Virus virtumonde impossible a détruire!!
Djhardboy
-
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention -
^^Marie^^ Messages postés 41884 Date d'inscription Statut Membre Dernière intervention -
Bonjour, Merci a l'avance de l'aide que vous allez me donner j'ai un sérieux problème avec un virus qui serait d'origine Virtumonde qui d'après ce que j'en sais appelle d'autre virus sur le net et en plus de sa congestionne quasi totalement mon ordinateur et ce même après 2 format et 1 Write Zero format et réinstallation de windows.
Voici mon log Malwarebyte's Anti-Malware
Malwarebytes' Anti-Malware 1.14
Version de la base de données: 818
20:02:52 03/06/2008
mbam-log-6-3-2008 (20-02-52).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 160391
Temps écoulé: 27 minute(s), 38 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 12
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 23
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
C:\Windows\System32\jKATNDvV.dll (Trojan.Vundo) -> Unloaded module successfully.
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{38d30c71-98bd-479e-9283-7aa2c326ff16} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38d30c71-98bd-479e-9283-7aa2c326ff16} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0cf5d165-517e-48b6-b3c7-3054a24f8bf6} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0cf5d165-517e-48b6-b3c7-3054a24f8bf6} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{26af6f0f-494e-4be4-ba16-ea7cdf98dc26} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{26af6f0f-494e-4be4-ba16-ea7cdf98dc26} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{0cf5d165-517e-48b6-b3c7-3054a24f8bf6} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\647d49c3 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM674e7a5f (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkatndvv
Voici mon log hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:58, on 03/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Safe mode
Running processes:
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {81A02689-B9EE-4DCC-A73D-79A7E15EEBE2} - C:\Windows\system32\iifdbCsq.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B35CE958-ECDE-4FC8-8973-43CADCB23487} - C:\Windows\system32\jKATNDvV.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [DAEMON Tools] "%ProgramFiles%\DAEMON Tools\daemon.exe\" -lang 1033
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ljJAQHww.dll,#1
O4 - HKLM\..\Run: [BM674e7a5f] Rundll32.exe "C:\Windows\system32\uwfjbymn.dll",s
O4 - HKLM\..\Run: [647d49c3] rundll32.exe "C:\Windows\system32\nxhkboak.dll",b
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
--
End of file - 5811 bytes
Et finalement mon log LopSD:
-----------------------[ Lop S&D 4.2.1-2 XP/Vista ]---------------------
[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
[ USER : Administrateur ] [ "C:\Lop SD" ] [ Selection : 1 ]
[ 03/06/2008 | 20:32:57,05 ] [ PC : LHSWEET-C30JVEO ]
[ MAJ : 01-06-2008 | 15:51 ]
[ UAC => 0 ]
-------------[ Listing des dossiers dans Application Data ]------------
[03/06/2008|12:04] C:\Users\ADMINI~1\AppData\Roaming\Adobe\Acrobat
[02/11/2006|09:02] C:\Users\ADMINI~1\AppData\Roaming\Identities\{63D6359F-B98D-4CDC-8B0D-7E8A9EF4926E}
[02/06/2008|14:30] C:\Users\ADMINI~1\AppData\Roaming\Macromedia\Flash Player
[03/06/2008|13:56] C:\Users\ADMINI~1\AppData\Roaming\MailFrontier\addrbk
[03/06/2008|19:24] C:\Users\ADMINI~1\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware
[03/06/2008|11:38] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Internet Explorer
[03/06/2008|11:27] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\MSN Messenger
[03/06/2008|11:26] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\IdentityCRL
[02/06/2008|13:15] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\eHome
[02/06/2008|12:05] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\MMC
[02/06/2008|11:55] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Templates
[02/06/2008|05:32] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Office
[02/06/2008|05:31] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Document Building Blocks
[02/06/2008|05:31] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Word
[02/06/2008|05:31] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\AddIns
[02/06/2008|05:30] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Windows
[02/06/2008|05:23] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Protect
[02/06/2008|05:23] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Crypto
[02/11/2006|09:02] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\SystemCertificates
[02/11/2006|09:02] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Credentials
[02/06/2008|18:37] C:\Users\ADMINI~1\AppData\Roaming\Mozilla\Firefox
[03/06/2008|12:21] C:\Users\ADMINI~1\AppData\Roaming\Winamp\Plugins
----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------
[03/06/2008 20:29][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{9D2C9BB4-6A54-4BC9-95FA-E34EFE1291D7}.job
[03/06/2008 20:29][--ah-----] C:\Windows\tasks\SA.DAT
[03/06/2008 20:29][--a------] C:\Windows\tasks\SCHEDLGU.TXT
------[ Listing des dossiers dans C:\ProgramData ]------
[02/06/2008|05:10] C:\ProgramData\Adobe
[02/06/2008|05:10] C:\ProgramData\Apple Computer
[02/11/2006|09:00] C:\ProgramData\Application Data
[03/06/2008|12:50] C:\ProgramData\BM674e7a5f.txt
[03/06/2008|11:42] C:\ProgramData\BM674e7a5f.xml
[02/06/2008|05:06] C:\ProgramData\Bureau
[03/06/2008|13:23] C:\ProgramData\CheckPoint
[03/06/2008|16:17] C:\ProgramData\Creative
[02/11/2006|09:00] C:\ProgramData\Desktop
[02/11/2006|09:00] C:\ProgramData\Documents
[02/06/2008|05:31] C:\ProgramData\ESET
