trojan, abebot, wml.exeRésolu/Fermé

Question

Bonjour, j'ai un problème car ma connexion est ralentie, il y a des pages de publicités qui s'ouvrent à tous les 5 min, et j'ai des alertes : 
-> une page qui s'ouvre Security System Warning rouge indiquant File: c:/windows/wml.exe threat : abebot il y a associé a cette page un lien ammenant vers une page vantant la pub pour des anti-spyware 
-> Une page nommée System IntegrityScan Wizard s'ouvre indicant Warning: Your computer may have critical errors in windows registry and file system! 
->triangle jaune avec point d'exclamation en bas a droite dans ma barre de tâche qui m'amène à une page d'anti-spyware.

J'ai utilisé hijackthis, voici le résultat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:58:13, on 5/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe
C:\Program Files
etwork associates\common framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\PROT_SRV.EXE
C:\WINDOWS\system32\pagents.exe
C:\WINDOWS\system32\PSTARTSR.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files
etwork associates\common framework\McScript_InUse.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\yperajyz\sjefazez.exe
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe
C:\PROGRA~1\Protocom\SECURE~1\slbroker.exe
C:\Program Files\Pointsec\P95tray.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack	bmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files
etwork associates\common framework\UdaterUI.exe
C:\Program Files
etwork associates\common framework\McTray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ypyjkfop.exe
C:\Program Files\IG Advantage\Igconsys\ConSched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\gaumes1\Local Settings\Temporary Internet Files\Content.IE5\NB824KBN\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/Content/fr/default.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = igproxy.investorsgroup.com:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://home*.investorsgroup.com;https://businesslinkonwinfund.investorsgroup.com;*.ig.bz;*.iga.bz;*.gwl.ca;*.gwl.bz;*mycybrary.londonlife.com;*cybrary.londonlife.com;*.ll.bz;*.grsaccess.com;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: (no name) - {71ED0CAC-7FAC-49CD-9D12-A629F86A3937} - C:\WINDOWS\system32\wvUmnKAq.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: SecureLogin IESSO Browser Helper Object - {7DE7B623-A17E-4A0B-94BA-D1B3BA646792} - C:\Program Files\Protocom\SecureLogin\iesso.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9B0BF480-8B6D-4673-8749-3AD4EDA32BE7} - (no file)
O2 - BHO: (no name) - {CE86878F-D099-4FFC-A4DC-E51D192063B1} - C:\WINDOWS\system32\wvUkLBrR.dll
O2 - BHO: (no name) - {FA045C44-3704-4B1E-9F00-2BA816AED276} - C:\WINDOWS\system32\byXOgggh.dll (file missing)
O2 - BHO: (no name) - {FAA9380F-B3F3-4347-A8B1-43AB76169513} - (no file)
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SecureLogin] "C:\Program Files\Protocom\SecureLogin\slproto.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Protect Tray] "C:\Program Files\Pointsec\P95tray.exe"
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack	bmon.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files
etwork associates\common framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [d4573f8e] rundll32.exe "C:\WINDOWS\system32\aynfbhkl.dll",b
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [oqovlkiy] C:\WINDOWS\system32\ypyjkfop.exe
O4 - HKLM\..\Policies\Explorer\Run: [drrIu6967i] C:\Documents and Settings\All Users\Application Data\yperajyz\sjefazez.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Controleur de Connection GI.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\Software\..\Telephony: DomainName = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O20 - Winlogon Notify: wvUkLBrR - C:\WINDOWS\SYSTEM32\wvUkLBrR.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R)  NetStructure(TM) VPN Client (ICService) - Unknown owner - C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files
etwork associates\common framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Pointsec - Unknown owner - C:\WINDOWS\system32\PROT_SRV.EXE
O23 - Service: Pointsec update agent (Pointsec_agent) - Unknown owner - C:\WINDOWS\system32\pagents.exe
O23 - Service: Pointsec service start (Pointsec_start) - Unknown owner - C:\WINDOWS\system32\PSTARTSR.EXE

ep44 · Answer

Bonjour et bien venu sur CCM

pour commencer 

* Télécharge malwarebytes
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

=> Installe le 
=> Ensuite va en mode sans echec 


   Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
   Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel


=> Lance malwarebytes
=> Coche "Executer un examen complet"
=> Si tu es en présence d'une infection à la fin de l'examen clique sur "ok"
=> Clique sur Supprimer la sélection
=> Pour poster le rapport Clique sur l'onglet Rapports/Logs, sélectionne celui t'intéresse et clique sur Ouvrir
=> Fait copier coller et poste le rapport 

--------------------------

ensuite 

* Télécharge CCleaner 
https://filehippo.com/download_ccleaner/
=> Aide toi de ce tuto pour l'utiliser 
https://www.malekal.com/tutoriel-ccleaner/

--------------------------

Ensuite Télécharge BTFix 1.057 (de bibi26)
http://cluster1.easy-hebergement.net/
    * Décompresse l'archive sur ton Bureau
    * Ouvre le dossier BTFix
    * Double clique sur BTFix.exe
    * Clique sur Rechercher
    * Un rapport va apparaître, copie/colle-le dans ta prochaine réponse

---------------------------
ensuite 

Télécharge Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
=> déconnecte toi d'internet et ferme toutes tes applications.
=> désactive tes protections (antivirus, parefeu,antispyware)
=> Double-clic sur combofix,
=> Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
=> Attends que combofix ait terminé, un rapport sera créé. 
=> réactive ton parefeu, ton antivirus, la garde de ton antispyware
=> copie/colle le rapport C:\ComboFix.txt 

@+

gaumos1 · Answer

Je ne pouvais pas entrer sur windows en "mode sans échec" (à cause d'un mot de passe de réseau) alors je suis allé en "mode sans échec prise en charge réseau". J'espère que c'est correct.

Je laisse le rapport malwarebytes. Ils disaient que certains éléments ne pouvaient pas être effacés, et ils me demandaient de redémarrer l'ordinateur pour que le processus se termine, ce que j'ai fais.

Merci pour l'aide!


Malwarebytes' Anti-Malware 1.12
Version de la base de données: 723

Type de recherche: Examen complet (C:\|)
Eléments examinés: 87929
Temps écoulé: 23 minute(s), 55 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 29
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 44

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\wvUmnKAq.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\wvUkLBrR.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d4a80003-1518-4eee-9ed2-cab2c3792c26} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{d4a80003-1518-4eee-9ed2-cab2c3792c26} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{ce86878f-d099-4ffc-a4dc-e51d192063b1} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ce86878f-d099-4ffc-a4dc-e51d192063b1} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvuklbrr (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\uninstall (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b2-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b3-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b4-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b5-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b6-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b7-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488b9-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488ba-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2dc488bb-d891-101b-8652-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8996b0a1-d7be-101b-8650-00aa003a5593} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d4573f8e (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oqovlkiy (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\drrIu6967i (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{0656a137-b161-cadd-9777-e37a75727e78} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{ce86878f-d099-4ffc-a4dc-e51d192063b1} (Trojan.Vundo) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvumnkaq -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvumnkaq  -> Delete on reboot.

Dossier(s) infecté(s):
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\chsqxaem.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\meaxqshc.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wvUmnKAq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qAKnmUvw.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qAKnmUvw.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ypyjkfop.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\yperajyz\sjefazez.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wvUkLBrR.dll (Trojan.Vundo) -> Delete on reboot.
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP2\A0002601.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\unopek.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mrgzspst.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
etode.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
ewsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Cfx32.ocx (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\CFX32.LIC (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	aack.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	aack.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	emp#01.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	hun.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	hun32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

gaumos1 · Answer

BTFix n'a trouvé aucune erreur... voici le rapport:

BTFix 1.098 (par bibi26) - 06/05/2008 14:29:33 - Analyse
Lancé depuis C:\Documents and Settings\gaumes1\Bureau\btfix\BTFix\BTFix.exe

