)ca supprime sans passer par la corbeille

gen-hackman · Answer

bien alors a toi la parole mr le proff

silverknight · Answer

Voici le rapport Combofix que j'avais omis :

ComboFix 08-04-29.5 - Laurent Worms 30/04/2008 20:37:49.1 - NTFSx86
Microsoft Windows 2000 Professionnel 5.0.2195.4.1252.1.1036.18.1609 [GMT 2:00]
Endroit: C:\Documents and Settings\Laurent Worms\Bureau\Comb-Fx.exe
* Resident AV is active

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINNT\Downloaded Program Files\setup.inf
C:\WINNT\pskt.ini
C:\WINNT\system32\eclixrso.ini
C:\WINNT\system32\gxferpat.ini
C:\WINNT\system32\jtmsjulu.ini
C:\WINNT\system32\jvxahsmb.ini
C:\WINNT\system32\lVwEOXbc.ini
C:\WINNT\system32\lVwEOXbc.ini2
C:\WINNT\system32\mcrh.tmp
C:\WINNT\Web\default.htt

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-28 to 2008-04-30 ))))))))))))))))))))))))))))))))))))
.

2008-04-30 19:30 . 08-04-30 19:30 <DIR> d-------- C:\_OTMoveIt
2008-04-30 19:03 . 08-04-30 19:03 <DIR> d-------- C:\Program Files\apulSoft
2008-04-30 17:49 . 07-09-15 01:24 17,920 --a------ C:\WINNT\system32\reg.exe
2008-04-30 17:47 . 08-04-30 20:03 <DIR> d-------- C:\Program Files\Navilog1
2008-04-30 13:33 . 08-04-30 13:33 <DIR> d-------- C:\Documents and Settings\Laurent Worms\Application Data\Malwarebytes
2008-04-30 13:32 . 08-04-30 13:33 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-30 13:32 . 08-04-30 13:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-30 08:34 . 08-04-30 17:40 1,346,380 ---h----- C:\WINNT\ShellIconCache
2008-04-29 23:13 . 08-04-29 23:13 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-29 08:51 . 08-04-29 08:52 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-27 12:41 . 08-04-27 12:41 54,156 --ah----- C:\WINNT\QTFont.qfn
2008-04-27 12:41 . 08-04-27 12:41 1,409 --a------ C:\WINNT\QTFont.for
2008-04-26 21:31 . 08-04-26 21:31 5 --a------ C:\WINNT\dhopfedf.ini
2008-04-26 18:46 . 08-04-26 18:46 <DIR> d-------- C:\Program Files\intermorphic
2008-04-26 18:46 . 08-04-26 18:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\intermorphic
2008-04-26 17:46 . 08-04-26 17:46 0 --a------ C:\WINNT\PROTOCOL.INI
2008-04-26 17:45 . 08-04-26 17:45 <DIR> d-------- C:\Program Files\Pinguin
2008-04-25 12:20 . 08-04-25 12:20 273,920 --------- C:\WINNT\system32\cbXOEwVl.dll
2008-04-25 12:20 . 08-04-28 15:11 109,757 --a------ C:\WINNT\BM53b63637.xml
2008-04-25 11:58 . 08-04-25 11:58 <DIR> d-------- C:\Program Files\Natura
2008-04-25 10:13 . 08-04-26 11:56 <DIR> d-------- C:\Program Files\Fichiers communs\Macromedia
2008-04-24 22:14 . 08-04-30 00:06 <DIR> d-------- C:\WINNT\system32\sysklog
2008-04-24 22:14 . 08-04-24 22:14 98,304 --a------ C:\WINNT\system32\winss.exe
2008-04-24 22:14 . 08-04-24 22:14 34,304 --a------ C:\WINNT\system32\ntsvc.ocx
2008-04-24 10:04 . 08-03-03 14:25 5,702 --ah----- C:\WINNT\nod32restoretemdono.reg
2008-04-24 10:04 . 08-03-03 18:21 568 --ah----- C:\WINNT\nod32fixtemdono.reg
2008-04-16 13:58 . 08-04-16 14:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania
2008-04-16 13:54 . 08-04-16 13:56 <DIR> d-------- C:\Program Files\TmNationsForever
2008-04-11 18:34 . 08-04-11 18:34 <DIR> d-------- C:\Program Files\MSECache
2008-04-11 11:32 . 08-04-11 11:32 23 --a------ C:\Documents and Settings\Laurent Worms\Application Data\iasna_F4F01109-B336-401f-BDE2-7C1926744120.dll
2008-04-11 11:32 . 08-04-11 11:32 21 --a------ C:\Documents and Settings\Laurent Worms\Application Data\iasna_DAA2EFCB-59BE-41d2-8BA5-20B0E5C039A7.dll
2008-04-11 11:32 . 08-04-11 11:32 21 --a------ C:\Documents and Settings\Laurent Worms\Application Data\iasna_47B68C20-EB2E-4320-B75D-71EEF7A96EB7.dll
2008-04-11 11:32 . 08-04-11 11:32 21 --a------ C:\Documents and Settings\Laurent Worms\Application Data\iasna_27FE67F6-017D-4123-8E81-713889A5DAC1.dll
2008-04-11 08:51 . 08-04-11 08:51 14 --a------ C:\WINNT\system32\odbcloc.tlb
2008-04-11 08:50 . 08-04-11 09:05 <DIR> d-------- C:\Program Files\Atmosphere Deluxe
2008-04-11 08:50 . 04-10-18 14:04 161,280 --a------ C:\WINNT\system32\fmod.dll
2008-04-11 08:50 . 06-03-03 23:09 90,112 --a------ C:\WINNT\system32\kcommobj.ocx
2008-04-11 08:50 . 06-08-24 02:15 90,112 --a------ C:\WINNT\system32\dgwaveedit.ocx
2008-04-11 08:50 . 99-09-09 01:51 40,208 --a------ C:\WINNT\system32\dsetup.dll
2008-04-10 19:00 . 08-04-10 19:07 <DIR> d-------- C:\Program Files\Atmosphere Lite
2008-04-10 19:00 . 05-11-07 01:14 366,080 --a------ C:\WINNT\system32\vbskfr2.ocx
2008-04-10 19:00 . 04-07-08 02:40 311,296 --a------ C:\WINNT\system32\puma lcd simulator v7.ocx
2008-04-10 19:00 . 04-10-25 18:19 151,552 --a------ C:\WINNT\system32\dxvumeter3.ocx
2008-04-10 19:00 . 05-11-09 02:35 69,632 --a------ C:\WINNT\system32\webupdate.ocx
2008-04-10 19:00 . 05-11-09 02:35 40,960 --a------ C:\WINNT\system32\akprogressbar.ocx
2008-04-10 19:00 . 04-05-25 23:24 35,840 --a------ C:\WINNT\system32\xfxslider.ocx
2008-04-01 10:04 . 08-01-17 12:00 53,248 --a------ C:\WINNT\system32\IKStompIO1API.dll
2008-03-29 15:20 . 07-06-19 10:27 2,045,952 --a------ C:\WINNT\system32\kconvert.dll
2008-03-29 15:20 . 07-06-19 10:27 233,472 --a------ C:\WINNT\system32\REX Shared Library.dll
2008-03-27 12:17 . 03-12-06 16:35 486,400 --a------ C:\WINNT\system\dbghelp.dll
2008-03-26 11:55 . 08-03-26 11:55 <DIR> d-------- C:\Program Files\Genwave
2008-03-19 16:04 . 08-03-19 16:04 <DIR> d-------- C:\Program Files\ESET
2008-03-19 16:04 . 08-03-19 16:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-03-19 15:18 . 08-03-19 15:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-03-14 19:34 . 03-06-19 21:05 148,208 --a------ C:\WINNT\system32\drivers\portcls.sys
2008-03-14 19:34 . 03-06-19 21:05 148,208 --a--c--- C:\WINNT\system32\dllcache\portcls.sys
2008-03-14 19:34 . 03-06-19 21:05 21,264 --a------ C:\WINNT\system32\wdmaud.drv
2008-03-11 00:48 . 08-04-30 20:51 29 d-a------ C:\WINNT\.
2008-03-05 23:06 . 08-03-05 23:06 0 --ah----- C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2C0ADD4DD.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-30 18:14 --------- d-----w C:\Program Files\Eye On Network
2008-04-30 17:31 19,823 ----a-w C:\WINNT\system32\drivers\fwdrv.err
2008-04-30 17:23 --------- d-----w C:\Program Files\AAMS
2008-04-30 13:10 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\utorrent