[02/06/2008|05:06] C:\ProgramData\Favoris
[02/11/2006|09:00] C:\ProgramData\Favorites
[03/06/2008|14:43] C:\ProgramData\MailFrontier
[03/06/2008|19:24] C:\ProgramData\Malwarebytes
[02/06/2008|05:06] C:\ProgramData\Menu D‚marrer
[02/06/2008|05:14] C:\ProgramData\Microsoft
[03/06/2008|11:08] C:\ProgramData\Microsoft Help
[02/06/2008|05:06] C:\ProgramData\ModŠles
[02/06/2008|05:27] C:\ProgramData\NVIDIA
[03/06/2008|11:40] C:\ProgramData\pskt.ini
[02/06/2008|05:10] C:\ProgramData\Real
[03/06/2008|12:43] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|09:00] C:\ProgramData\Start Menu
[02/11/2006|09:00] C:\ProgramData\Templates
[02/06/2008|13:03] C:\ProgramData\Winamp Toolbar
[03/06/2008|11:11] C:\ProgramData\WLInstaller
---------------[ Listing des dossiers dans C:\Program Files ]--------------
[02/06/2008|05:10] C:\Program Files\Adobe
[02/06/2008|05:45] C:\Program Files\Attansic
[02/06/2008|05:11] C:\Program Files\Combined Community Codec Pack
[03/06/2008|09:23] C:\Program Files\Common Files
[02/06/2008|13:23] C:\Program Files\Creative
[02/06/2008|05:18] C:\Program Files\DAEMON Tools
[02/06/2008|05:03] C:\Program Files\desktop.ini
[02/06/2008|05:10] C:\Program Files\ElcomSoft
[02/06/2008|05:31] C:\Program Files\ESET
[02/06/2008|05:06] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[02/06/2008|05:11] C:\Program Files\HashTab Shell Extension
[02/06/2008|19:10] C:\Program Files\InstallShield Installation Information
[02/06/2008|05:34] C:\Program Files\Intel
[03/06/2008|11:34] C:\Program Files\Internet Explorer
[02/06/2008|05:11] C:\Program Files\Java
[03/06/2008|19:24] C:\Program Files\Malwarebytes' Anti-Malware
[02/11/2006|08:35] C:\Program Files\Microsoft Games
[02/06/2008|05:14] C:\Program Files\Microsoft Office
[02/06/2008|05:14] C:\Program Files\Microsoft Visual Studio
[02/06/2008|05:12] C:\Program Files\Microsoft Visual Studio 8
[02/06/2008|05:14] C:\Program Files\Microsoft Works
[02/06/2008|05:14] C:\Program Files\Microsoft.NET
[02/11/2006|08:41] C:\Program Files\Movie Maker
[02/06/2008|18:54] C:\Program Files\Mozilla Firefox
[02/06/2008|05:14] C:\Program Files\MSBuild
[02/06/2008|05:18] C:\Program Files\MSECache
[02/11/2006|08:35] C:\Program Files\MSN
[02/06/2008|05:11] C:\Program Files\My Company Name
[02/06/2008|13:22] C:\Program Files\OpenAL
[02/06/2008|05:10] C:\Program Files\QuickTime Alternative
[02/06/2008|05:10] C:\Program Files\Real Alternative
[02/06/2008|05:42] C:\Program Files\Realtek
[02/11/2006|08:35] C:\Program Files\Reference Assemblies
[03/06/2008|11:52] C:\Program Files\Spybot - Search & Destroy
[03/06/2008|20:17] C:\Program Files\Trend Micro
[02/11/2006|09:00] C:\Program Files\Uninstall Information
[02/06/2008|05:11] C:\Program Files\Unlocker
[02/06/2008|13:02] C:\Program Files\uTorrent
[02/06/2008|13:04] C:\Program Files\Winamp
[02/06/2008|13:03] C:\Program Files\Winamp Toolbar
[02/11/2006|08:41] C:\Program Files\Windows Calendar
[02/11/2006|08:41] C:\Program Files\Windows Collaboration
[02/11/2006|08:41] C:\Program Files\Windows Defender
[02/11/2006|08:41] C:\Program Files\Windows Journal
[03/06/2008|11:32] C:\Program Files\Windows Live
[03/06/2008|11:34] C:\Program Files\Windows Mail
[03/06/2008|11:34] C:\Program Files\Windows Media Player
[02/06/2008|05:06] C:\Program Files\Windows NT
[02/11/2006|08:41] C:\Program Files\Windows Photo Gallery
[03/06/2008|11:34] C:\Program Files\Windows Sidebar
[02/06/2008|05:10] C:\Program Files\WinRAR
[03/06/2008|12:36] C:\Program Files\Zone Labs
------[ Listing des dossiers dans C:\Program Files\Common Files ]------
[02/06/2008|05:10] C:\Program Files\Common Files\Adobe
[02/06/2008|05:14] C:\Program Files\Common Files\DESIGNER
[02/06/2008|05:23] C:\Program Files\Common Files\InstallShield
[02/06/2008|05:11] C:\Program Files\Common Files\Java
[03/06/2008|11:21] C:\Program Files\Common Files\microsoft shared
[02/11/2006|07:18] C:\Program Files\Common Files\Services
[02/11/2006|07:18] C:\Program Files\Common Files\SpeechEngines
[02/06/2008|05:12] C:\Program Files\Common Files\System
[03/06/2008|11:21] C:\Program Files\Common Files\WindowsLiveInstaller
---------------------------[ Process ]--------------------------
... 17
... OK !
----------------------[ Recherche avec S_Lop ]---------------------
Aucun fichier / dossier Lop trouvé !
-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------
Aucun fichier / dossier Lop trouvé !
----------------------[ Verification du Registre ]----------------------
..... OK !
--------------------[ Verification du fichier Hosts ]---------------------
Fichier Hosts PROPRE
----------------[ Recherche de fichiers avec Catchme ]-----------------
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-03 20:33:18
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------[ Recherche d'autres infections ]---------------------
C:\Windows\system32\qsCbdfii.ini2
C:\Windows\system32\VvDNTAKj.ini2
C:\Windows\system32\wvELnXbc.ini2
[b]! VUNDO Possible !/b
=> C:\Users\Administrateur\AppData\Local\Temp\Windows.Genuine.Advantage.Validation.v1.7.69.2.CRACKED-ETH0.rar [mininova].torrent
=> C:\Users\Administrateur\AppData\Roaming\Microsoft\Windows\Recent\VISTA ENG+FR X86 32 BITS 6000 FINAL + CRACK.lnk
=> C:\Users\Administrateur\Downloads\Windows.Genuine.Advantage.Validation.v1.7.69.2.CRACKED-ETH0.rar
[F:358][D:36]-> C:\Users\ADMINI~1\AppData\Local\Temp
[F:38][D:1]-> C:\Users\ADMINI~1\AppData\Roaming\MICROS~1\Windows\Cookies
[F:472][D:7]-> C:\Users\ADMINI~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:34][D:3]-> C:\$Recycle.Bin
[ UAC => 1 ]
--------------------[ Fin du rapport a 20:33:38,80 ]----------------------
En passant j'ai essayer différente version de windows dont des version original et des versions crackés ce qui change absoluement rien.