---> Fichiers/Dossiers trouvés


---> Analyse terminée le 06/05/2008 14:29:33

gaumos1 · Answer

Alors voici enfin le rapport de Combofix: ComboFix 08-05-01.3 - GAUMES1 2008-05-06 14:39:27.1 - NTFSx86 NETWORK Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.804 [GMT -4:00] Endroit: C:\Documents and Settings\gaumes1\Bureau\ComboFix.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\smp.bat C:\WINDOWS\cookies.ini C:\WINDOWS\system32\ggfblvfu.ini C:\WINDOWS\system32\hgggOXyb.ini C:\WINDOWS\system32\hgggOXyb.ini2 C:\WINDOWS\system32\lkhbfnya.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mvpkavvq.ini C:\WINDOWS\system32 ejtgavr.ini C:\WINDOWS\system32 sfdfxus.ini C:\WINDOWS\system32\qAKnmUvw.ini C:\WINDOWS\system32\qAKnmUvw.ini2 C:\WINDOWS\system32\wvUkLBrR.dll C:\WINDOWS\system32\wvUmnKAq.dll C:\WINDOWS\system32\yvqxtvsm.ini . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-06 to 2008-05-06 )))))))))))))))))))))))))))))))))))) . 2008-05-06 14:21 . 2008-05-06 14:21 d-------- C:\Program Files\CCleaner 2008-05-06 11:22 . 2008-05-06 11:22 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-05-06 10:45 . 2008-05-06 10:45 d-------- C:\Documents and Settings\gaumes1\Application Data\Malwarebytes 2008-05-06 10:44 . 2008-05-06 10:44 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-06 10:44 . 2008-05-06 10:44 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-05-06 10:44 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-05-06 10:44 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-05-06 09:23 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-05-06 09:22 . 2008-05-06 09:22 d-------- C:\Program Files\Fichiers communs\Java 2008-05-05 12:46 . 2008-05-05 13:10 d-------- C:\Program Files\Spyware Terminator 2008-05-05 12:46 . 2008-05-05 13:10 d-------- C:\Documents and Settings\gaumes1\Application Data\Spyware Terminator 2008-05-05 12:46 . 2008-05-05 13:06 d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator 2008-05-05 12:46 . 2008-05-05 12:46 141,312 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-05-02 23:13 . 2008-05-02 23:14 153 --a------ C:\WINDOWS\wininit.ini 2008-05-02 12:09 . 2008-05-02 12:09 d-------- C:\Program Files\Enigma Software Group 2008-05-02 10:59 . 2004-08-04 00:54 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll 2008-05-02 10:57 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys 2008-05-02 10:56 . 2001-08-17 21:28 765,884 --a--c--- C:\WINDOWS\system32\dllcache\usrti.sys 2008-05-02 10:55 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys 2008-05-02 10:54 . 2001-08-23 17:47 525,568 --a--c--- C:\WINDOWS\system32\dllcache ridxp.dll 2008-05-02 10:53 . 2001-08-17 22:01 241,664 --a--c--- C:\WINDOWS\system32\dllcache osdvd02.sys 2008-05-02 10:52 . 2001-08-23 17:46 172,768 --a--c--- C:\WINDOWS\system32\dllcache 2r4disp.dll 2008-05-02 10:51 . 2001-08-23 16:57 286,848 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys 2008-05-02 10:50 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys 2008-05-02 10:49 . 2004-08-04 00:54 286,792 --a--c--- C:\WINDOWS\system32\dllcache\slextspk.dll 2008-05-02 10:48 . 2001-08-23 17:47 495,616 --a--c--- C:\WINDOWS\system32\dllcache\sblfx.dll 2008-05-02 10:47 . 2004-08-04 00:54 397,056 --a--c--- C:\WINDOWS\system32\dllcache\s3gnb.dll 2008-05-02 10:46 . 2001-08-23 17:18 899,914 --a--c--- C:\WINDOWS\system32\dllcache 2mdkxga.sys 2008-05-02 10:45 . 2004-08-04 00:54 363,520 --a--c--- C:\WINDOWS\system32\dllcache\psisdecd.dll 2008-05-02 10:44 . 2004-08-04 00:53 259,328 --a--c--- C:\WINDOWS\system32\dllcache\perm3dd.dll 2008-05-02 10:43 . 2001-08-17 22:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys 2008-05-02 10:42 . 2004-08-04 00:54 4,274,816 --a--c--- C:\WINDOWS\system32\dllcache v4_disp.dll 2008-05-02 10:41 . 2004-08-04 00:47 132,695 --a--c--- C:\WINDOWS\system32\dllcache etwlan5.sys 2008-05-02 10:40 . 2004-08-04 00:54 1,737,856 --a--c--- C:\WINDOWS\system32\dllcache\mtxparhd.dll 2008-05-02 10:39 . 2001-08-23 17:03 320,384 --a--c--- C:\WINDOWS\system32\dllcache\mgaum.sys 2008-05-02 10:38 . 2001-08-17 21:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys 2008-05-02 10:37 . 2001-08-23 17:47 242,688 --a--c--- C:\WINDOWS\system32\dllcache\kdsusd.dll 2008-05-02 10:37 . 2001-08-23 17:47 46,080 --a--c--- C:\WINDOWS\system32\dllcache\kdsui.dll 2008-05-02 10:37 . 2004-08-04 00:45 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys 2008-05-02 10:37 . 2001-08-23 17:47 8,704 --a--c--- C:\WINDOWS\system32\dllcache\kbdjpn.dll 2008-05-02 10:37 . 2001-08-23 17:47 8,192 --a--c--- C:\WINDOWS\system32\dllcache\kbdkor.dll 2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd106.dll 2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101c.dll 2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101b.dll 2008-05-02 10:37 . 2001-08-17 22:55 5,632 --a--c--- C:\WINDOWS\system32\dllcache\kbd103.dll 2008-05-02 10:35 . 2001-08-23 17:47 372,824 --a--c--- C:\WINDOWS\system32\dllcache\iconf32.dll 2008-05-02 10:34 . 2004-08-03 22:41 1,041,536 --a--c--- C:\WINDOWS\system32\dllcache\hsfdpsp2.sys 2008-05-02 10:33 . 2001-08-17 21:28 542,879 --a--c--- C:\WINDOWS\system32\dllcache\hsf_msft.sys 2008-05-02 10:32 . 2001-08-23 17:46 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll 2008-05-02 10:31 . 2001-08-17 20:15 455,680 --a--c--- C:\WINDOWS\system32\dllcache\fus2base.sys 2008-05-02 10:30 . 2001-08-23 17:13 634,166 --a--c--- C:\WINDOWS\system32\dllcache\el656ct5.sys 2008-05-02 10:29 . 2001-08-17 20:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys 2008-05-02 10:28 . 2001-08-23 17:47 422,429 --a--c--- C:\WINDOWS\system32\dllcache\dgconfig.dll 2008-05-02 10:27 . 2001-08-23 17:04 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys 2008-05-02 10:26 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys 2008-05-02 10:25 . 2004-08-04 00:54 870,784 --a--c--- C:\WINDOWS\system32\dllcache\ati3d1ag.dll 2008-05-02 10:24 . 2001-08-17 21:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys 2008-05-01 16:25 . 2008-05-02 10:09 3,420 --a------ C:\WINDOWS\system32 mp.reg 2008-05-01 15:32 . 2008-05-06 14:05 d-------- C:\Documents and Settings\All Users\Application Data\yperajyz 2008-05-01 15:13 . 2008-05-06 14:38 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG 2008-04-17 22:19 . 2008-04-17 22:50 d-------- C:\WINDOWS\system32\Adobe 2008-04-15 15:37 . 2008-04-15 15:37 d-------- C:\Program Files\Spybot - Search & Destroy 2008-04-15 15:37 . 2008-04-15 15:42 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-06 14:42 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\Skype 2008-05-06 14:07 --------- d-----w C:\Program Files\PointsecLogs 2008-05-06 13:23 --------- d-----w C:\Program Files\Java 2008-05-06 13:00 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\skypePM 2008-05-06 03:38 --------- d-----w C:\Program Files\Online Bible 2008-05-04 18:03 --------- d-----w C:\Program Files\Pointsec 2008-03-31 14:30 --------- d-----w C:\Program Files\QuickTime 2008-03-24 20:22 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\OpenSong 2008-03-24 20:19 --------- d-----w C:\Program Files\OpenSong 2008-03-18 13:56 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\Image Zone Express 2008-03-18 13:53 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\HP 2008-03-15 05:10 --------- d-----w C:\Program Files\Sun Life 2008-03-15 05:08 --------- d-----w C:\Program Files\Fichiers communs\Data Dynamics 2008-03-15 05:07 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-15 05:07 --------- d-----w C:\Program Files\Vortex 2008-03-15 04:53 --------- d-----w C:\Program Files\ZoomExpressKeyview 2008-03-13 15:10 3,905 ----a-w C:\WINDOWS\system32\drivers\stac97e.log 2008-03-09 03:30 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-03-07 20:35 --------- d-----w C:\Program Files\HP 2008-03-07 20:35 --------- d-----w C:\Program Files\Fichiers communs\HP 2008-03-07 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP 2008-03-07 20:33 --------- d-----w C:\Program Files\Hewlett-Packard 2008-03-07 20:31 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard 2008-03-06 20:39 --------- d-----w C:\Program Files\Naviplan 2008-03-06 20:38 --------- d-----w C:\Program Files\Fichiers communs\IG Shared 2008-03-06 20:37 --------- d-----w C:\Program Files\IG Advantage 2008-03-04 21:17 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-03-04 14:55 6 ----a-w C:\VOL_CHAR.DAT 2008-03-04 14:55 1,715,200 --sha-r C:\PROT_INS.SYS . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 08:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592] "SecureLogin"="C:\Program Files\Protocom\SecureLogin\slproto.exe" [2005-06-29 18:29 356352] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-31 10:30 385024] "Protect Tray"="C:\Program Files\Pointsec\P95tray.exe" [2005-12-28 08:41 344064] "Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack bmon.exe" [2003-10-07 10:48 147514] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 09:04 53248] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 22:00 344064] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 21:00 94208] "McAfeeUpdaterUI"="C:\Program Files etwork associates\common framework\UdaterUI.exe" [2007-10-25 16:06 136512] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-05 08:00 160768] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Malwarebytes Anti-Malware Reboot"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-05-05 20:46 1179256] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 08:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\wvUkLBrR] wvUkLBrR.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^gaumes1^Menu Démarrer^Programmes^Démarrage^Webshots.lnk] path=C:\Documents and Settings\gaumes1\Menu Démarrer\Programmes\Démarrage\Webshots.lnk backup=C:\WINDOWS\pss\Webshots.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] --a------ 2007-01-01 17:22 3739648 C:\Program Files\Google\Google Talk\googletalk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-06 19:37 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "SharedAccess"=2 (0x2) "sp_rssrv"=2 (0x2) "McShield"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "%programfiles%\Intel\Intel NetStructure VPN Client\icdesk.exe"= "%windir%\system32\dwrcs.exe"= "%ProgramFiles%\Microsoft Office\Office10\OUTLOOK.EXE"= "%ProgramFiles%\Microsoft Office\Office11\OUTLOOK.EXE"= "%ProgramFiles%\Microsoft Office\Office12\OUTLOOK.EXE"= "%ProgramFiles%\IG Advantage\IGConSys\jobs\JobControlFiles.EXE"= "%ProgramFiles%\IG Advantage\IGConSys\jobs\JobPhoneList.EXE"= "%ProgramFiles%\ACT\ACT for Windows\ActSage.exe"= "%ProgramFiles%\ACT\ACT for Windows\Act8.exe"= "%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe"= "%windir%\system32\mqsvc.exe"= "C:\Program Files\Network Associates\Common Framework\FrameworkService.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Google\Google Talk\googletalk.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "137:UDP"= 137:UDP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Name Service "138:UDP"= 138:UDP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Datagram Service "139:TCP"= 139:TCP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Session Service "445:TCP"= 445:TCP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:SMB over TCP "6129:TCP"= 6129:TCP:10.0.0.0/8,156.11.0.0/16:Enabled:Dameware Service [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R0 prot_2k;prot_2k;C:\WINDOWS\system32\drivers\prot_2k.sys [2005-12-21 15:12] R3 ICvnic;VPN Client Virtual Adapter;C:\WINDOWS\system32\DRIVERS\ICvnic.sys [2002-05-01 15:19] S1 ICsrvr;VPN Client Protocol;C:\WINDOWS\system32\DRIVERS\ICsrvr.sys [2002-05-01 15:20] S1 ICtdi;VPN Client TDI Driver;C:\WINDOWS\system32\DRIVERS\ictdi.sys [2002-05-01 15:19] S2 ICService;Intel(R) NetStructure(TM) VPN Client;C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe [2002-05-01 15:35] S2 Pointsec;Pointsec;C:\WINDOWS\system32\PROT_SRV.EXE [2005-12-28 08:41] S2 Pointsec_agent;Pointsec update agent;C:\WINDOWS\system32\pagents.exe [2005-09-16 02:56] S2 Pointsec_start;Pointsec service start;C:\WINDOWS\system32\PSTARTSR.EXE [2005-12-28 08:41] S3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2005-05-31 12:46] S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-05 20:46] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-06 14:43:40 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 1 ************************************************************************** . --------------------- DLLs a charg‚ sous des processus courants --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\icgina.dll -> C:\WINDOWS\system32\ICGinaApi.dll . Temps d'accomplissement: 2008-05-06 14:46:03 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-06 18:46:00 Pre-Run: 25,870,684,160 octets libres Post-Run: 26,134,302,720 octets libres 224 --- E O F --- 2008-04-10 04:20:35