2008-04-29 06:52 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-28 17:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-28 17:00 9,344 ----a-w C:\WINNT\system32\drivers\NSDriver.sys
2008-04-28 17:00 8,064 ----a-w C:\WINNT\system32\drivers\AWRTRD.sys
2008-04-28 16:23 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\OfficeUpdate12
2008-04-27 10:18 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\data
2008-04-27 09:45 --------- d-----w C:\Program Files\Sonik Synth 2
2008-04-26 19:37 4 ----a-w C:\miracle.sys
2008-04-26 19:10 0 ----a-w C:\DMguard.dll
2008-04-26 18:46 --------- d-----w C:\Program Files\Common Files
2008-04-26 18:35 --------- d-----w C:\Program Files\Fichiers communs\Native Instruments
2008-04-26 18:34 --------- d-----w C:\Program Files\Native Instruments
2008-04-26 16:46 --------- d-----w C:\Program Files\Steinberg
2008-04-26 09:55 --------- d-----w C:\Program Files\Macromedia
2008-04-26 09:07 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\SmartFTP
2008-04-25 08:12 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-04-24 20:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 18:46 --------- d-----w C:\Program Files\HomePlayer1.5.1.2
2008-04-20 07:04 --------- d-----w C:\Program Files\eMule
2008-04-17 13:49 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\FXpansion
2008-04-17 06:24 --------- d-----w C:\Program Files\FXpansion
2008-04-16 12:45 --------- d-----w C:\Program Files\Nomad Factory
2008-04-16 11:42 --------- d-----w C:\Program Files\Google
2008-04-11 09:26 --------- d-----w C:\Program Files\NuGen Audio
2008-04-07 08:35 --------- d-----w C:\Program Files\Waves
2008-04-01 08:04 --------- d-----w C:\Program Files\IK Multimedia
2008-03-29 17:58 --------- d-----w C:\Program Files\iZotope
2008-03-29 17:32 --------- d-----w C:\Program Files\PSPaudioware
2008-03-27 10:09 --------- d-----w C:\Program Files\Best Service
2008-03-26 10:38 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\dvdcss
2008-03-20 08:15 --------- d-----w C:\Program Files\Java
2008-03-18 16:27 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\Audio Ease
2008-03-15 16:48 --------- d-----w C:\Program Files\Antares Audio Technologies
2008-02-19 16:27 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2E8864D0F.sys
2008-02-17 20:23 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D232414DDE.sys
2008-01-13 11:31 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D258C6F58A.sys
2008-01-13 11:30 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D258C6F589.sys
2007-12-29 20:29 880,293 ----a-w C:\Documents and Settings\Laurent Worms\Y.dat
2007-12-29 20:29 452,479 ----a-w C:\Documents and Settings\Laurent Worms\W.dat
2007-11-15 10:51 21 ----a-w C:\Documents and Settings\Laurent Worms\Application Data\iasna_27FE67F6-017D-4123-8E81-713889A5DAC0.dll
2007-07-29 08:10 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D228CEB20A.sys
2007-07-08 22:16 148 ----a-w C:\Program Files\setuplog.txt
2007-06-28 16:12 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D29D34FFEA.sys
2007-06-27 14:34 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2BF986FC1.sys
2007-06-27 14:34 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2BF986FC0.sys
2007-06-27 14:33 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D26E113FCC.sys
2007-06-27 14:32 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D26E113FCB.sys
2007-06-21 15:42 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2D8910D51.sys
2007-06-21 15:42 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2571BECEE.sys
2007-06-21 15:42 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2571BECED.sys
2007-06-21 15:42 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D206385595.sys
2007-06-21 15:41 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2D8910D50.sys
2007-06-21 15:41 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D272B730B3.sys
2007-06-21 14:39 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD7.sys
2007-06-21 14:39 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD6.sys
2007-06-21 14:38 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD5.sys
2007-06-21 14:37 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD4.sys
2007-06-21 14:32 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD3.sys
2007-06-21 14:08 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD2.sys
2007-06-20 14:18 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2EEEA39DE.sys
2007-06-20 14:17 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2859F7D89.sys
2007-06-20 14:16 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2ABB8C36B.sys
2007-06-20 13:58 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D24A84BAF5.sys
2007-06-20 13:58 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D24A84BAF4.sys
2007-06-20 13:44 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D24A06AB74.sys
2007-06-20 13:43 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D24A06AB73.sys
2007-06-20 13:36 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D26659B183.sys
2007-05-11 21:33 86,528 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\rbap500.dll
2007-05-11 21:33 73,728 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\rbqt500.DLL
2007-05-11 21:33 43,520 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\MBSCFPlugin2509.dll
2007-05-11 21:33 36,352 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\MiconoSoundEqualizer.DLL
2007-05-11 21:33 35,840 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\MBSCarbonEventsPlugin2509.dll
2007-05-11 21:33 26,112 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\MBSRegistrationPlugin2455.dll
2006-09-03 20:05 123,964 ----a-w C:\Program Files\Lolo-Studio16ème-04.acp
2005-10-10 04:40 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2005-05-24 22:47 1,834 ----a-w C:\Program Files\uninstal.log
2004-01-25 15:53 271 ---h--w C:\Program Files\desktop.ini
2004-01-25 15:53 22,115 ---h--w C:\Program Files\folder.htt
2003-08-25 12:46 473 ----a-w C:\Documents and Settings\Laurent Worms\layout.bin
2007-11-29 22:31 479,232 ----a-w C:\Program Files\mozilla firefox\plugins\msvcm80.dll
2007-11-29 22:31 548,864 ----a-w C:\Program Files\mozilla firefox\plugins\msvcp80.dll
2007-11-29 22:31 626,688 ----a-w C:\Program Files\mozilla firefox\plugins\msvcr80.dll
2007-10-24 14:40 8 --sha-w C:\WINNT\sndxms32.drv
2005-08-03 14:16 1,890 --sha-w C:\WINNT\system32\KGyGaAvL.sys
.