Voici mon log Malwarebyte's Anti-Malware
Malwarebytes' Anti-Malware 1.14
Version de la base de données: 818
20:02:52 03/06/2008
mbam-log-6-3-2008 (20-02-52).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 160391
Temps écoulé: 27 minute(s), 38 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 12
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 23
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
C:\Windows\System32\jKATNDvV.dll (Trojan.Vundo) -> Unloaded module successfully.
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{38d30c71-98bd-479e-9283-7aa2c326ff16} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{38d30c71-98bd-479e-9283-7aa2c326ff16} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0cf5d165-517e-48b6-b3c7-3054a24f8bf6} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0cf5d165-517e-48b6-b3c7-3054a24f8bf6} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{26af6f0f-494e-4be4-ba16-ea7cdf98dc26} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{26af6f0f-494e-4be4-ba16-ea7cdf98dc26} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{0cf5d165-517e-48b6-b3c7-3054a24f8bf6} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\647d49c3 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM674e7a5f (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkatndvv
Voici mon log hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:58, on 03/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Safe mode
Running processes:
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {81A02689-B9EE-4DCC-A73D-79A7E15EEBE2} - C:\Windows\system32\iifdbCsq.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B35CE958-ECDE-4FC8-8973-43CADCB23487} - C:\Windows\system32\jKATNDvV.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [DAEMON Tools] "%ProgramFiles%\DAEMON Tools\daemon.exe\" -lang 1033
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ljJAQHww.dll,#1
O4 - HKLM\..\Run: [BM674e7a5f] Rundll32.exe "C:\Windows\system32\uwfjbymn.dll",s
O4 - HKLM\..\Run: [647d49c3] rundll32.exe "C:\Windows\system32\nxhkboak.dll",b
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
--
End of file - 5811 bytes
Et finalement mon log LopSD:
-----------------------[ Lop S&D 4.2.1-2 XP/Vista ]---------------------
[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
[ USER : Administrateur ] [ "C:\Lop SD" ] [ Selection : 1 ]
[ 03/06/2008 | 20:32:57,05 ] [ PC : LHSWEET-C30JVEO ]
[ MAJ : 01-06-2008 | 15:51 ]
[ UAC => 0 ]
-------------[ Listing des dossiers dans Application Data ]------------
[03/06/2008|12:04] C:\Users\ADMINI~1\AppData\Roaming\Adobe\Acrobat
[02/11/2006|09:02] C:\Users\ADMINI~1\AppData\Roaming\Identities\{63D6359F-B98D-4CDC-8B0D-7E8A9EF4926E}
[02/06/2008|14:30] C:\Users\ADMINI~1\AppData\Roaming\Macromedia\Flash Player
[03/06/2008|13:56] C:\Users\ADMINI~1\AppData\Roaming\MailFrontier\addrbk
[03/06/2008|19:24] C:\Users\ADMINI~1\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware
[03/06/2008|11:38] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Internet Explorer
[03/06/2008|11:27] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\MSN Messenger
[03/06/2008|11:26] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\IdentityCRL
[02/06/2008|13:15] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\eHome
[02/06/2008|12:05] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\MMC
[02/06/2008|11:55] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Templates
[02/06/2008|05:32] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Office
[02/06/2008|05:31] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Document Building Blocks
[02/06/2008|05:31] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Word
[02/06/2008|05:31] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\AddIns
[02/06/2008|05:30] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Windows
[02/06/2008|05:23] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Protect
[02/06/2008|05:23] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Crypto
[02/11/2006|09:02] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\SystemCertificates
[02/11/2006|09:02] C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Credentials
[02/06/2008|18:37] C:\Users\ADMINI~1\AppData\Roaming\Mozilla\Firefox
[03/06/2008|12:21] C:\Users\ADMINI~1\AppData\Roaming\Winamp\Plugins
----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------
[03/06/2008 20:29][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{9D2C9BB4-6A54-4BC9-95FA-E34EFE1291D7}.job
[03/06/2008 20:29][--ah-----] C:\Windows\tasks\SA.DAT
[03/06/2008 20:29][--a------] C:\Windows\tasks\SCHEDLGU.TXT
------[ Listing des dossiers dans C:\ProgramData ]------
[02/06/2008|05:10] C:\ProgramData\Adobe
[02/06/2008|05:10] C:\ProgramData\Apple Computer
[02/11/2006|09:00] C:\ProgramData\Application Data
[03/06/2008|12:50] C:\ProgramData\BM674e7a5f.txt
[03/06/2008|11:42] C:\ProgramData\BM674e7a5f.xml
[02/06/2008|05:06] C:\ProgramData\Bureau
[03/06/2008|13:23] C:\ProgramData\CheckPoint
[03/06/2008|16:17] C:\ProgramData\Creative
[02/11/2006|09:00] C:\ProgramData\Desktop
[02/11/2006|09:00] C:\ProgramData\Documents
[02/06/2008|05:31] C:\ProgramData\ESET
[02/06/2008|05:06] C:\ProgramData\Favoris
[02/11/2006|09:00] C:\ProgramData\Favorites
[03/06/2008|14:43] C:\ProgramData\MailFrontier
[03/06/2008|19:24] C:\ProgramData\Malwarebytes
[02/06/2008|05:06] C:\ProgramData\Menu D‚marrer
[02/06/2008|05:14] C:\ProgramData\Microsoft
[03/06/2008|11:08] C:\ProgramData\Microsoft Help
[02/06/2008|05:06] C:\ProgramData\ModŠles
[02/06/2008|05:27] C:\ProgramData\NVIDIA
[03/06/2008|11:40] C:\ProgramData\pskt.ini
[02/06/2008|05:10] C:\ProgramData\Real
[03/06/2008|12:43] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|09:00] C:\ProgramData\Start Menu
[02/11/2006|09:00] C:\ProgramData\Templates
[02/06/2008|13:03] C:\ProgramData\Winamp Toolbar
[03/06/2008|11:11] C:\ProgramData\WLInstaller
---------------[ Listing des dossiers dans C:\Program Files ]--------------