ep44 · Answer

selectionne ceci

registry::

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wvUkLBrR] 



* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
* Veille à ce que Retour à la ligne ne soit pas coché dans Format. 
* Colle le texte copié dans ce bloc-notes (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt
* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme ceci 
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
* Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

@+

ensuite fait un scan en ligne

avec bitdefender et colle le rapport

https://www.bitdefender.com/toolbox/

Scan à faire sous Internet Explorer

un tuto
http://pageperso.aol.fr/rginformatique/mapage/defender.htm

plus un nouveau hijack 

@+

gaumos1 · Answer

Rapport du scan combofix... ComboFix 08-05-01.3 - GAUMES1 2008-05-06 15:41:02.2 - NTFSx86 NETWORK Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.804 [GMT -4:00] Endroit: C:\Documents and Settings\gaumes1\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\gaumes1\Bureau\CFScript.txt [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . ((((((((((((((((((((((((((((( Fichiers créés 2008-04-06 to 2008-05-06 )))))))))))))))))))))))))))))))))))) . 2008-05-06 11:22 . 2008-05-06 11:22 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-05-06 10:45 . 2008-05-06 10:45 d-------- C:\Documents and Settings\gaumes1\Application Data\Malwarebytes 2008-05-06 10:44 . 2008-05-06 10:44 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-05-06 09:23 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-05-06 09:22 . 2008-05-06 09:22 d-------- C:\Program Files\Fichiers communs\Java 2008-05-02 23:13 . 2008-05-02 23:14 153 --a------ C:\WINDOWS\wininit.ini 2008-05-02 10:59 . 2004-08-04 00:54 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll 2008-05-02 10:57 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys 2008-05-02 10:56 . 2001-08-17 21:28 765,884 --a--c--- C:\WINDOWS\system32\dllcache\usrti.sys 2008-05-02 10:55 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys 2008-05-02 10:54 . 2001-08-23 17:47 525,568 --a--c--- C:\WINDOWS\system32\dllcache ridxp.dll 2008-05-02 10:53 . 2001-08-17 22:01 241,664 --a--c--- C:\WINDOWS\system32\dllcache osdvd02.sys 2008-05-02 10:52 . 2001-08-23 17:46 172,768 --a--c--- C:\WINDOWS\system32\dllcache 2r4disp.dll 2008-05-02 10:51 . 2001-08-23 16:57 286,848 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys 2008-05-02 10:50 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys 2008-05-02 10:49 . 2004-08-04 00:54 286,792 --a--c--- C:\WINDOWS\system32\dllcache\slextspk.dll 2008-05-02 10:48 . 2001-08-23 17:47 495,616 --a--c--- C:\WINDOWS\system32\dllcache\sblfx.dll 2008-05-02 10:47 . 2004-08-04 00:54 397,056 --a--c--- C:\WINDOWS\system32\dllcache\s3gnb.dll 2008-05-02 10:46 . 2001-08-23 17:18 899,914 --a--c--- C:\WINDOWS\system32\dllcache 2mdkxga.sys 2008-05-02 10:45 . 2004-08-04 00:54 363,520 --a--c--- C:\WINDOWS\system32\dllcache\psisdecd.dll 2008-05-02 10:44 . 2004-08-04 00:53 259,328 --a--c--- C:\WINDOWS\system32\dllcache\perm3dd.dll 2008-05-02 10:43 . 2001-08-17 22:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys 2008-05-02 10:42 . 2004-08-04 00:54 4,274,816 --a--c--- C:\WINDOWS\system32\dllcache v4_disp.dll 2008-05-02 10:41 . 2004-08-04 00:47 132,695 --a--c--- C:\WINDOWS\system32\dllcache etwlan5.sys 2008-05-02 10:40 . 2004-08-04 00:54 1,737,856 --a--c--- C:\WINDOWS\system32\dllcache\mtxparhd.dll 2008-05-02 10:39 . 2001-08-23 17:03 320,384 --a--c--- C:\WINDOWS\system32\dllcache\mgaum.sys 2008-05-02 10:38 . 2001-08-17 21:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys 2008-05-02 10:37 . 2001-08-23 17:47 242,688 --a--c--- C:\WINDOWS\system32\dllcache\kdsusd.dll 2008-05-02 10:37 . 2001-08-23 17:47 46,080 --a--c--- C:\WINDOWS\system32\dllcache\kdsui.dll 2008-05-02 10:37 . 2004-08-04 00:45 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys 2008-05-02 10:37 . 2001-08-23 17:47 8,704 --a--c--- C:\WINDOWS\system32\dllcache\kbdjpn.dll 2008-05-02 10:37 . 2001-08-23 17:47 8,192 --a--c--- C:\WINDOWS\system32\dllcache\kbdkor.dll 2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd106.dll 2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101c.dll 2008-05-02 10:37 . 2001-08-17 22:55 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101b.dll 2008-05-02 10:37 . 2001-08-17 22:55 5,632 --a--c--- C:\WINDOWS\system32\dllcache\kbd103.dll 2008-05-02 10:35 . 2001-08-23 17:47 372,824 --a--c--- C:\WINDOWS\system32\dllcache\iconf32.dll 2008-05-02 10:34 . 2004-08-03 22:41 1,041,536 --a--c--- C:\WINDOWS\system32\dllcache\hsfdpsp2.sys 2008-05-02 10:33 . 2001-08-17 21:28 542,879 --a--c--- C:\WINDOWS\system32\dllcache\hsf_msft.sys 2008-05-02 10:32 . 2001-08-23 17:46 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll 2008-05-02 10:31 . 2001-08-17 20:15 455,680 --a--c--- C:\WINDOWS\system32\dllcache\fus2base.sys 2008-05-02 10:30 . 2001-08-23 17:13 634,166 --a--c--- C:\WINDOWS\system32\dllcache\el656ct5.sys 2008-05-02 10:29 . 2001-08-17 20:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys 2008-05-02 10:28 . 2001-08-23 17:47 422,429 --a--c--- C:\WINDOWS\system32\dllcache\dgconfig.dll 2008-05-02 10:27 . 2001-08-23 17:04 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys 2008-05-02 10:26 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys 2008-05-02 10:25 . 2004-08-04 00:54 870,784 --a--c--- C:\WINDOWS\system32\dllcache\ati3d1ag.dll 2008-05-02 10:24 . 2001-08-17 21:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys 2008-05-01 16:25 . 2008-05-02 10:09 3,420 --a------ C:\WINDOWS\system32 mp.reg 2008-05-01 15:32 . 2008-05-06 14:05 d-------- C:\Documents and Settings\All Users\Application Data\yperajyz 2008-05-01 15:13 . 2008-05-06 14:38 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG 2008-04-17 22:19 . 2008-04-17 22:50 d-------- C:\WINDOWS\system32\Adobe 2008-04-15 15:37 . 2008-05-06 14:53 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-06 19:35 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\Skype 2008-05-06 19:26 --------- d-----w C:\Program Files\Online Bible 2008-05-06 19:09 --------- d-----w C:\Program Files\PointsecLogs 2008-05-06 13:23 --------- d-----w C:\Program Files\Java 2008-05-06 13:00 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\skypePM 2008-05-04 18:03 --------- d-----w C:\Program Files\Pointsec 2008-03-31 14:30 --------- d-----w C:\Program Files\QuickTime 2008-03-24 20:22 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\OpenSong 2008-03-24 20:19 --------- d-----w C:\Program Files\OpenSong 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-18 13:56 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\Image Zone Express 2008-03-18 13:53 --------- d-----w C:\Documents and Settings\gaumes1\Application Data\HP 2008-03-15 05:10 --------- d-----w C:\Program Files\Sun Life 2008-03-15 05:08 --------- d-----w C:\Program Files\Fichiers communs\Data Dynamics 2008-03-15 05:07 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-15 05:07 --------- d-----w C:\Program Files\Vortex 2008-03-15 04:53 --------- d-----w C:\Program Files\ZoomExpressKeyview 2008-03-13 15:10 3,905 ----a-w C:\WINDOWS\system32\drivers\stac97e.log 2008-03-09 03:30 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-03-07 20:35 --------- d-----w C:\Program Files\HP 2008-03-07 20:35 --------- d-----w C:\Program Files\Fichiers communs\HP 2008-03-07 20:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP 2008-03-07 20:33 --------- d-----w C:\Program Files\Hewlett-Packard 2008-03-07 20:31 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard 2008-03-06 20:39 --------- d-----w C:\Program Files\Naviplan 2008-03-06 20:38 --------- d-----w C:\Program Files\Fichiers communs\IG Shared 2008-03-06 20:37 --------- d-----w C:\Program Files\IG Advantage 2008-03-04 21:17 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-03-04 14:55 6 ----a-w C:\VOL_CHAR.DAT 2008-03-04 14:55 1,715,200 --sha-r C:\PROT_INS.SYS 2008-03-04 14:46 88,576 ----a-w C:\WINDOWS\system32\ICGINAAPI.DLL 2008-03-01 12:58 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-11 14:04 24,728 ----a-w C:\WINDOWS\system32 ovamnv5.dll 2008-02-11 14:04 18,584 ----a-w C:\WINDOWS\system32 ovamiv5.dll . ((((((((((((((((((((((((((((( snapshot@2008-05-06_14.45.50.93 