------- Sigcheck -------

05-03-21 15:13 11264 ab176f2171db704d51b8809e8a5c38bd C:\WINNT\system32\CTFMON.EXE
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87349ADB-7A0C-4625-9E13-A2BFE018794D}]
08-04-25 12:20 273920 --------- C:\WINNT\system32\cbXOEwVl.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="ctfmon.exe" [05-03-21 15:13 11264 C:\WINNT\system32\CTFMON.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 21:05 111888 C:\WINNT\system32\mobsync.exe]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [03-05-15 16:45 114688]
"Cloneur Expert Monitor"="C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [04-11-30 18:42 508582]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [06-09-22 17:51 817976]
"Eye On Network"="C:\Program Files\Eye On Network\Eye On Network.exe" [03-09-13 19:47 1553920]
"Acronis Scheduler2 Service"="C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [04-11-30 18:42 65536]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [08-02-20 12:06 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 21:05 189712]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MacDrive-iTunes compatibility]
C:\Program Files\Fichiers communs\Mediafour\MacDriveiTunesPatch.dll 03-11-07 11:24 61440 C:\Program Files\Fichiers communs\Mediafour\MacDriveiTunesPatch.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"midi9"= xgusb.cpl
"msacm.l3acm"= l3codecp.acm
"vidc.xvid"= xvid.dll
"vidc.div3"= DivXc32.dll
"vidc.div4"= DivXc32f.dll
"vidc.CDVC"= cdvccodc.dll
"VIDC.MSZH"= AVIMSZH.DLL
"midi"= gmidi.dll
"midi2"= usbmn2x2.dll
"wave7"= Echo3GWrap.dll
"midi4"= KORGUMDD.DRV