[02/06/2008|05:10] C:\Program Files\Adobe
[02/06/2008|05:45] C:\Program Files\Attansic
[02/06/2008|05:11] C:\Program Files\Combined Community Codec Pack
[03/06/2008|09:23] C:\Program Files\Common Files
[02/06/2008|13:23] C:\Program Files\Creative
[02/06/2008|05:18] C:\Program Files\DAEMON Tools
[02/06/2008|05:03] C:\Program Files\desktop.ini
[02/06/2008|05:10] C:\Program Files\ElcomSoft
[02/06/2008|05:31] C:\Program Files\ESET
[02/06/2008|05:06] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[02/06/2008|05:11] C:\Program Files\HashTab Shell Extension
[02/06/2008|19:10] C:\Program Files\InstallShield Installation Information
[02/06/2008|05:34] C:\Program Files\Intel
[03/06/2008|11:34] C:\Program Files\Internet Explorer
[02/06/2008|05:11] C:\Program Files\Java
[03/06/2008|19:24] C:\Program Files\Malwarebytes' Anti-Malware
[02/11/2006|08:35] C:\Program Files\Microsoft Games
[02/06/2008|05:14] C:\Program Files\Microsoft Office
[02/06/2008|05:14] C:\Program Files\Microsoft Visual Studio
[02/06/2008|05:12] C:\Program Files\Microsoft Visual Studio 8
[02/06/2008|05:14] C:\Program Files\Microsoft Works
[02/06/2008|05:14] C:\Program Files\Microsoft.NET
[02/11/2006|08:41] C:\Program Files\Movie Maker
[02/06/2008|18:54] C:\Program Files\Mozilla Firefox
[02/06/2008|05:14] C:\Program Files\MSBuild
[02/06/2008|05:18] C:\Program Files\MSECache
[02/11/2006|08:35] C:\Program Files\MSN
[02/06/2008|05:11] C:\Program Files\My Company Name
[02/06/2008|13:22] C:\Program Files\OpenAL
[02/06/2008|05:10] C:\Program Files\QuickTime Alternative
[02/06/2008|05:10] C:\Program Files\Real Alternative
[02/06/2008|05:42] C:\Program Files\Realtek
[02/11/2006|08:35] C:\Program Files\Reference Assemblies
[03/06/2008|11:52] C:\Program Files\Spybot - Search & Destroy
[03/06/2008|20:17] C:\Program Files\Trend Micro
[02/11/2006|09:00] C:\Program Files\Uninstall Information
[02/06/2008|05:11] C:\Program Files\Unlocker
[02/06/2008|13:02] C:\Program Files\uTorrent
[02/06/2008|13:04] C:\Program Files\Winamp
[02/06/2008|13:03] C:\Program Files\Winamp Toolbar
[02/11/2006|08:41] C:\Program Files\Windows Calendar
[02/11/2006|08:41] C:\Program Files\Windows Collaboration
[02/11/2006|08:41] C:\Program Files\Windows Defender
[02/11/2006|08:41] C:\Program Files\Windows Journal
[03/06/2008|11:32] C:\Program Files\Windows Live
[03/06/2008|11:34] C:\Program Files\Windows Mail
[03/06/2008|11:34] C:\Program Files\Windows Media Player
[02/06/2008|05:06] C:\Program Files\Windows NT
[02/11/2006|08:41] C:\Program Files\Windows Photo Gallery
[03/06/2008|11:34] C:\Program Files\Windows Sidebar
[02/06/2008|05:10] C:\Program Files\WinRAR
[03/06/2008|12:36] C:\Program Files\Zone Labs
------[ Listing des dossiers dans C:\Program Files\Common Files ]------
[02/06/2008|05:10] C:\Program Files\Common Files\Adobe
[02/06/2008|05:14] C:\Program Files\Common Files\DESIGNER
[02/06/2008|05:23] C:\Program Files\Common Files\InstallShield
[02/06/2008|05:11] C:\Program Files\Common Files\Java
[03/06/2008|11:21] C:\Program Files\Common Files\microsoft shared
[02/11/2006|07:18] C:\Program Files\Common Files\Services
[02/11/2006|07:18] C:\Program Files\Common Files\SpeechEngines
[02/06/2008|05:12] C:\Program Files\Common Files\System
[03/06/2008|11:21] C:\Program Files\Common Files\WindowsLiveInstaller
---------------------------[ Process ]--------------------------
... 17
... OK !
----------------------[ Recherche avec S_Lop ]---------------------
Aucun fichier / dossier Lop trouvé !
-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------
Aucun fichier / dossier Lop trouvé !
----------------------[ Verification du Registre ]----------------------
..... OK !
--------------------[ Verification du fichier Hosts ]---------------------
Fichier Hosts PROPRE
----------------[ Recherche de fichiers avec Catchme ]-----------------
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-03 20:33:18
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0
--------------------[ Recherche d'autres infections ]---------------------
C:\Windows\system32\qsCbdfii.ini2
C:\Windows\system32\VvDNTAKj.ini2
C:\Windows\system32\wvELnXbc.ini2
[b]! VUNDO Possible !/b
=> C:\Users\Administrateur\AppData\Local\Temp\Windows.Genuine.Advantage.Validation.v1.7.69.2.CRACKED-ETH0.rar [mininova].torrent
=> C:\Users\Administrateur\AppData\Roaming\Microsoft\Windows\Recent\VISTA ENG+FR X86 32 BITS 6000 FINAL + CRACK.lnk
=> C:\Users\Administrateur\Downloads\Windows.Genuine.Advantage.Validation.v1.7.69.2.CRACKED-ETH0.rar
[F:358][D:36]-> C:\Users\ADMINI~1\AppData\Local\Temp
[F:38][D:1]-> C:\Users\ADMINI~1\AppData\Roaming\MICROS~1\Windows\Cookies
[F:472][D:7]-> C:\Users\ADMINI~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:34][D:3]-> C:\$Recycle.Bin
[ UAC => 1 ]
--------------------[ Fin du rapport a 20:33:38,80 ]----------------------
En passant j'ai essayer différente version de windows dont des version original et des versions crackés ce qui change absoluement rien.
Configuration: Windows Vista Firefox 2.0.0.14
12 réponses
-
Salut !!
Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le Bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi. -
C'est fait et voici le log de ComboFix:
ComboFix 08-06-03.1 - Administrateur 2008-06-04 9:51:48.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6000.0.1252.1.1036.18.2284 [GMT -4:00]
Endroit: C:\Users\Administrateur\Desktop\ComboFix.exe
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\bbvdvtqp.ini
C:\Windows\System32\dvpubhgw.ini
C:\Windows\System32\evapxicy.ini
C:\Windows\system32\fnuaoycx.ini
C:\Windows\System32\hmqlqhdc.ini
C:\Windows\System32\kaobkhxn.ini
C:\Windows\system32\lhufddhg.ini
C:\Windows\system32\qsCbdfii.ini
C:\Windows\System32\qsCbdfii.ini2
C:\Windows\system32\VvDNTAKj.ini
C:\Windows\System32\VvDNTAKj.ini2
C:\Windows\System32\wvELnXbc.ini
C:\Windows\System32\wvELnXbc.ini2
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-04 to 2008-06-04 ))))))))))))))))))))))))))))))))))))
.