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-06 18:42:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-06 19:37:15 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 08:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592] "SecureLogin"="C:\Program Files\Protocom\SecureLogin\slproto.exe" [2005-06-29 18:29 356352] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-31 10:30 385024] "Protect Tray"="C:\Program Files\Pointsec\P95tray.exe" [2005-12-28 08:41 344064] "Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack bmon.exe" [2003-10-07 10:48 147514] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 09:04 53248] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 22:00 344064] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 21:00 94208] "McAfeeUpdaterUI"="C:\Program Files etwork associates\common framework\UdaterUI.exe" [2007-10-25 16:06 136512] "MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [2004-08-05 08:00 160768] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Malwarebytes Anti-Malware Reboot"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 08:00 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^gaumes1^Menu Démarrer^Programmes^Démarrage^Webshots.lnk] path=C:\Documents and Settings\gaumes1\Menu Démarrer\Programmes\Démarrage\Webshots.lnk backup=C:\WINDOWS\pss\Webshots.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] --a------ 2007-01-01 17:22 3739648 C:\Program Files\Google\Google Talk\googletalk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-06 19:37 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "sp_rssrv"=2 (0x2) "McShield"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "%programfiles%\Intel\Intel NetStructure VPN Client\icdesk.exe"= "%windir%\system32\dwrcs.exe"= "%ProgramFiles%\Microsoft Office\Office10\OUTLOOK.EXE"= "%ProgramFiles%\Microsoft Office\Office11\OUTLOOK.EXE"= "%ProgramFiles%\Microsoft Office\Office12\OUTLOOK.EXE"= "%ProgramFiles%\IG Advantage\IGConSys\jobs\JobControlFiles.EXE"= "%ProgramFiles%\IG Advantage\IGConSys\jobs\JobPhoneList.EXE"= "%ProgramFiles%\ACT\ACT for Windows\ActSage.exe"= "%ProgramFiles%\ACT\ACT for Windows\Act8.exe"= "%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe"= "%windir%\system32\mqsvc.exe"= "C:\Program Files\Network Associates\Common Framework\FrameworkService.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Google\Google Talk\googletalk.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "137:UDP"= 137:UDP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Name Service "138:UDP"= 138:UDP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Datagram Service "139:TCP"= 139:TCP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:NetBIOS Session Service "445:TCP"= 445:TCP:10.0.0.0/8,192.168.0.0/16,156.11.0.0/16:Enabled:SMB over TCP "6129:TCP"= 6129:TCP:10.0.0.0/8,156.11.0.0/16:Enabled:Dameware Service [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R0 prot_2k;prot_2k;C:\WINDOWS\system32\drivers\prot_2k.sys [2005-12-21 15:12] R3 ICvnic;VPN Client Virtual Adapter;C:\WINDOWS\system32\DRIVERS\ICvnic.sys [2002-05-01 15:19] S1 ICsrvr;VPN Client Protocol;C:\WINDOWS\system32\DRIVERS\ICsrvr.sys [2002-05-01 15:20] S1 ICtdi;VPN Client TDI Driver;C:\WINDOWS\system32\DRIVERS\ictdi.sys [2002-05-01 15:19] S2 ICService;Intel(R) NetStructure(TM) VPN Client;C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe [2002-05-01 15:35] S2 Pointsec;Pointsec;C:\WINDOWS\system32\PROT_SRV.EXE [2005-12-28 08:41] S2 Pointsec_agent;Pointsec update agent;C:\WINDOWS\system32\pagents.exe [2005-09-16 02:56] S2 Pointsec_start;Pointsec service start;C:\WINDOWS\system32\PSTARTSR.EXE [2005-12-28 08:41] S3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2005-05-31 12:46] S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-06 15:42:54 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . --------------------- DLLs a chargé sous des processus courants --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\icgina.dll -> C:\WINDOWS\system32\ICGinaApi.dll . Temps d'accomplissement: 2008-05-06 15:43:36 ComboFix-quarantined-files.txt 2008-05-06 19:43:33 ComboFix2.txt 2008-05-06 18:46:04 Pre-Run: 26,132,746,240 octets libres Post-Run: 26,137,956,352 octets libres 208 --- E O F --- 2008-04-10 04:20:35

ep44 · Answer

ok maintenant le scan 
@+

gaumos1 · Answer

Alors voici le Scan et le rapport HIJACKTHIS:


BitDefender Online Scanner
  
  
 
Scan report generated at: Tue, May 06, 2008 - 16:20:36
 
 
  
  
 
Scan path: C:\;D:\;
  
  
 
 
  
  
 
Statistics
 
Time
 00:28:32
 
Files
 159063
 
Folders
 4397
 
Boot Sectors
 2
 
Archives
 925
 
Packed Files
 7988
 
  
  
 
Results
 
Identified Viruses 
 3
 
Infected Files 
 5
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 5
 
  
  
 
Engines Info
 
Virus Definitions
 1189986
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 16
 
Archive plugins
 42
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 5
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe=>wise0031
 Detected with: Adware.Gator.AD
 
C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe=>wise0031
 Deleted
 
C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe
 Update failed
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000001.ini
 Infected with: Trojan.Vundo.DVS
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000001.ini
 Disinfection failed
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000001.ini
 Deleted
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000019.ini
 Infected with: Trojan.Vundo.DVS
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000019.ini
 Disinfection failed
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000019.ini
 Deleted
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000066.ini
 Infected with: Trojan.Vundo.DVS
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000066.ini
 Disinfection failed
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP1\A0000066.ini
 Deleted
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP6\A0003206.dll
 Infected with: Trojan.PWS.Agent.SDB
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP6\A0003206.dll
 Deleted
 
 



Rapport HIJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:25, on 2008-05-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\gaumes1\Local Settings\Temporary Internet Files\Content.IE5\S7E7VXMP\HiJackThis[1].exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/Content/fr/default.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = igproxy.investorsgroup.com:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://home*.investorsgroup.com;https://businesslinkonwinfund.investorsgroup.com;*.ig.bz;*.iga.bz;*.gwl.ca;*.gwl.bz;*mycybrary.londonlife.com;*cybrary.londonlife.com;*.ll.bz;*.grsaccess.com;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: SecureLogin IESSO Browser Helper Object - {7DE7B623-A17E-4A0B-94BA-D1B3BA646792} - C:\Program Files\Protocom\SecureLogin\iesso.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SecureLogin] "C:\Program Files\Protocom\SecureLogin\slproto.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Protect Tray] "C:\Program Files\Pointsec\P95tray.exe"
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack	bmon.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files
etwork associates\common framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Controleur de Connection GI.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\Software\..\Telephony: DomainName = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R)  NetStructure(TM) VPN Client (ICService) - Unknown owner - C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files
etwork associates\common framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Pointsec - Unknown owner - C:\WINDOWS\system32\PROT_SRV.EXE
O23 - Service: Pointsec update agent (Pointsec_agent) - Unknown owner - C:\WINDOWS\system32\pagents.exe
O23 - Service: Pointsec service start (Pointsec_start) - Unknown owner - C:\WINDOWS\system32\PSTARTSR.EXE

ep44 · Answer

re

Télécharge sur le bureau http://siri.urz.free.fr/Fix/SmitfraudFix.exe
=> Double clic sur SmitfraudFix.zip
=> Extraire tout
=> Double clic sur SmitfraudFix
=> Double Clic sur SmitfraudFix.cmd
=> Choisir Option 1
=> poste le rapport
@+

gaumos1 · Answer

Rapport Smitfraudfix:

SmitFraudFix v2.320

Rapport fait à 19:32:03.15, 2008-05-06
Executé à partir de C:\Documents and Settings\gaumes1\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\gaumes1


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\gaumes1\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\gaumes1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom NetXtreme 57xx Gigabit Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0B1138E6-3721-4E59-8FBB-8A4EBA7271EF}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0B1138E6-3721-4E59-8FBB-8A4EBA7271EF}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0B1138E6-3721-4E59-8FBB-8A4EBA7271EF}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=156.11.98.121 156.11.219.1 156.11.98.122
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=156.11.98.121 156.11.219.1 156.11.98.122
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=156.11.98.121 156.11.219.1 156.11.98.122


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

ep44 · Answer

Bonjour connais tu cette adresse 156.11.98.121 156.11.219.1 156.11.98.122 
?

gaumos1 · Answer

Aucune idée. La compagnie où je travaille fait des mises à jour automatiques quotidiennement sur mon ordinateur. Aussi, une fois, il y avait eu un expert de la compagnie où je travaille qui s'était connecté sur mon ordi pour arranger quelques éléments qui ne fonctionnaient pas. Je ne sais pas si tout ça peut être lié.

ep44 · Answer

pas sur mais pour vérif 

Télécharge FixWareout de l'un de ces deux liens :
http://downloads.subratam.org/Fixwareout.exe
https://www.bleepingcomputer.com/download/linux/

Sauvegarde-le sur ton Bureau, puis lance-le.
Clique Next, puis Install, et assure-toi que "Run fixit" soit coché, puis clique Finish.
Suis les directives à l'écran.
L'outil va te demander de redémarrer ton PC; fais-le s'il te plaît.
Le redémarrage risque de prendre un peu plus de temps; ceci est normal.

Lorsque redémarré, un fichier texte apparaîtra (report.txt); copie/colle ce rapport dans ta prochaine réponse, avec un nouveau rapport HijackThis également.

gaumos1 · Answer

Voici le rapport FixWareout d'abord, et le hijack ensuite.

FIXWAREOUT:

Username "GAUMES1" - 2008-05-07 11:37:36 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Cache de résolution DNS vidé.


System was rebooted successfully. 
 
~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "System"="" 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionun]
"UpdateManager"="\"C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe\" /r"
"SecureLogin"="\"C:\Program Files\Protocom\SecureLogin\slproto.exe\""
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime"
"Protect Tray"="\"C:\Program Files\Pointsec\P95tray.exe\""
"Network Associates Error Reporting Service"="\"C:\Program Files\Fichiers communs\Network Associates\TalkBack\tbmon.exe\""
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
"DVDLauncher"="\"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe\""
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
"Adobe Reader Speed Launcher"="\"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe\""
"ShStatEXE"="\"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE\" /STANDALONE"
"McAfeeUpdaterUI"="\"C:\Program Files\network associates\common framework\UdaterUI.exe\" /StartedFromRunKey"
"SunJavaUpdateSched"="\"C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe\""
"Malwarebytes Anti-Malware Reboot"="\"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe\" /runcleanupscript"
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersionun]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~



RAPPORT HIJACK:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45, on 2008-05-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe
C:\Program Files
etwork associates\common framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PROT_SRV.EXE
C:\WINDOWS\system32\pagents.exe
C:\WINDOWS\system32\PSTARTSR.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe
C:\Program Files\Pointsec\P95tray.exe
C:\Program Files\Fichiers communs\Network Associates\TalkBack	bmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Protocom\SECURE~1\slbroker.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files
etwork associates\common framework\UdaterUI.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files
etwork associates\common framework\McTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IG Advantage\Igconsys\ConSched.exe
C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files
etwork associates\common framework\McScript_InUse.exe
C:\Program Files\Network Associates\VirusScan\SCAN32.EXE
C:\Documents and Settings\gaumes1\Local Settings\Temporary Internet Files\Content.IE5\X7TVFABX\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/Content/fr/default.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = igproxy.investorsgroup.com:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://home*.investorsgroup.com;https://businesslinkonwinfund.investorsgroup.com;*.ig.bz;*.iga.bz;*.gwl.ca;*.gwl.bz;*mycybrary.londonlife.com;*cybrary.londonlife.com;*.ll.bz;*.grsaccess.com;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: SecureLogin IESSO Browser Helper Object - {7DE7B623-A17E-4A0B-94BA-D1B3BA646792} - C:\Program Files\Protocom\SecureLogin\iesso.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SecureLogin] "C:\Program Files\Protocom\SecureLogin\slproto.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Protect Tray] "C:\Program Files\Pointsec\P95tray.exe"
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack	bmon.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files
etwork associates\common framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Controleur de Connection GI.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\Software\..\Telephony: DomainName = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = iga.bz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R)  NetStructure(TM) VPN Client (ICService) - Unknown owner - C:\Program Files\Intel\Intel NetStructure VPN Client\icsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files
etwork associates\common framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Pointsec - Unknown owner - C:\WINDOWS\system32\PROT_SRV.EXE
O23 - Service: Pointsec update agent (Pointsec_agent) - Unknown owner - C:\WINDOWS\system32\pagents.exe
O23 - Service: Pointsec service start (Pointsec_start) - Unknown owner - C:\WINDOWS\system32\PSTARTSR.EXE

ep44 · Answer

tu vas te rendre sur ce site 
https://www.virustotal.com/gui/

et faire analyser ces fichiers 

C:\Program Files\IG Advantage\Igconsys\ConSched.exe
C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe"

Et colle les résultats 
@+

gaumos1 · Answer

Alors voici les 3 résultats...
______________________________________________________________________________________
Fichier ConSched.exe reçu le 2008.05.07 20:22:43 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 0/31 (0%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: ___.
L'heure estimée de démarrage est entre ___ et ___ .
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.5.3.0 2008.05.07 - 
AntiVir 7.8.0.11 2008.05.07 - 
Authentium 4.93.8 2008.05.07 - 
Avast 4.8.1169.0 2008.05.07 - 
AVG 7.5.0.516 2008.05.07 - 
BitDefender 7.2 2008.05.07 - 
CAT-QuickHeal 9.50 2008.05.07 - 
ClamAV 0.92.1 2008.05.07 - 
DrWeb 4.44.0.09170 2008.05.07 - 
eSafe 7.0.15.0 2008.05.07 - 
eTrust-Vet 31.4.5766 2008.05.07 - 
Ewido 4.0 2008.05.07 - 
F-Prot 4.4.2.54 2008.05.07 - 
F-Secure 6.70.13260.0 2008.05.07 - 
Fortinet 3.14.0.0 2008.05.07 - 
Ikarus T3.1.1.26 2008.05.07 - 
Kaspersky 7.0.0.125 2008.05.07 - 
McAfee 5290 2008.05.07 - 
Microsoft 1.3408 2008.05.07 - 
NOD32v2 3083 2008.05.07 - 
Norman 5.80.02 2008.05.07 - 
Panda 9.0.0.4 2008.05.06 - 
Prevx1 V2 2008.05.07 - 
Rising 20.43.12.00 2008.05.07 - 
Sophos 4.29.0 2008.05.07 - 
Sunbelt 3.0.1097.0 2008.05.07 - 
Symantec 10 2008.05.07 - 
TheHacker 6.2.92.302 2008.05.07 - 
VBA32 3.12.6.5 2008.05.07 - 
VirusBuster 4.3.26:9 2008.05.07 - 
Webwasher-Gateway 6.6.2 2008.05.07 - 
Information additionnelle 
File size: 69632 bytes 
MD5...: 5453f56a2e709bcec190e39234d99cde 
SHA1..: a4ff42b8abc478d1f1155d201e90c7ffd5226133 
SHA256: c026e1f4c0c015409e3bf91377af46e5146c1d790050999b3199c81d3d5d9427 
SHA512: 9e5b05dd9fe30894428ef14600f3e93b54b59956afe0587ba59030f7a9937f26
f00256d7ce56033213ad357abc1c343e4e114824745f0899cc4835597e0dfbe6 
PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401878
timedatestamp.....: 0x4693daaf (Tue Jul 10 19:14:55 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xde10 0xe000 5.72 6276ce60d7c51d0e175a5e39bc0827a9
.data 0xf000 0x142c 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x11000 0xf00 0x1000 3.34 1165704b4907141438bce9237825f0cf