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

R0 d346bus;d346bus;C:\WINNT\system32\DRIVERS\d346bus.sys [04-03-12 23:41 ]
R0 d346prt;d346prt;C:\WINNT\system32\Drivers\d346prt.sys [04-03-12 23:41 ]
R0 MDPMGRNT;MDPMGRNT;C:\WINNT\system32\drivers\MDPMGRNT.sys [03-11-05 17:06 ]
R0 Si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINNT\system32\DRIVERS\si3112r.sys [06-01-12 12:56 ]
R1 Asapi;Asapi;C:\WINNT\system32\drivers\Asapi.sys [02-04-17 20:27 ]
R1 epfwtdir;epfwtdir;C:\WINNT\system32\DRIVERS\epfwtdir.sys [08-02-20 12:11 ]
R1 fwdrv;Firewall Driver;C:\WINNT\system32\drivers\fwdrv.sys [07-04-26 10:21 ]
R1 khips;Kerio HIPS Driver;C:\WINNT\system32\drivers\khips.sys [07-04-26 10:21 ]
R2 tcaicchg;tcaicchg;C:\WINNT\system32\tcaicchg.sys [00-06-06 05:08 ]
R2 TCAITDI;TCAITDI Protocol;C:\WINNT\system32\DRIVERS\TCAITDI.sys [01-09-03 22:22 ]
R2 TSKNF501.SYS;TSKNF501.SYS;C:\WINNT\system32\Drivers\TSKNF501.SYS [02-12-03 00:57 ]
R2 Windows service sysklog;Windows service sysklog;C:\WINNT\System32\winss.exe [08-04-24 22:14 ]
R3 echo3g;Echo3G Service;C:\WINNT\system32\drivers\echo3g.sys [07-10-06 01:08 ]
R3 openhci;Pilote de contrôleur hôte ouvert USB Microsoft;C:\WINNT\system32\DRIVERS\openhci.sys [03-06-19 21:05 ]
R3 usbhub20;Prise en charge du concentrateur racine USB 2.0;C:\WINNT\system32\DRIVERS\usbhub20.sys [03-06-19 21:05 ]
R3 USBMN2X2;M-Audio USB MidiSport 2x2;C:\WINNT\system32\drivers\usbmn2x2.sys [07-05-21 16:47 ]
R3 yukonw2k;NDIS5 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter;C:\WINNT\system32\DRIVERS\yukonw2k.sys [03-10-23 07:28 ]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINNT\system32\regedt32.exe [03-06-19 21:05 ]
S2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [07-04-26 10:21 ]
S3 EWAVE;EWAVE;C:\WINNT\system32\drivers\ew.sys [06-12-10 02:08 ]
S3 fbxusb;FreeBox USB Network Adapter;C:\WINNT\system32\DRIVERS\fbxusb.sys [03-12-31 12:35 ]
S3 FILESPY;FILESPY;C:\WINNT\system32\drivers\FILESPY.sys [06-12-10 02:08 ]
S3 hpoid407;IEEE-1284.4 Driver hpoid407;C:\WINNT\system32\DRIVERS\hpoid407.sys [01-03-29 16:38 ]
S3 hpoius07;USB to IEEE-1284.4 Translation Driver hpoius07;C:\WINNT\system32\DRIVERS\hpoius07.sys [01-03-29 16:34 ]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows XP;C:\WINNT\system32\Drivers\KORGUMDS.SYS [06-05-16 02:08 ]
S3 MADWARE;MadPlayer driver (2000, Xp);C:\WINNT\system32\Drivers\madmidi.sys [03-04-08 16:09 ]
S3 MDFSYSNT;MDFSYSNT;C:\WINNT\system32\drivers\MDFSYSNT.sys [03-10-07 14:38 ]
S3 NPF;NetGroup Packet Filter Driver;C:\WINNT\system32\drivers\npf.sys [06-05-09 17:50 ]
S3 NSTATION;NSTATION;C:\WINNT\system32\drivers\nstation.sys [06-12-10 02:08 ]
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINNT\system32\DRIVERS\ss_bus.sys [05-01-24 16:38 ]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINNT\system32\DRIVERS\ss_mdfl.sys [05-01-24 16:38 ]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINNT\system32\DRIVERS\ss_mdm.sys [05-01-24 16:38 ]
S3 USB22LDR;M-Audio USB MidiSport 2x2 Loader;C:\WINNT\system32\drivers\usb22ldr.sys [07-05-21 16:47 ]
S3 UsbSagCom;SAGEM Full USB Driver;C:\WINNT\system32\DRIVERS\UsbSagCom.sys [06-03-27 11:29 ]
S3 voxthing;Voice Thing service;C:\WINNT\system32\drivers\voxthing.sys [07-07-20 15:30 ]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-02-16 09:54:16 C:\WINNT\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-30 20:51:44
Windows 5.0.2195 Service Pack 4 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-30 21:01:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-30 19:01:21

Pre-Run: 77,213,057,024 octets libres
Post-Run: 77,122,494,464 octets libres

272

gen-hackman · Answer

ben alors il est ou celui qui s y connait?

Le sioux · Answer

Bonsoir tout le monde

En effet, l'utilisation de ComboFix etait necessaire, reste un CFScript à rediger pour parfaire le nettoyage.

ben alors il est ou celui qui s y connait?  ... Gen hackman, laisse jlpjlp finir le travail et evite de faire du mauvais esprit, cela ne fait pas avancer les choses ...

Merci.

gen-hackman · Answer

certes pardon c etait mal place

jlpjlp · Answer

telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs ! 



Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :




File::
C:\WINNT\system32\cbXOEwVl.dll 


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87349ADB-7A0C-4625-9E13-A2BFE018794D}]

 




Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

silverknight · Answer

Bonjour à tous,

J'ai une bonne nouvelle, la dll cbXOEwVl.dll a disparu alors que je n'avais pas encore tenté la solution de jlpjlp. C'est sans doute grâce à vous même si je ne comprends pas bien ce qu'il s'est passé (je pense sans en être sûr que mon antivirus s'est mis à jour seul et a trouvé la parade mais cela m'étonne). Du côté d'Internet Explorer je n'ai plus aucun problème de fenêtre intempestives.

Avant de clôturer ce sujet en résolu, j'ai vu qu'il restait dans le registre la clé

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87349ADB-7A0C-4625-9E13-A2BFE018794D}]

dois-je l'enlever comme tu me le préconises jlpjlp ?