2008-06-03 20:17 . 2008-06-03 20:17 <REP> d-------- C:\Program Files\Trend Micro
2008-06-03 20:17 . 2008-06-03 20:33 <REP> d-------- C:\Lop SD
2008-06-03 19:24 . 2008-06-03 19:24 <REP> d-------- C:\Users\Administrateur\AppData\Roaming\Malwarebytes
2008-06-03 19:24 . 2008-06-03 19:24 <REP> d-------- C:\ProgramData\Malwarebytes
2008-06-03 19:24 . 2008-06-03 19:24 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-03 19:24 . 2008-05-30 01:06 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-06-03 19:24 . 2008-05-30 01:06 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
2008-06-03 16:27 . 2008-01-09 03:31 1,086,952 --a------ C:\Windows\System32\zpeng24.dll
2008-06-03 16:23 . 2008-06-03 16:23 1,080 --a------ C:\Windows\System32\settingsbkup.sfm
2008-06-03 16:23 . 2008-06-03 16:23 1,080 --a------ C:\Windows\System32\settings.sfm
2008-06-03 14:48 . 2008-06-04 08:40 1,276 --a------ C:\rollback.ini
2008-06-03 14:43 . 2008-06-03 14:43 <REP> d-------- C:\ProgramData\MailFrontier
2008-06-03 14:34 . 2008-06-04 09:55 928,288 --ahs---- C:\Windows\System32\drivers\fidbox.dat
2008-06-03 14:34 . 2008-06-04 09:53 21,860 --ahs---- C:\Windows\System32\drivers\fidbox.idx
2008-06-03 13:56 . 2008-06-03 13:56 <REP> d-------- C:\Users\Administrateur\AppData\Roaming\MailFrontier
2008-06-03 13:23 . 2008-06-04 09:43 <REP> d-------- C:\Windows\System32\ZoneLabs
2008-06-03 13:23 . 2008-06-03 13:23 <REP> d-------- C:\ProgramData\CheckPoint
2008-06-03 13:23 . 2008-01-09 03:31 75,248 --a------ C:\Windows\zllsputility.exe
2008-06-03 13:23 . 2004-04-27 04:40 11,264 --a------ C:\Windows\System32\SpOrder.dll
2008-06-03 12:50 . 2008-01-09 03:32 276,368 --a------ C:\Windows\System32\drivers\vsdatant.sys
2008-06-03 12:43 . 2008-06-03 12:43 153 --a------ C:\Windows\wininit.ini
2008-06-03 12:36 . 2008-06-03 12:36 <REP> d-------- C:\Program Files\Zone Labs
2008-06-03 12:36 . 2008-06-04 09:55 354,388 --ah----- C:\Windows\System32\drivers\vsconfig.xml
2008-06-03 12:35 . 2008-06-04 09:45 <REP> d-------- C:\Windows\Internet Logs
2008-06-03 11:52 . 2008-06-03 12:43 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-06-03 11:52 . 2008-06-03 11:52 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-03 11:06 . 2008-06-03 11:06 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-06-03 11:06 . 2008-06-03 11:06 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
2008-06-03 11:05 . 2008-06-03 11:05 8,147,968 --a------ C:\Windows\System32\wmploc.DLL
2008-06-03 11:05 . 2008-06-03 11:05 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_xusb21_01005.Wdf
2008-06-03 11:03 . 2008-06-03 11:03 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-06-03 11:03 . 2008-06-03 11:03 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-06-03 11:03 . 2008-06-03 11:03 337,408 --a------ C:\Windows\System32\intl.cpl
2008-06-03 11:03 . 2008-06-03 11:03 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-06-03 11:03 . 2008-06-03 11:03 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-06-03 11:03 . 2008-06-03 11:03 166,912 --a------ C:\Windows\System32\lpksetup.exe
2008-06-03 11:03 . 2008-06-03 11:03 25,600 --a------ C:\Windows\System32\LangCleanupSysprepAction.dll
2008-06-03 11:03 . 2008-06-03 11:03 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-06-03 11:03 . 2008-06-03 11:03 23,552 --a------ C:\Windows\System32\lpremove.exe
2008-06-03 11:03 . 2008-06-03 11:03 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-06-03 11:03 . 2008-06-03 11:03 10,240 --a------ C:\Windows\System32\MUILanguageCleanup.dll
2008-06-03 11:02 . 2008-06-03 11:02 2,027,008 --a------ C:\Windows\System32\win32k.sys
2008-06-03 11:02 . 2008-06-03 11:02 223,232 --a------ C:\Windows\System32\WMASF.DLL
2008-06-03 11:02 . 2008-06-03 11:02 9,728 --a------ C:\Windows\System32\LAPRXY.DLL
2008-06-03 11:02 . 2008-06-03 11:02 2,048 --a------ C:\Windows\System32\asferror.dll
2008-06-03 11:01 . 2008-06-03 11:01 737,792 --a------ C:\Windows\System32\inetcomm.dll
2008-06-03 11:01 . 2008-06-03 11:01 558,080 --a------ C:\Windows\System32\oleaut32.dll
2008-06-03 11:01 . 2008-06-03 11:01 296,448 --a------ C:\Windows\System32\gdi32.dll
2008-06-03 11:01 . 2008-06-03 11:01 84,480 --a------ C:\Windows\System32\INETRES.dll
2008-06-03 11:01 . 2008-06-03 11:01 11,776 --a------ C:\Windows\System32\sbunattend.exe
2008-06-03 11:00 . 2008-06-03 11:00 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-06-03 11:00 . 2008-06-03 11:00 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-06-03 11:00 . 2008-06-03 11:00 83,968 --a------ C:\Windows\System32\dnsrslvr.dll
2008-06-03 11:00 . 2008-06-03 11:00 53,760 --a------ C:\Windows\System32\drivers\hdaudbus.sys
2008-06-03 11:00 . 2008-06-03 11:00 24,576 --a------ C:\Windows\System32\dnscacheugc.exe
2008-06-03 10:54 . 2008-06-03 10:54 788,992 --a------ C:\Windows\System32\rpcrt4.dll
2008-06-03 10:54 . 2008-06-03 10:54 130,048 --a------ C:\Windows\System32\drivers\srv2.sys
2008-06-03 10:54 . 2008-06-03 10:54 101,888 --a------ C:\Windows\System32\drivers\mrxsmb.sys
2008-06-03 10:54 . 2008-06-03 10:54 84,992 --a------ C:\Windows\System32\drivers\srvnet.sys
2008-06-03 10:54 . 2008-06-03 10:54 58,368 --a------ C:\Windows\System32\drivers\mrxsmb20.sys
2008-06-03 10:52 . 2008-06-03 10:52 99,840 --a------ C:\Windows\System32\poqexec.exe
2008-06-03 10:51 . 2008-06-03 10:51 750,080 --a------ C:\Windows\System32\qmgr.dll
2008-06-03 10:51 . 2008-06-03 10:51 2,048 --a------ C:\Windows\System32\tzres.dll
2008-06-03 10:50 . 2008-06-03 10:50 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-06-03 10:22 . 2008-06-03 10:22 <REP> d-------- C:\$WINDOWS.~LS
2008-06-03 10:20 . 2008-06-03 10:20 <REP> d-------- C:\$WINDOWS.~BT
2008-06-03 10:20 . 2008-06-03 10:26 1,905 --a------ C:\Windows\diagwrn.xml