( 1 imports ) 
> MSVBVM60.DLL: __vbaVarTstGt, __vbaVarSub, __vbaStrI2, _CIcos, _adj_fptan, __vbaStrI4, __vbaVarVargNofree, __vbaFreeVar, __vbaLenBstr, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, -, _adj_fprem1, __vbaRecAnsiToUni, __vbaStrCat, -, __vbaLsetFixstr, -, __vbaSetSystemError, -, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, -, __vbaExitProc, -, -, __vbaOnError, __vbaObjSet, -, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, -, __vbaStrFixstr, -, -, _CIsin, -, -, __vbaChkstk, __vbaFileClose, -, EVENT_SINK_AddRef, -, __vbaGenerateBoundsError, __vbaStrCmp, __vbaVarTstEq, -, __vbaObjVar, __vbaI2I4, DllFunctionCall, __vbaRedimPreserve, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, -, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaVarMul, __vbaExceptHandler, __vbaInputFile, __vbaStrToUnicode, __vbaDateStr, _adj_fprem, _adj_fdivr_m64, -, -, __vbaFPException, __vbaStrVarVal, __vbaVarCat, __vbaDateVar, __vbaI2Var, -, -, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, -, __vbaInStr, -, _adj_fdiv_m32i, _adj_fdivr_m32i, -, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, __vbaPowerR8, _adj_fdiv_r, -, -, __vbaI4Var, __vbaLateMemCall, __vbaVarAdd, __vbaAryLock, __vbaVarDup, __vbaStrToAnsi, __vbaFpI2, __vbaFpI4, -, __vbaLateMemCallLd, _CIatan, __vbaCastObj, __vbaStrMove, -, -, -, _allmul, -, _CItan, -, __vbaAryUnlock, _CIexp, __vbaFreeStr, __vbaFreeObj

( 0 exports ) 
 

______________________________________________________________________________________




Fichier slwinsso.exe reçu le 2008.05.07 20:29:47 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 1/31 (3.23%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: 2.
L'heure estimée de démarrage est entre 42 et 61 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.5.3.0 2008.05.07 - 
AntiVir 7.8.0.11 2008.05.07 - 
Authentium 4.93.8 2008.05.07 - 
Avast 4.8.1169.0 2008.05.07 - 
AVG 7.5.0.516 2008.05.07 - 
BitDefender 7.2 2008.05.07 - 
CAT-QuickHeal 9.50 2008.05.07 - 
ClamAV 0.92.1 2008.05.07 - 
DrWeb 4.44.0.09170 2008.05.07 - 
eSafe 7.0.15.0 2008.05.07 - 
eTrust-Vet 31.4.5766 2008.05.07 - 
Ewido 4.0 2008.05.07 - 
F-Prot 4.4.2.54 2008.05.07 - 
F-Secure 6.70.13260.0 2008.05.07 - 
Fortinet 3.14.0.0 2008.05.07 - 
Ikarus T3.1.1.26.0 2008.05.07 - 
Kaspersky 7.0.0.125 2008.05.07 - 
McAfee 5290 2008.05.07 - 
Microsoft 1.3408 2008.05.07 - 
NOD32v2 3083 2008.05.07 - 
Norman 5.80.02 2008.05.07 - 
Panda 9.0.0.4 2008.05.06 - 
Prevx1 V2 2008.05.07 Malicious Software 
Rising 20.43.12.00 2008.05.07 - 
Sophos 4.29.0 2008.05.07 - 
Sunbelt 3.0.1097.0 2008.05.07 - 
Symantec 10 2008.05.07 - 
TheHacker 6.2.92.302 2008.05.07 - 
VBA32 3.12.6.5 2008.05.07 - 
VirusBuster 4.3.26:9 2008.05.07 - 
Webwasher-Gateway 6.6.2 2008.05.07 - 
Information additionnelle 
File size: 53248 bytes 
MD5...: 9effa03e0917bb6f92a40d0d8e6be7fa 
SHA1..: 59755747e3a94d4cf94d3a0900b7c1f8a1e2e7f4 
SHA256: 863a659600e8e02b9398f15f75ca43e2a43aaabf44be22928b637e3ee5eaf92e 
SHA512: cff337d3975084bcb20bfb7e2833c03fb01fefae8f9e6f8298434a697e4cb7af
74af30e944ac330e559d7ec44e5a06110787d318d1a50184301212b19e62bd1a 
PEiD..: Armadillo v1.71 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4033c2
timedatestamp.....: 0x42c24d9b (Wed Jun 29 07:28:27 2005)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x290b 0x3000 5.70 3aeb6929443a8d8aac041f471529afce
.rdata 0x4000 0x14f4 0x2000 3.78 b7ec0391d602c7a9601827f212a5cc99
.data 0x6000 0x69c 0x1000 1.66 0ff9061bf7dd3d4e31923a647d52949f
.rsrc 0x7000 0x5cb8 0x6000 5.12 82342a9482399f0235c1f6a919d69d52

( 7 imports ) 
> KERNEL32.dll: OpenEventW, SetProcessWorkingSetSize, CloseHandle, ReleaseMutex, OutputDebugStringW, CreateMutexW, WideCharToMultiByte, WaitForSingleObject, MultiByteToWideChar, CreateDirectoryW, GetProcAddress, FreeLibrary, LoadLibraryA, GetProcessHeaps, LoadLibraryW, GetLastError, GetModuleHandleA, GetCurrentProcess, GetStartupInfoA
> USER32.dll: LoadStringW, PeekMessageW, MsgWaitForMultipleObjects, wsprintfW, MessageBoxW, DispatchMessageW, TranslateMessage, GetMessageW
> slcaptain.dll: _SetLongJohn@@YAHPAUHWND__@@@Z, _Hook_Start@@YAHXZ, _Hook_Stop@@YAHXZ
> slbroker.dll: __0CSSOScriptBroker@@QAE@_N00@Z, __1CSSOScriptBroker@@QAE@XZ
> MSVCP60.dll: _npos@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@2IB, __Hstd@@YA_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@ABV10@0@Z, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBG@Z, __0_Lockit@std@@QAE@XZ, __1_Lockit@std@@QAE@XZ, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z, __Freeze@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXXZ, __C@_1___Nullstr@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@CAPBGXZ@4GB, _c_str@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEPBGXZ, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@PBGABV_$allocator@G@1@@Z, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBGI@Z, __Tidy@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEX_N@Z, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBGI@Z, __6std@@YAAAV_$basic_ostream@GU_$char_traits@G@std@@@0@AAV10@PBG@Z, _c_str@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEPBDXZ, __0_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAE@PBDH@Z, __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, _close@_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAEXXZ, ___D_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAEXXZ, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __1_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@XZ
> MSVCRT.dll: abs, _onexit, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, _XcptFilter, _exit, free, _controlfp, swprintf, wcsncpy, __2@YAPAXI@Z, _snwprintf, time, _wstrtime, wcslen, strlen, __CxxFrameHandler, _beginthread, exit, _wgetenv, _except_handler3, _wstat, _wstrdate, __dllonexit
> ADVAPI32.dll: RegCloseKey, RegQueryValueExA, RegOpenKeyExA

( 0 exports ) 
 
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=53A82C20005DD563D05D0056FA2CB200584DA0FB 






______________________________________________________________________________________





Fichier slproto.exe reçu le 2008.05.07 20:33:38 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 1/31 (3.23%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: 2.
L'heure estimée de démarrage est entre 42 et 61 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.5.3.0 2008.05.07 - 
AntiVir 7.8.0.11 2008.05.07 - 
Authentium 4.93.8 2008.05.07 - 
Avast 4.8.1169.0 2008.05.07 - 
AVG 7.5.0.516 2008.05.07 - 
BitDefender 7.2 2008.05.07 - 
CAT-QuickHeal 9.50 2008.05.07 - 
ClamAV 0.92.1 2008.05.07 - 
DrWeb 4.44.0.09170 2008.05.07 - 
eSafe 7.0.15.0 2008.05.07 - 
eTrust-Vet 31.4.5766 2008.05.07 - 
Ewido 4.0 2008.05.07 - 
F-Prot 4.4.2.54 2008.05.07 - 
F-Secure 6.70.13260.0 2008.05.07 - 
Fortinet 3.14.0.0 2008.05.07 - 
Ikarus T3.1.1.26.0 2008.05.07 - 
Kaspersky 7.0.0.125 2008.05.07 - 
McAfee 5290 2008.05.07 - 
Microsoft 1.3408 2008.05.07 - 
NOD32v2 3083 2008.05.07 - 
Norman 5.80.02 2008.05.07 - 
Panda 9.0.0.4 2008.05.06 - 
Prevx1 V2 2008.05.07 Malicious Software 
Rising 20.43.12.00 2008.05.07 - 
Sophos 4.29.0 2008.05.07 - 
Sunbelt 3.0.1097.0 2008.05.07 - 
Symantec 10 2008.05.07 - 
TheHacker 6.2.92.302 2008.05.07 - 
VBA32 3.12.6.5 2008.05.07 - 
VirusBuster 4.3.26:9 2008.05.07 - 
Webwasher-Gateway 6.6.2 2008.05.07 - 
Information additionnelle 
File size: 356352 bytes 
MD5...: c2f3f2407451f77489dd57cbad6d1aae 
SHA1..: 1a437ac7844191fa360826121ca90738adb9cd82 
SHA256: 00a99dd5a325d0ccaa63142807e1f15df41ba030a18b8c15cdb1212f2d310454 
SHA512: bbfcd938e95adf589c282ac82ec00e7e52583bb23176b07197295cfdbc6e20fa
0201e6186b21ebf1a195f4cb59a7390d16ac37841b9e148c83b7ae5a51b0de36 
PEiD..: Armadillo v1.71 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x42f560
timedatestamp.....: 0x42c24ddc (Wed Jun 29 07:29:32 2005)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3c674 0x3d000 6.41 39c0ca66a47f1a94dbb49ce6c5a65be8
.rdata 0x3e000 0xd30c 0xe000 4.91 9f220b7f755a7faef20f63d1b3e6493f
.data 0x4c000 0x57dc 0x5000 4.11 769553629a8eb44378309bb56aefd027
.rsrc 0x52000 0x5d10 0x6000 5.13 1b5acb8c6931d9c02c099b896920861b