Voici également ci-dessous les rapports hijakchtis et combofix (réalisé en mode sans échec). En tout cas un grand merci à tous pour votre aide et votre rapidité, vous êtes des pros !

COMBOFIX

ComboFix 08-04-29.5 - Laurent Worms 2008-05-01 13:36:37.3 - NTFSx86 MINIMAL
Microsoft Windows 2000 Professionnel 5.0.2195.4.1252.1.1036.18.1791 [GMT 2:00]
Endroit: C:\Documents and Settings\Laurent Worms\Bureau\Comb-Fx.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.

((((((((((((((((((((((((((((( Fichiers créés 2008-04-01 to 2008-05-01 ))))))))))))))))))))))))))))))))))))
.

2008-05-01 13:36 . 08-05-01 13:36 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_204.dat
2008-04-30 19:30 . 08-04-30 19:30 <DIR> d-------- C:\_OTMoveIt
2008-04-30 19:03 . 08-04-30 19:03 <DIR> d-------- C:\Program Files\apulSoft
2008-04-30 17:49 . 07-09-15 01:24 17,920 --a------ C:\WINNT\system32\reg.exe
2008-04-30 17:47 . 08-04-30 20:03 <DIR> d-------- C:\Program Files\Navilog1
2008-04-30 13:33 . 08-04-30 13:33 <DIR> d-------- C:\Documents and Settings\Laurent Worms\Application Data\Malwarebytes
2008-04-30 13:32 . 08-04-30 13:33 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-30 13:32 . 08-04-30 13:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-30 08:34 . 08-05-01 13:32 1,346,470 ---h----- C:\WINNT\ShellIconCache
2008-04-29 23:13 . 08-04-29 23:13 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-29 08:51 . 08-04-29 08:52 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-26 21:31 . 08-04-26 21:31 5 --a------ C:\WINNT\dhopfedf.ini
2008-04-26 18:46 . 08-04-26 18:46 <DIR> d-------- C:\Program Files\intermorphic
2008-04-26 18:46 . 08-04-26 18:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\intermorphic
2008-04-26 17:46 . 08-04-26 17:46 0 --a------ C:\WINNT\PROTOCOL.INI
2008-04-26 17:45 . 08-04-26 17:45 <DIR> d-------- C:\Program Files\Pinguin
2008-04-25 12:20 . 08-04-28 15:11 109,757 --a------ C:\WINNT\BM53b63637.xml
2008-04-25 11:58 . 08-04-25 11:58 <DIR> d-------- C:\Program Files\Natura
2008-04-25 10:13 . 08-04-26 11:56 <DIR> d-------- C:\Program Files\Fichiers communs\Macromedia
2008-04-24 22:14 . 08-05-01 00:04 <DIR> d-------- C:\WINNT\system32\sysklog
2008-04-24 22:14 . 08-04-24 22:14 98,304 --a------ C:\WINNT\system32\winss.exe
2008-04-24 22:14 . 08-04-24 22:14 34,304 --a------ C:\WINNT\system32\ntsvc.ocx
2008-04-24 10:04 . 08-03-03 14:25 5,702 --ah----- C:\WINNT\nod32restoretemdono.reg
2008-04-24 10:04 . 08-03-03 18:21 568 --ah----- C:\WINNT\nod32fixtemdono.reg
2008-04-16 13:58 . 08-04-16 14:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania
2008-04-16 13:54 . 08-04-16 13:56 <DIR> d-------- C:\Program Files\TmNationsForever
2008-04-11 18:34 . 08-04-11 18:34 <DIR> d-------- C:\Program Files\MSECache
2008-04-11 11:32 . 08-04-11 11:32 23 --a------ C:\Documents and Settings\Laurent Worms\Application Data\iasna_F4F01109-B336-401f-BDE2-7C1926744120.dll
2008-04-11 11:32 . 08-04-11 11:32 21 --a------ C:\Documents and Settings\Laurent Worms\Application Data\iasna_DAA2EFCB-59BE-41d2-8BA5-20B0E5C039A7.dll
2008-04-11 11:32 . 08-04-11 11:32 21 --a------ C:\Documents and Settings\Laurent Worms\Application Data\iasna_47B68C20-EB2E-4320-B75D-71EEF7A96EB7.dll
2008-04-11 11:32 . 08-04-11 11:32 21 --a------ C:\Documents and Settings\Laurent Worms\Application Data\iasna_27FE67F6-017D-4123-8E81-713889A5DAC1.dll
2008-04-11 08:51 . 08-04-11 08:51 14 --a------ C:\WINNT\system32\odbcloc.tlb
2008-04-11 08:50 . 08-04-11 09:05 <DIR> d-------- C:\Program Files\Atmosphere Deluxe
2008-04-11 08:50 . 04-10-18 14:04 161,280 --a------ C:\WINNT\system32\fmod.dll
2008-04-11 08:50 . 06-03-03 23:09 90,112 --a------ C:\WINNT\system32\kcommobj.ocx
2008-04-11 08:50 . 06-08-24 02:15 90,112 --a------ C:\WINNT\system32\dgwaveedit.ocx
2008-04-11 08:50 . 99-09-09 01:51 40,208 --a------ C:\WINNT\system32\dsetup.dll
2008-04-10 19:00 . 08-04-10 19:07 <DIR> d-------- C:\Program Files\Atmosphere Lite
2008-04-10 19:00 . 05-11-07 01:14 366,080 --a------ C:\WINNT\system32\vbskfr2.ocx
2008-04-10 19:00 . 04-07-08 02:40 311,296 --a------ C:\WINNT\system32\puma lcd simulator v7.ocx
2008-04-10 19:00 . 04-10-25 18:19 151,552 --a------ C:\WINNT\system32\dxvumeter3.ocx
2008-04-10 19:00 . 05-11-09 02:35 69,632 --a------ C:\WINNT\system32\webupdate.ocx
2008-04-10 19:00 . 05-11-09 02:35 40,960 --a------ C:\WINNT\system32\akprogressbar.ocx
2008-04-10 19:00 . 04-05-25 23:24 35,840 --a------ C:\WINNT\system32\xfxslider.ocx
2008-04-01 10:04 . 08-01-17 12:00 53,248 --a------ C:\WINNT\system32\IKStompIO1API.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-01 11:33 19,986 ----a-w C:\WINNT\system32\drivers\fwdrv.err
2008-05-01 08:48 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\utorrent
2008-04-30 18:59 --------- d-----w C:\Program Files\Eye On Network
2008-04-30 17:23 --------- d-----w C:\Program Files\AAMS
2008-04-29 06:52 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-28 17:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-28 17:00 9,344 ----a-w C:\WINNT\system32\drivers\NSDriver.sys
2008-04-28 17:00 8,064 ----a-w C:\WINNT\system32\drivers\AWRTRD.sys
2008-04-28 17:00 12,632 ----a-w C:\WINNT\system32\lsdelete.exe
2008-04-28 16:23 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\OfficeUpdate12
2008-04-27 10:18 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\data
2008-04-27 09:45 --------- d-----w C:\Program Files\Sonik Synth 2
2008-04-26 19:37 4 ----a-w C:\miracle.sys
2008-04-26 19:10 0 ----a-w C:\DMguard.dll
2008-04-26 18:46 --------- d-----w C:\Program Files\Common Files
2008-04-26 18:35 --------- d-----w C:\Program Files\Fichiers communs\Native Instruments
2008-04-26 18:34 --------- d-----w C:\Program Files\Native Instruments
2008-04-26 16:46 --------- d-----w C:\Program Files\Steinberg
2008-04-26 09:55 --------- d-----w C:\Program Files\Macromedia
2008-04-26 09:07 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\SmartFTP
2008-04-25 08:12 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-04-24 20:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 18:46 --------- d-----w C:\Program Files\HomePlayer1.5.1.2