2008-06-03 10:20 . 2008-06-03 10:26 1,905 --a------ C:\Windows\diagerr.xml
2008-06-03 09:23 . 2008-06-03 11:32 <REP> d-------- C:\Program Files\Windows Live
2008-06-03 09:23 . 2008-06-03 11:21 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-03 09:16 . 2008-06-03 11:11 <REP> d-------- C:\ProgramData\WLInstaller
2008-06-02 19:08 . 2008-06-04 09:53 55,300 --a------ C:\Windows\System32\BMXStateBkp-{00000005-00000000-00000002-00001102-00000005-00311102}.rfx
2008-06-02 19:08 . 2008-06-04 09:53 55,300 --a------ C:\Windows\System32\BMXState-{00000005-00000000-00000002-00001102-00000005-00311102}.rfx
2008-06-02 19:08 . 2008-06-04 09:53 788 --a------ C:\Windows\System32\DVCState-{00000005-00000000-00000002-00001102-00000005-00311102}.rfx
2008-06-02 13:22 . 2008-06-03 16:17 <REP> d-------- C:\ProgramData\Creative
2008-06-02 13:22 . 2008-06-02 13:22 <REP> d-------- C:\Program Files\OpenAL
2008-06-02 13:22 . 2008-06-02 19:09 413,696 --a------ C:\Windows\System32\wrap_oal.dll
2008-06-02 13:22 . 2008-06-02 19:09 110,592 --a------ C:\Windows\System32\OpenAL32.dll
2008-06-02 13:22 . 2007-02-26 15:24 94,208 --a------ C:\Windows\System32\cttele32.dll
2008-06-02 13:19 . 2008-06-02 13:21 <REP> d-------- C:\Windows\System32\Data
2008-06-02 13:19 . 2008-06-02 13:23 <REP> d-------- C:\Program Files\Creative
2008-06-02 13:19 . 2007-08-28 10:22 108,544 --a------ C:\Windows\System32\APOMngr.DLL
2008-06-02 13:19 . 2007-05-28 11:28 69,120 --a------ C:\Windows\System32\CmdRtr.DLL
2008-06-02 13:19 . 2004-07-30 14:47 20,480 --a------ C:\Windows\INRESFRN.DLL
2008-06-02 13:19 . 2006-06-09 09:20 3,072 --a------ C:\Windows\CTXFIFRN.DLL
2008-06-02 13:19 . 2008-06-02 19:07 87 -rah----- C:\Windows\ctfile.rfc
2008-06-02 13:09 . 2008-06-02 13:09 1,474,560 -rahs---- C:\vstaldr.img
2008-06-02 13:09 . 2008-06-02 13:09 166,876 -rahs---- C:\vstaldr
2008-06-02 13:09 . 2008-06-02 13:09 219 -rahs---- C:\menu.lst
2008-06-02 13:03 . 2008-06-02 13:04 <REP> d-------- C:\Users\Administrateur\AppData\Roaming\Winamp
2008-06-02 13:03 . 2008-06-02 13:03 <REP> d-------- C:\ProgramData\Winamp Toolbar
2008-06-02 13:03 . 2008-06-02 13:03 <REP> d-------- C:\Program Files\Winamp Toolbar
2008-06-02 13:03 . 2008-06-02 13:04 <REP> d-------- C:\Program Files\Winamp
2008-06-02 13:03 . 2007-03-07 19:51 129,784 --------- C:\Windows\System32\pxafs.dll
2008-06-02 13:02 . 2008-06-04 09:42 <REP> d-------- C:\Users\Administrateur\AppData\Roaming\uTorrent
2008-06-02 13:02 . 2008-06-02 13:02 <REP> d-------- C:\Program Files\uTorrent
2008-06-02 11:50 . 2008-06-02 11:50 <REP> d-------- C:\RaidTool
2008-06-02 11:50 . 2007-03-21 12:23 1,953,792 -r------- C:\Windows\System32\xRaidSetup.exe
2008-06-02 11:50 . 2007-03-20 17:15 143,360 -r------- C:\Windows\System32\xRaidAPI.dll
2008-06-02 11:50 . 2007-03-24 07:20 46,208 --a------ C:\Windows\System32\drivers\jraid.sys
2008-06-02 11:50 . 2006-02-07 15:52 6,912 --a------ C:\Windows\System32\drivers\JGOGO.sys
2008-06-02 11:49 . 2008-06-02 11:50 <REP> d-------- C:\Windows\RaidTool
2008-06-02 11:49 . 2006-08-30 08:33 319,984 -r------- C:\Windows\System32\DifxApi.dll
2008-06-02 05:57 . 2008-06-02 05:03 <REP> d-------- C:\Windows\Panther
2008-06-02 05:57 . 2008-06-04 09:53 <REP> d--hs---- C:\Boot
2008-06-02 05:57 . 2008-06-03 10:52 443,912 -rahs---- C:\bootmgr
2008-06-02 05:57 . 2008-06-02 05:57 8,192 -ra-s---- C:\BOOTSECT.BAK
2008-06-02 05:56 . 2008-06-02 05:56 <REP> d-------- C:\Windows\System32\OEM
2008-06-02 05:56 . 2007-03-16 12:40 59 -ra------ C:\Windows\DELL_VERSION
2008-06-02 05:46 . 2008-06-02 05:46 <REP> d-------- C:\Windows\System32\Attansic
2008-06-02 05:45 . 2008-06-02 05:45 <REP> d-------- C:\Program Files\Attansic
2008-06-02 05:45 . 2007-03-15 10:41 48,128 --a------ C:\Windows\System32\drivers\atl01v32.sys
2008-06-02 05:43 . 2008-06-02 05:43 <REP> d-------- C:\Windows\System32\RTCOM
2008-06-02 05:42 . 2008-06-02 05:42 <REP> d-------- C:\Program Files\Realtek
2008-06-02 05:42 . 2008-06-02 19:10 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-06-02 05:39 . 2008-06-02 05:39 <REP> d-------- C:\Windows\ASUSInstAll
2008-06-02 05:34 . 2008-06-02 05:34 <REP> d-------- C:\Program Files\Intel
2008-06-02 05:33 . 2008-06-02 05:33 <REP> d-------- C:\Intel
2008-06-02 05:33 . 2008-06-02 11:50 14,604 --a------ C:\Windows\Ascd_log.ini
2008-06-02 05:33 . 2008-06-02 05:33 14,280 --a------ C:\Windows\Ascd_tmp.ini
2008-06-02 05:33 . 2006-10-11 07:33 10,288 --a------ C:\Windows\System32\drivers\ASUSHWIO.SYS
2008-06-02 05:33 . 2006-10-18 17:44 7,680 --a------ C:\Windows\System32\drivers\ASACPI.sys
2008-06-02 05:31 . 2008-06-02 05:31 <REP> d-------- C:\ProgramData\ESET
2008-06-02 05:31 . 2008-06-02 05:31 <REP> d-------- C:\Program Files\ESET
2008-06-02 05:27 . 2008-06-02 05:27 <REP> d-------- C:\ProgramData\NVIDIA
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-03 23:27 225,792 ----a-w C:\Windows\Internet Logs\xDB8CF3.tmp
2008-06-03 15:34 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-03 15:34 --------- d-----w C:\Program Files\Windows Mail
2008-06-03 15:07 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-06-03 15:07 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-06-03 15:07 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-06-03 15:07 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-06-03 15:07 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-06-03 15:07 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-06-03 15:07 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-06-03 15:07 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-06-03 15:07 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-06-03 15:07 2,923,520 ----a-w C:\Windows\explorer.exe