( 13 imports ) 
> slbroker.dll: _GetPlatformScript@CSSOScriptBroker@@QAEHPBGPAPAGPAW4SSOPlatformType@@_N@Z, _AddCredentialSet@CSSOScriptBroker@@QAEHPBG0_N@Z, _ChangePassphrase@CSSOScriptBroker@@QAEHXZ, _LoadVariableList@CSSOScriptBroker@@QAEHPBG0@Z, _FreePlatformScript@CSSOScriptBroker@@QAEHPAG@Z, _GetNumCredentialSets@CSSOScriptBroker@@QAEHPBGW4SSOCredSetType@@PAH@Z, _SetReloadStatus@CSSOScriptBroker@@QAEHH@Z, _FreeVariableList@CSSOScriptBroker@@QAEHXZ, _FreePlatformTypeName@CSSOScriptBroker@@QAEHPAG@Z, _SetPlatformTypeName@CSSOScriptBroker@@QAEHPBG00PAPAG@Z, _AuthenticateDevice@CSSOScriptBroker@@QAEHXZ, _GetRTVariable@CSSOScriptBroker@@QAEHPBG0PAPAG@Z, _FreeString@CSSOScriptBroker@@QAEHPAG@Z, _FreeAttribute@CSSOScriptBroker@@QAEHPAG@Z, _GetAttributeFromCurrentUser@CSSOScriptBroker@@QAEHPBGPAPAG@Z, __1CSSOScriptBroker@@QAE@XZ, _CheckAuthChanged@CSSOScriptBroker@@QAEHXZ, _VerifyPassphrase@CSSOScriptBroker@@QAEHH@Z, _SetSelectOfflineMode@CSSOScriptBroker@@QAEHH@Z, _GetNextVariable@CSSOScriptBroker@@QAEHPAGH@Z, _AmIActive@CSSOScriptBroker@@QAEHW4SSOModulesEnum@@@Z, _ShutdownBroker@CSSOScriptBroker@@QAEHXZ, _FreeRTVariableResult@CSSOScriptBroker@@QAEHPAPAG@Z, _IsLoadingSSOData@CSSOScriptBroker@@QAEHPAH@Z, _SetValue@CSSOScriptBroker@@QAEHPBG000H@Z, _SaveSSOData@CSSOScriptBroker@@QAEH_N00@Z, _SetPrimaryDataStoreProfile@CSSOScriptBroker@@QAEHPBG@Z, _SetRTVariable@CSSOScriptBroker@@QAEHPBG00@Z, _SetSecureLoginStatus@CSSOScriptBroker@@QAEHH@Z, _LogError@CSSOScriptBroker@@QBAHW4SSOModulesEnum@@W4ErrorSeverityLevel@@HPAGZZ, _SetForceOfflineMode@CSSOScriptBroker@@QAEHH@Z, _LoadSSOData@CSSOScriptBroker@@QAEH_N0@Z, _GetCurrentUserName@CSSOScriptBroker@@QAEHPAPAG_N@Z, _ShowBrokerErrorBox@CSSOScriptBroker@@QAEHPBG0HPAH@Z, _FreeUserName@CSSOScriptBroker@@QAEHPAG@Z, _ClearAllSSOCredentials@CSSOScriptBroker@@QAEHXZ, _LoadPlatformList@CSSOScriptBroker@@QAEHW4SSOPlatformType@@_N@Z, _GetNextPlatform@CSSOScriptBroker@@QAEHAA_NAAW4SSOPlatformType@@PAGH@Z, _GetPlatformDescription@CSSOScriptBroker@@QAEHPBGPAPAG@Z, _FreePlatformList@CSSOScriptBroker@@QAEHXZ, _LoadCredentialSetList@CSSOScriptBroker@@QAEHPBGW4SSOCredSetType@@@Z, _GetNextCredentialSet@CSSOScriptBroker@@QAEHPAGH@Z, _FreeCredentialSetList@CSSOScriptBroker@@QAEHXZ, __0CSSOScriptBroker@@QAE@_N00@Z, _GetDataStoreInfo@CSSOScriptBroker@@QAEHPAW4SSODataStoreTraitsType@@PAH01@Z, _GetSelectOfflineMode@CSSOScriptBroker@@QAEHPAH@Z, _GetPreference@CSSOScriptBroker@@QAEHW4PreferenceNameEnum@@PAHPAG_N3@Z, _IsDataStoreConnectionEncrypted@CSSOScriptBroker@@QAEHPAH@Z, _GetDataStoreVersion@CSSOScriptBroker@@QAEHPAPAG_N@Z, _FreeBuffer@CSSOScriptBroker@@QAEHPAG@Z
> ADVAPI32.dll: RegSetValueExW, RegCloseKey, RegOpenKeyA, RegQueryValueExA, RegOpenKeyExA, OpenThreadToken, GetUserNameW, RegCreateKeyExW, OpenProcessToken, GetTokenInformation, LookupAccountSidW, RegQueryValueExW, RegDeleteValueW, RegOpenKeyExW
> CRYPT32.dll: CryptUnprotectData, CryptProtectData
> MFC42u.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCRT.dll: __CxxFrameHandler, __0exception@@QAE@ABV0@@Z, wcscmp, memset, wcslen, _CxxThrowException, towlower, wcsstr, _wcsupr, wcscpy, swprintf, _endthread, _beginthread, _except_handler3, __p___wargv, __p___argc, _wtoi, wcsncpy, _purecall, isdigit, abs, _vsnwprintf, _wstrdate, strlen, _wstrtime, _snwprintf, time, __1type_info@@UAE@XZ, _controlfp, __dllonexit, _terminate@@YAXXZ, _onexit, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __wgetmainargs, _wcmdln, exit, _XcptFilter, _exit, iswspace, strspn, strncmp, strstr, strncpy, strchr, strcspn, wcscat, srand, rand, strcmp, iswupper, tolower, _wtol, localtime, _wasctime, towupper, _wcsnicmp, sprintf, _beginthreadex, memmove, memcpy, strcpy, toupper, _wgetenv, _wstat, _itow, __set_app_type, _wcsicmp, __1exception@@UAE@XZ, __0exception@@QAE@ABQBD@Z, isspace
> KERNEL32.dll: LCMapStringW, GetStringTypeW, DeleteCriticalSection, GetVersionExA, CreateSemaphoreW, MultiByteToWideChar, GetVersion, LeaveCriticalSection, GetStringTypeA, GetUserDefaultLCID, GetCurrentProcessId, LCMapStringA, TerminateProcess, GetModuleHandleA, lstrcmpA, GetModuleFileNameW, GetPrivateProfileStringW, GetStartupInfoW, InitializeCriticalSection, ResumeThread, CreateDirectoryW, lstrlenA, ReleaseSemaphore, EnterCriticalSection, WideCharToMultiByte, ReleaseMutex, FindResourceW, LoadResource, LockResource, GetEnvironmentVariableW, OutputDebugStringW, LoadLibraryA, OpenProcess, GetLastError, GetProcAddress, FreeLibrary, GetVersionExW, WaitForSingleObject, LoadLibraryW, ResetEvent, SetEvent, Sleep, lstrlenW, CreateMutexW, CreateEventW, GetModuleHandleW, HeapFree, CreateProcessW, HeapAlloc, GetProcessHeap, GetComputerNameW, GetCurrentThread, LocalFree, GetCurrentProcess, SetProcessWorkingSetSize, InterlockedDecrement, LocalAlloc, InterlockedIncrement, GetProcessHeaps, CloseHandle
> USER32.dll: GetDesktopWindow, GetForegroundWindow, SetWindowPos, DialogBoxParamW, SendDlgItemMessageW, GetSystemMetrics, GetClientRect, ScreenToClient, MoveWindow, GetWindowTextW, DialogBoxIndirectParamW, SetWindowTextW, EndDialog, CreatePopupMenu, AppendMenuW, IsWindow, SetFocus, SetDlgItemTextW, DestroyWindow, GetWindowLongW, PeekMessageW, DispatchMessageW, MsgWaitForMultipleObjects, wsprintfW, LoadStringW, LoadIconW, MessageBoxW, GetWindowRect, ExitWindowsEx, LoadMenuIndirectW, RemoveMenu, GetSubMenu, CheckMenuItem, TrackPopupMenu, SetForegroundWindow, GetCursorPos, GetMenuStringW, KillTimer, SetTimer, CloseWindow, LoadCursorW, SystemParametersInfoW, DefWindowProcW, CreateWindowExW, PostMessageW, SendMessageW, EnableWindow, RegisterWindowMessageW, DrawTextW, GetDC, AdjustWindowRectEx, ReleaseDC, ShowWindow, CreateDialogIndirectParamW, GetDlgItem, FindWindowW, CharLowerW, LoadStringA
> GDI32.dll: SelectObject, SetBkColor, SetBkMode, CreateSolidBrush, SetTextColor
> SHELL32.dll: Shell_NotifyIconW, ShellExecuteW
> COMCTL32.dll: -
> MSVCP60.dll: _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBG0@Z, _what@runtime_error@std@@UBEPBDXZ, _max_size@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEIXZ, _max_size@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIXZ, __Copy@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXI@Z, _replace@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PAG0PBG1@Z, __8std@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@PBD@Z, __Copy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXI@Z, __Hstd@@YA_AV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@ABV10@PBD@Z, ___7runtime_error@std@@6B@, ___F_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEXXZ, __1_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@XZ, __Y_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV01@PBG@Z, __4_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV01@PBG@Z, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@ABV_$allocator@G@1@@Z, _c_str@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEPBGXZ, __4_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV01@ABV01@@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, _c_str@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEPBDXZ, _length@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEIXZ, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@PBGABV_$allocator@G@1@@Z, _empty@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBE_NXZ, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@ABV01@@Z, __0logic_error@std@@QAE@ABV01@@Z, __0out_of_range@std@@QAE@ABV01@@Z, __1out_of_range@std@@UAE@XZ, __0out_of_range@std@@QAE@ABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@1@@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBDABV_$allocator@D@1@@Z, __Ostd@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@0@Z, _end@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEPAGXZ, _begin@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEPAGXZ, __8std@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@0@Z, _npos@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@2IB, _find@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIABV12@I@Z, __Hstd@@YA_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@PBGABV10@@Z, _find@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGI@Z, _erase@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@II@Z, _find_last_of@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIGI@Z, _size@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIXZ, __Hstd@@YA_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@ABV10@0@Z, __Hstd@@YA_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@ABV10@PBG@Z, __Eos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXI@Z, _insert@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@IPBG@Z, _rend@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE_AV_$reverse_iterator@PAGGAAGPAGH@2@XZ, _end@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEPBGXZ, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@IG@Z, _reserve@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEXI@Z, _rbegin@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE_AV_$reverse_iterator@PAGGAAGPAGH@2@XZ, __1runtime_error@std@@UAE@XZ, __0runtime_error@std@@QAE@ABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@1@@Z, __0runtime_error@std@@QAE@ABV01@@Z, _compare@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEHPBG@Z, __0_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@IGABV_$allocator@G@1@@Z, _max@_$numeric_limits@H@std@@SAHXZ, _length@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIXZ, __Tidy@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEX_N@Z, _rfind@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGI@Z, __C@_1___Nullstr@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@CAPBGXZ@4GB, __Freeze@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXXZ, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBGI@Z, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@PBGI@Z, _find@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGII@Z, __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, _substr@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBE_AV12@II@Z, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, ___D_$basic_ostringstream@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEXXZ, _str@_$basic_ostringstream@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBE_AV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@2@XZ, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, __0_$basic_ostringstream@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAE@H@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, __9std@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@PBG@Z, __Mstd@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@0@Z, _erase@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@II@Z, ___7out_of_range@std@@6B@, __0logic_error@std@@QAE@ABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@1@@Z, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __Freeze@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXXZ, __Xran@std@@YAXXZ, _find@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEIPBDII@Z, _compare@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBEHIIPBDI@Z, __0Init@ios_base@std@@QAE@XZ, __1Init@ios_base@std@@QAE@XZ, __0_Winit@std@@QAE@XZ, __1_Winit@std@@QAE@XZ, _compare@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEHIIPBGI@Z, _find_first_of@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGII@Z, __Xlen@std@@YAXXZ, __Grow@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAE_NI_N@Z, __Doraise@runtime_error@std@@MBEXXZ, _begin@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEPBGXZ, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, __6_$basic_ostream@GU_$char_traits@G@std@@@std@@QAEAAV01@H@Z, __Grow@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAE_NI_N@Z, __Split@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXXZ, __A_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAGI@Z, _assign@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@IG@Z, __Eos@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXI@Z, __Split@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@AAEXXZ, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBD0ABV_$allocator@D@1@@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBD0@Z, _insert@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEPAGPAGG@Z, _rfind@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QBEIPBGII@Z, __8std@@YA_NABV_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@0@PBG@Z, __0_Lockit@std@@QAE@XZ, __1_Lockit@std@@QAE@XZ, _append@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z, _erase@_$basic_string@GU_$char_traits@G@std@@V_$allocator@G@2@@std@@QAEPAGPAG@Z, __0_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAE@PBDH@Z, __6std@@YAAAV_$basic_ostream@GU_$char_traits@G@std@@@0@AAV10@PBG@Z, _close@_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAEXXZ, ___D_$basic_ofstream@GU_$char_traits@G@std@@@std@@QAEXXZ
> ole32.dll: CoInitializeEx
> VERSION.dll: VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