2008-04-20 07:04 --------- d-----w C:\Program Files\eMule
2008-04-17 13:49 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\FXpansion
2008-04-17 06:24 --------- d-----w C:\Program Files\FXpansion
2008-04-16 12:45 --------- d-----w C:\Program Files\Nomad Factory
2008-04-16 11:42 --------- d-----w C:\Program Files\Google
2008-04-11 09:26 --------- d-----w C:\Program Files\NuGen Audio
2008-04-07 08:35 --------- d-----w C:\Program Files\Waves
2008-04-01 08:04 --------- d-----w C:\Program Files\IK Multimedia
2008-03-29 17:58 --------- d-----w C:\Program Files\iZotope
2008-03-29 17:32 --------- d-----w C:\Program Files\PSPaudioware
2008-03-27 10:09 --------- d-----w C:\Program Files\Best Service
2008-03-26 10:38 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\dvdcss
2008-03-26 09:55 --------- d-----w C:\Program Files\Genwave
2008-03-20 10:22 1,644,208 ----a-w C:\WINNT\system32\WIN32K.SYS
2008-03-20 08:15 --------- d-----w C:\Program Files\Java
2008-03-19 14:04 --------- d-----w C:\Program Files\ESET
2008-03-19 14:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-03-19 13:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-03-18 16:27 --------- d-----w C:\Documents and Settings\Laurent Worms\Application Data\Audio Ease
2008-03-15 16:48 --------- d-----w C:\Program Files\Antares Audio Technologies
2008-03-05 21:06 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2C0ADD4DD.sys
2008-02-26 18:54 180,224 ----a-w C:\WINNT\system32\PolyOptionsDialog.dll
2008-02-19 17:09 236,304 ----a-w C:\WINNT\system32\GDI32.DLL
2008-02-19 16:27 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2E8864D0F.sys
2008-02-17 20:23 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D232414DDE.sys
2008-02-15 14:26 581,120 ----a-w C:\WINNT\system32\WININET.DLL
2008-02-15 13:24 96,528 ----a-w C:\WINNT\system32\dnsrslvr.dll
2008-02-07 09:52 413,048 ----a-w C:\WINNT\system32\SpoonUninstall.exe
2008-01-13 11:31 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D258C6F58A.sys
2008-01-13 11:30 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D258C6F589.sys
2007-12-29 20:29 880,293 ----a-w C:\Documents and Settings\Laurent Worms\Y.dat
2007-12-29 20:29 452,479 ----a-w C:\Documents and Settings\Laurent Worms\W.dat
2007-11-15 10:51 21 ----a-w C:\Documents and Settings\Laurent Worms\Application Data\iasna_27FE67F6-017D-4123-8E81-713889A5DAC0.dll
2007-07-29 08:10 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D228CEB20A.sys
2007-07-08 22:16 148 ----a-w C:\Program Files\setuplog.txt
2007-06-28 16:12 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D29D34FFEA.sys
2007-06-27 14:34 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2BF986FC1.sys
2007-06-27 14:34 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2BF986FC0.sys
2007-06-27 14:33 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D26E113FCC.sys
2007-06-27 14:32 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D26E113FCB.sys
2007-06-21 15:42 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2D8910D51.sys
2007-06-21 15:42 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2571BECEE.sys
2007-06-21 15:42 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2571BECED.sys
2007-06-21 15:42 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D206385595.sys
2007-06-21 15:41 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2D8910D50.sys
2007-06-21 15:41 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D272B730B3.sys
2007-06-21 14:39 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD7.sys
2007-06-21 14:39 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD6.sys
2007-06-21 14:38 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD5.sys
2007-06-21 14:37 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD4.sys
2007-06-21 14:32 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD3.sys
2007-06-21 14:08 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D221B25AD2.sys
2007-06-20 14:18 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2EEEA39DE.sys
2007-06-20 14:17 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2859F7D89.sys
2007-06-20 14:16 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D2ABB8C36B.sys
2007-06-20 13:58 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D24A84BAF5.sys
2007-06-20 13:58 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D24A84BAF4.sys
2007-06-20 13:44 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D24A06AB74.sys
2007-06-20 13:43 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D24A06AB73.sys
2007-06-20 13:36 0 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\.CAA735D26659B183.sys
2007-05-11 21:33 86,528 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\rbap500.dll
2007-05-11 21:33 73,728 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\rbqt500.DLL
2007-05-11 21:33 43,520 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\MBSCFPlugin2509.dll
2007-05-11 21:33 36,352 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\MiconoSoundEqualizer.DLL
2007-05-11 21:33 35,840 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\MBSCarbonEventsPlugin2509.dll
2007-05-11 21:33 26,112 ---ha-w C:\Documents and Settings\Laurent Worms\Application Data\MBSRegistrationPlugin2455.dll
2006-09-03 20:05 123,964 ----a-w C:\Program Files\Lolo-Studio16ème-04.acp
2005-10-10 04:40 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2005-05-24 22:47 1,834 ----a-w C:\Program Files\uninstal.log
2004-01-25 15:53 271 ---h--w C:\Program Files\desktop.ini
2004-01-25 15:53 22,115 ---h--w C:\Program Files\folder.htt
2003-08-25 12:46 473 ----a-w C:\Documents and Settings\Laurent Worms\layout.bin
2000-04-18 12:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys
2007-11-29 22:31 479,232 ----a-w C:\Program Files\mozilla firefox\plugins\msvcm80.dll
2007-11-29 22:31 548,864 ----a-w C:\Program Files\mozilla firefox\plugins\msvcp80.dll
2007-11-29 22:31 626,688 ----a-w C:\Program Files\mozilla firefox\plugins\msvcr80.dll
2007-10-24 14:40 8 --sha-w C:\WINNT\sndxms32.drv
2005-08-03 14:16 1,890 --sha-w C:\WINNT\system32\KGyGaAvL.sys
.