2008-06-03 15:07 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-06-03 15:07 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-06-03 15:04 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-06-03 15:04 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-06-03 15:04 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-06-03 15:04 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-06-03 15:04 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-06-03 15:04 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-06-03 15:04 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-06-03 15:04 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-06-03 15:04 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-06-03 15:04 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-06-03 15:04 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-06-03 15:00 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-03 15:00 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-06-03 15:00 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-06-03 15:00 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-06-03 15:00 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-03 14:53 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-03 14:53 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-03 14:53 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-03 14:53 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-02 09:42 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-06-02 09:42 315,392 ----a-w C:\Windows\HideWin.exe
2008-06-02 09:14 --------- d-----w C:\Program Files\MSBuild
2008-06-02 09:06 --------- d-sh--w C:\ProgramData\Modèles
2008-06-02 09:06 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-06-02 09:06 --------- d-sh--w C:\ProgramData\Favoris
2008-06-02 09:06 --------- d-sh--w C:\ProgramData\Bureau
2008-06-02 09:06 --------- d-sh--w C:\Program Files\Fichiers communs
2008-06-02 09:03 174 --sha-w C:\Program Files\desktop.ini
.
------- Sigcheck -------
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{81A02689-B9EE-4DCC-A73D-79A7E15EEBE2}]
C:\Windows\system32\iifdbCsq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-19 18:36 1267040]
[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-19 18:36 1267040]
[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-06-03 11:01 1232896]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 07:24 167368]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 08:34 125440]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe\ -lang 1033" [ ]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 13:19 15872]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-03-24 13:52 13531680]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-03-24 13:52 92704]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 10:48 1443072]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 15:04 4423680 C:\Windows\RtHDVCpl.exe]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 10:36 36864]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 14:49 36352]
"CTHelper"="CTHELPER.EXE" [2008-02-20 20:58 19456 C:\Windows\System32\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-02-20 20:58 19968 C:\Windows\System32\CTXFIHLP.EXE]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-01-09 03:31 959976]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableInstallerDetection"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"ValidateAdminCodeSignatures"= 1 (0x1)
"FilterAdministratorToken"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"DisableNotifications"= 1 (0x1)
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{36B219AC-7A97-48E4-9C21-B7453CAF7516}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{C26247C1-36F9-41E6-A573-29E784678E7D}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{79ED4521-6848-4D28-82DC-89B0298EAC41}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{1CFB8BA6-7563-49A4-973E-3524D680500B}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F4985805-B1D6-454C-8F0C-CB521C282A36}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DisableNotifications"= 1 (0x1)
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"DisableNotifications"= 1 (0x1)
"EnableFirewall"= 0 (0x0)
R1 epfwtdir;epfwtdir;C:\Windows\system32\DRIVERS\epfwtdir.sys [2008-03-13 10:52]
R2 CTAudSvcService;Creative Audio Service;C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2008-03-07 13:24]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43]
R3 ha20x2k;Creative 20X HAL Driver;C:\Windows\system32\drivers\ha20x2k.sys [2008-02-25 09:44]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\atl01v32.sys [2007-03-15 10:41]
S3 MBAMCatchMe;MBAMCatchMe;C:\Windows\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{101d5ec9-3082-11dd-bfbf-806e6f6e6963}]
\shell\AutoRun\command - E:\.\Bin\Assetup.exe
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-06-04 13:45:16 C:\Windows\Tasks\User_Feed_Synchronization-{9D2C9BB4-6A54-4BC9-95FA-E34EFE1291D7}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-04 09:55:52
Windows 6.0.6000 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\nvvsvc.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\ZoneLabs\avsys\ScanningProcess.exe
C:\Windows\System32\ZoneLabs\avsys\ScanningProcess.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\CTXFISPI.EXE
C:\ComboFix\catchme.tmp
C:\ComboFix\catchme.tmp
C:\ComboFix\catchme.tmp
C:\ComboFix\catchme.tmp
C:\ComboFix\catchme.tmp
C:\ComboFix\catchme.tmp
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-04 9:58:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-04 13:57:04
Pre-Run: 298,395,967,488 octets libres
Post-Run: 298,623,221,760 octets libres
314 --- E O F --- 2008-06-03 15:08:47 -
-
Et voici mon nouveau log hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:31, on 04/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Safe mode
Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {81A02689-B9EE-4DCC-A73D-79A7E15EEBE2} - C:\Windows\system32\iifdbCsq.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [DAEMON Tools] "%ProgramFiles%\DAEMON Tools\daemon.exe\" -lang 1033
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
-
Salut,
tu peux faire un scan avec Hijackthis, cocher les lignes suivantes
O2 - BHO: (no name) - {81A02689-B9EE-4DCC-A73D-79A7E15EEBE2} - C:\Windows\system32\iifdbCsq.dll (file missing)
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
msnmsgr
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] \"C:\Program Files\Winamp\winampa.exe\"
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
Attention, elles ne sont pas nécessairement dans l'ordre
Après appuie sur "fix checked"
Ciao
Zor
PS: pourrais-tu faire un scan en mode sans échec avec NOD32. A plus.- Et maintenant mon ordi fait des blue screen et redémarre pour rien en donnant ce code :
Signature du problème :
Nom d’événement de problème: BlueScreen
Version du système: 6.0.6000.2.0.0.256.1
Identificateur de paramètres régionaux: 1036
Informations supplémentaires sur le problème :
BCCode: d1
BCP1: 00000019
BCP2: 00000002
BCP3: 00000000
BCP4: 93B76CA5
OS Version: 6_0_6000
Service Pack: 0_0
Product: 256_1
Fichiers aidant à décrire le problème :
C:\Windows\Minidump\Mini060408-02.dmp
C:\Windows\TEMP\WER-36114-0.sysdata.xml
C:\Windows\TEMP\WEREC9F.tmp.version.txt
Lire notre déclaration de confidentialité :
https://privacy.microsoft.com/fr-fr/microsoft-error-reporting-privacy-statement
-
-
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
Je ne vois plus d infection dans ton rapport, je pense que ton probleme est résolu
Si tu n as plus de problemes, va mettre résolu en haut de ton topic -
Super merci beaucoup je vais voir si cela perdure et si je vois que le problème reviens je réécrirai. Encore merci de la rapidité de la réponse c'est vraiment gentil je trainais ce virus depuis un mois environ.
-
fallait pas cocher les lignes comme l avait dit zorhino, je parie qu il t as dit de faire ca sans savoir ce qu il faisait :s
-
je ne crois pas...ou en tout cas je ne sais pas...demande lui ! mdr
(je ne rigole pas vraiment t inquiete, ca me tue des helpers pareils ) -
Fais chier je sais pas pourquoi j'ai écouté ce clown j'aurais du laisser ça comme c'était quand je te parlais goffrey5
-
Stop, le "clown" tient à répondre.
1) J'ai en effet supprimé des fichiers superflus au démarrage (lignes 04), ainsi que des lignes 09 obsolètes (file missing).
J'ai déjà agi de la sorte des dizaines de fois sur ce site, sans aucun problème et à la satisfaction générale des personnes aidées.
2) Personnellement, j'ai déjà supprimé certaines lignes superflues avec mes 2 ordis personnels, en ne laissant que les programmes indispensables (pare-feu, antivirus, antispyware, etc) au démarrage. Je peux assurer que mes ordinateurs fonctionnent parfaitement et que je ne joue pas à l'apprenti-sorcier.
3) Personnellement, je me remettrais en question en utilisant des versions de Windows "exotiques", ou comme tu le mentionnes en téléchargeant Comodo avec activation de l'antivirus alors que, comme tu l'as dit et comme le montre le rapport Hijackthis, tu n'avais pas désinstallé NOD32.
Il ne faut dès lors pas s'étonner qu'il puisse y avoir des conflits entre programmes.
Malgré toute la meilleure volonté du monde, l'utilisateur reste maître et responsable de ses actes.
4) Sous vista, tu peux aller dans "sécurité et maintenance" et revenir en arrière. Chaque opération est reprise dans un historique.
Bien à toi,
Zor -
NOD32 n a rien à voir avec ce probleme là..
Et les analyses que je lui au fait faire ne font que supprimer les infections et ne font pas des problemes au pc..
C est surtout en cochant ce qu il ne faut pas dans hijackthis, et surtout que ce sont des applications démarrées par le registre qui ne montraient aucun signe d infection, elles étaient saines...Ce n est pas comme si elles n avaient pas été traiées..
Et ce n est pas la premiere fois non plus qu une personne se plaint apres avoir supprimer ces lignes !! -
Djhardboy : As tu réactiver le controle des comptes utilisateurs ??
Le probleme ne vient surement pas de là mais je demande quand meme?-
Oui je l'ai réactivé et j'ai relancé le volet windows par la suite aussi pour ce qui est des blue screen que je n'avais pas avant selon microsoft mon problème devrait se règlé ou du moins s'amélioré en installant service pack 1 ce que je suis en train de faire.
Et pour répondre a Zorinho je te remercie de l'aide que tu as voulu me fournir mais je tiens a te dire que te défendre en accusant mon utilisation certain logiciel ou système d'exploitation ce n'est pas très professionnel surtout venant d'un gars qui connait sa. Tu serais supposé savoir qu'il y a des versions de windows (exotique) comme tu le mentionnes qui fonctionnes beaucoup mieux,avec beaucoup moins de bug et beaucoup moins de ressources et je tiens a signaler que j'ai jamais eu de problème au par avant.Mais je ne t'en tien pas rigueur le but étant de me donner un coup de main avec un virus que j'avais du mal a éliminer.- Salut,
j'étais énervé par les remarques d'avant.
Si j'ai lancé des accusations, c'est sous le coup de l'énervement.J'avais lu dans un de tes messages ceci "En passant j'ai essayer différente version de windows dont des version original et des versions crackés ce qui change absoluement rien."
Puis, tu disais que tu voulais activer l'antivirus de Comodo alors que NOD32 était toujours présent ou pas désinstallé.
Bref, j'étais énervé parce qu'il y a des gens ici qui font n'importe quoi et qui s'étonnent que leur ordi ne tourne pas rond.
Maintenant, j'espère simplement que tout va rentrer dans l'ordre.
Ciao
Zor
-