( 0 exports )

ep44 · Answer

relance hijack et coche ceci
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/Content/fr/default.shtml
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.investorsgroup.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = https://home*.investorsgroup.com;https://businesslinkonwinfund.investorsgroup.co m;*.ig.bz;­*.iga.bz;*.gwl.ca;*.gwl.bz;*mycybrary.londonlife.com;*cybrary.londonl ife.com;*.ll.bz;*.grs­access.com;
O4 - HKLM\..\Run: [SecureLogin] "C:\Program Files\Protocom\SecureLogin\slproto.exe"
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 156.11.98.121 156.11.219.1 156.11.98.122

ensuite clique sur fix checked 

Télécharge OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
clic double sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :
Paste List of Files/Folders to be moved.

C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe
EmptyTemp

clique sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\\_OTMoveIt\MovedFiles.

il te sera peut-être demandé de redémarrer le pc pour achever la suppression. 

ensuite fait un scan en ligne

avec bitdefender et colle le rapport

https://www.bitdefender.com/toolbox/

Scan à faire sous Internet Explorer

un tuto
http://pageperso.aol.fr/rginformatique/mapage/defender.htm


@+

gaumos1 · Answer

Êtes-vous bien sûr? Parce que ces programmes je les utilise à tous les jours... ils se connectent automatiquement à mon ordinateur pour me donner des mises à jour pour mon travail, par le réseau de la compagnie.

ep44 · Answer

pour ces deux la 
C:\Program Files\Protocom\SecureLogin\slwinsso.exe
C:\Program Files\Protocom\SecureLogin\slproto.exe 

Prevx1 V2 2008.05.07 Malicious Software 
mais à toi de voir 
si tu es sur de ces fichiers pas de soucis 

donc fait le scan en ligne et dit ou tu en est avec tes soucis 

@+

gaumos1 · Answer

Je vais appeler demain au centre de ressources informatiques pour m'informer là-dessus.

Pour ce qui est du problème que j'avais, tout semble réglé. Je n'ai plus de fenêtres intempestives, et ma connexion internet semble fonctionner normalement. Merci beaucoup pour tout ton aide qui m'a permis de me sortir des ces problèmes!

Pour l'instant, voici le rapport BitDefender:

BitDefender Online Scanner
  
  
 
Scan report generated at: Wed, May 07, 2008 - 22:46:23
 
 
  
  
 
Scan path: C:\;D:\;
  
  
 
 
  
  
 
Statistics
 
Time
 00:41:32
 
Files
 167666
 
Folders
 4435
 
Boot Sectors
 2
 
Archives
 926
 
Packed Files
 8270
 
  
  
 
Results
 
Identified Viruses 
 4
 
Infected Files 
 6
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 6
 
  
  
 
Engines Info
 
Virus Definitions
 1190432
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 16
 
Archive plugins
 42
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 5
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe=>wise0031
 Detected with: Adware.Gator.AD
 
C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe=>wise0031
 Deleted
 
C:\Documents and Settings\gaumes1\Mes documents\Mes images\wallpapers\wbsamp.exe
 Update failed
 
C:\QooBox\Quarantine\catchme2008-05-06_144137,75.zip=>wvUmnKAq.dll
 Infected with: Trojan.Vundo.EJT
 
C:\QooBox\Quarantine\catchme2008-05-06_144137,75.zip=>wvUmnKAq.dll
 Deleted
 
C:\QooBox\Quarantine\catchme2008-05-06_144137,75.zip
 Updated
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP2\A0002602.dll
 Infected with: Trojan.Vundo.EJS
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP2\A0002602.dll
 Deleted
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP3\A0002710.dll
 Infected with: Trojan.Vundo.EJS
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP3\A0002710.dll
 Deleted
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP3\A0002772.dll
 Infected with: Trojan.Vundo.EKD
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP3\A0002772.dll
 Deleted
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP3\A0002816.dll
 Infected with: Trojan.Vundo.EKD
 
C:\System Volume Information\_restore{26B3DD07-5E5F-454B-BB43-A09D4B36A680}\RP3\A0002816.dll
 Deleted

ep44 · Answer

Bonour 
si tu es sur pour c'est fichiers pas de sucis mais tu peux toujours demandés pour avoir une confirmation 

Tu peux supprimer tous les logiciels que nous avons utilisés
va dans ajout/suppression de programes et dans programmes files
pour vérifier



ensuite fait ceci (IMPORTANT)

=démarrer
=panneau de configuration
=système
=onglet Restauration système
=coche la case (Désactiver la restauration système)
=redémarre l'ordinateur
=réactive la ensuite

@+

gaumos1 · Answer

Merci ep44 pour tout!

ep44 · Answer

;-)

Trojan, abebot, wml.exe

23 réponses

Discussions similaires

Newsletters