------- Sigcheck -------

05-03-21 15:13 11264 ab176f2171db704d51b8809e8a5c38bd C:\WINNT\system32\CTFMON.EXE
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87349ADB-7A0C-4625-9E13-A2BFE018794D}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="ctfmon.exe" [05-03-21 15:13 11264 C:\WINNT\system32\CTFMON.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 21:05 111888 C:\WINNT\system32\mobsync.exe]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [03-05-15 16:45 114688]
"Cloneur Expert Monitor"="C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" [04-11-30 18:42 508582]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [06-09-22 17:51 817976]
"Eye On Network"="C:\Program Files\Eye On Network\Eye On Network.exe" [03-09-13 19:47 1553920]
"Acronis Scheduler2 Service"="C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe" [04-11-30 18:42 65536]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [08-02-20 12:06 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 21:05 189712]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoStartMenuMFUprogramsList"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MacDrive-iTunes compatibility]
C:\Program Files\Fichiers communs\Mediafour\MacDriveiTunesPatch.dll 03-11-07 11:24 61440 C:\Program Files\Fichiers communs\Mediafour\MacDriveiTunesPatch.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"midi9"= xgusb.cpl
"msacm.l3acm"= l3codecp.acm
"vidc.xvid"= xvid.dll
"vidc.div3"= DivXc32.dll
"vidc.div4"= DivXc32f.dll
"vidc.CDVC"= cdvccodc.dll
"VIDC.MSZH"= AVIMSZH.DLL
"midi"= gmidi.dll
"midi2"= usbmn2x2.dll
"wave7"= Echo3GWrap.dll
"midi4"= KORGUMDD.DRV

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

R0 d346bus;d346bus;C:\WINNT\system32\DRIVERS\d346bus.sys [04-03-12 23:41 ]
R0 d346prt;d346prt;C:\WINNT\system32\Drivers\d346prt.sys [04-03-12 23:41 ]
R0 MDPMGRNT;MDPMGRNT;C:\WINNT\system32\drivers\MDPMGRNT.sys [03-11-05 17:06 ]
R0 Si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINNT\system32\DRIVERS\si3112r.sys [06-01-12 12:56 ]
R1 Asapi;Asapi;C:\WINNT\system32\drivers\Asapi.sys [02-04-17 20:27 ]
R1 fwdrv;Firewall Driver;C:\WINNT\system32\drivers\fwdrv.sys [07-04-26 10:21 ]
R3 openhci;Pilote de contrôleur hôte ouvert USB Microsoft;C:\WINNT\system32\DRIVERS\openhci.sys [03-06-19 21:05 ]
R3 usbhub20;Prise en charge du concentrateur racine USB 2.0;C:\WINNT\system32\DRIVERS\usbhub20.sys [03-06-19 21:05 ]
S1 epfwtdir;epfwtdir;C:\WINNT\system32\DRIVERS\epfwtdir.sys [08-02-20 12:11 ]
S1 khips;Kerio HIPS Driver;C:\WINNT\system32\drivers\khips.sys [07-04-26 10:21 ]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINNT\system32\regedt32.exe [03-06-19 21:05 ]
S2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [07-04-26 10:21 ]
S2 tcaicchg;tcaicchg;C:\WINNT\system32\tcaicchg.sys [00-06-06 05:08 ]
S2 TCAITDI;TCAITDI Protocol;C:\WINNT\system32\DRIVERS\TCAITDI.sys [01-09-03 22:22 ]
S2 TSKNF501.SYS;TSKNF501.SYS;C:\WINNT\system32\Drivers\TSKNF501.SYS [02-12-03 00:57 ]
S2 Windows service sysklog;Windows service sysklog;C:\WINNT\System32\winss.exe [08-04-24 22:14 ]
S3 echo3g;Echo3G Service;C:\WINNT\system32\drivers\echo3g.sys [07-10-06 01:08 ]
S3 EWAVE;EWAVE;C:\WINNT\system32\drivers\ew.sys [06-12-10 02:08 ]
S3 fbxusb;FreeBox USB Network Adapter;C:\WINNT\system32\DRIVERS\fbxusb.sys [03-12-31 12:35 ]
S3 FILESPY;FILESPY;C:\WINNT\system32\drivers\FILESPY.sys [06-12-10 02:08 ]
S3 hpoid407;IEEE-1284.4 Driver hpoid407;C:\WINNT\system32\DRIVERS\hpoid407.sys [01-03-29 16:38 ]
S3 hpoius07;USB to IEEE-1284.4 Translation Driver hpoius07;C:\WINNT\system32\DRIVERS\hpoius07.sys [01-03-29 16:34 ]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows XP;C:\WINNT\system32\Drivers\KORGUMDS.SYS [06-05-16 02:08 ]
S3 MADWARE;MadPlayer driver (2000, Xp);C:\WINNT\system32\Drivers\madmidi.sys [03-04-08 16:09 ]
S3 MDFSYSNT;MDFSYSNT;C:\WINNT\system32\drivers\MDFSYSNT.sys [03-10-07 14:38 ]
S3 NPF;NetGroup Packet Filter Driver;C:\WINNT\system32\drivers\npf.sys [06-05-09 17:50 ]
S3 NSTATION;NSTATION;C:\WINNT\system32\drivers\nstation.sys [06-12-10 02:08 ]
S3 ss_bus;Samsung Mobile USB Device 1.0 driver (WDM);C:\WINNT\system32\DRIVERS\ss_bus.sys [05-01-24 16:38 ]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINNT\system32\DRIVERS\ss_mdfl.sys [05-01-24 16:38 ]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINNT\system32\DRIVERS\ss_mdm.sys [05-01-24 16:38 ]
S3 USB22LDR;M-Audio USB MidiSport 2x2 Loader;C:\WINNT\system32\drivers\usb22ldr.sys [07-05-21 16:47 ]
S3 USBMN2X2;M-Audio USB MidiSport 2x2;C:\WINNT\system32\drivers\usbmn2x2.sys [07-05-21 16:47 ]
S3 UsbSagCom;SAGEM Full USB Driver;C:\WINNT\system32\DRIVERS\UsbSagCom.sys [06-03-27 11:29 ]
S3 voxthing;Voice Thing service;C:\WINNT\system32\drivers\voxthing.sys [07-07-20 15:30 ]
S3 yukonw2k;NDIS5 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter;C:\WINNT\system32\DRIVERS\yukonw2k.sys [03-10-23 07:28 ]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-02-16 09:54:16 C:\WINNT\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-01 13:39:26
Windows 5.0.2195 Service Pack 4 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-05-01 13:46:54
ComboFix-quarantined-files.txt 2008-05-01 11:46:52
ComboFix2.txt 2008-04-30 19:01:29

Pre-Run: 77,005,938,688 octets libres
Post-Run: 76,991,320,064 octets libres

257

HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:21:58, on 01/05/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\WINNT\system32\crypserv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Eye On Network\Eye On Network.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\oodag.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINNT\System32\winss.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Trend Micro\HijackThis\MyProg.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {87349ADB-7A0C-4625-9E13-A2BFE018794D} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Eye On Network] C:\Program Files\Eye On Network\Eye On Network.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\system32\shdocvw.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/software
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
O16 - DPF: {A06BE318-C096-11D4-964F-0010A4D06F69} (TeleTVA Control) - https://tva.dgi.minefi.gouv.fr/activeX/TeleTVA.tva
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f003.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.streamload.com/Upload/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{8DC60D79-CF22-408D-AFC4-BA3892DB2549}: NameServer = 212.27.54.252,212.27.53.252
O20 - Winlogon Notify: MacDrive-iTunes compatibility - C:\Program Files\Fichiers communs\Mediafour\MacDriveiTunesPatch.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINNT\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Windows service sysklog - Dreamy - C:\WINNT\System32\winss.exe

jlpjlp · Answer

fais le message 17 et la clé du registre sera virée sinon fais le manuellement


___________

comme tu as  Windows 2000 SP4

utilise de preference firefox ou opera ou safari pour aller sur le net

http://www.mozilla-europe.org/fr/products/firefox/

______________

tu peux utilser ccleaner pour virer les traces des infections ( et le garder pour virer tes traces de surf regulierement)
https://www.malekal.com/tutoriel-ccleaner/


bonne suite

silverknight · Answer

Comme me l'a conseillé jlpjlp, l, j'ai réussi à enlever manuellement la clé :

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87349ADB-7A0C-4625-9E13-A2BFE018794D}]

et j'ai vérifié après redémarrage sa disparition.

Merci beaucoup jlpjlp pour ton aide précieuse, tu m'as été d'un grand secours !

 J'ai du mal à comprendre ce qui a marché (ça doit être l'ensemble des techniques), mais je marque le problème comme résolu.

Bon week-end à tous,

Laurent.

Troyen Vundo - cbXOEwVl.dll toujours présente

18 réponses

Discussions similaires

Newsletters