Malware Protecotr 2008

Question

Bonjour tout le monde,

Je viens solliciter votre aide concernant un problème de virus qui s'est installé sur mon pc : Malware Protector 2008
Il est sur mon pc depuis fin Avril mais jusqu'à présent il ne faisait que ouvrir des fenêtres Internet ... Malheureusement, depuis ce week-end, un magnique fond d'écran "Warning! Spyware deteced on your computer! Install an antivirus or spyware remover to clean your computer" est apparu, ainsi qu’une fenêtre de pub pour Malware Protector 2008 que je ne peux pas fermer. Des applications de recherche de virus et de débogage se lancent automatiquement. Je ne peux pas désinstaller Malware Protector 2008 en plus …

Mon antivirus est Securitoo (F-Secure) que je paye ts les mois avec Orange.

Je ne suis pas très calé en informatique et je ne sais pas quoi faire… quelqu’un aurait-il l’amabilité de m’aider avec mon problème ?

Merci d’avance.

sKe69 · Answer

Salut,
Télécharges et instales le logiciel HijackThis : 
 
ici :ftp://ftp.commentcamarche.com/download/HJTInstall.exe
ou ici : http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

1-Cliker sur le setup pour lancer l'instale : laisses toi guider et ne modifies pas les parramètres d'instale .
A la fin tu doit avoir un raccouci sur ton bureau et aussi un cheminement comme : "C:\ programme file\Trend Micro\HijackThis\HijackThis.exe " .

Important :
Renommer le prg HijackThis : 
Rends toi sur ton PC ici "C:\ programme file\Trend Micro\HijackThis\HijackThis.exe"<---clik droit sur ce dernier et choisis "renommer" : tapes monjack et valide .

tuto pour l’utiliser 
regarde ici c'est parfaitement expliqué en images 
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm 

2-!!Déconnectes toi et fermes toute tes applications en cours !!

Double clik sur le raccourci du bureau,
Fais un scan monjack (ou HijackThis renommé) et postes le rapport généré pour analyse ...

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:46:29, on 23/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\84psjwcuuxz.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\lphc1tuj0egbr.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe
C:\Program Files\Microsoft Security Adviser\msavsc.exe
C:\Program Files\Microsoft Security Adviser\msscan.exe
C:\Program Files\Microsoft Security Adviser\msiemon.exe
C:\Program Files\Microsoft Security Adviser\msfw.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft Security Adviser\mssadv.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Security Adviser\msctrl.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
F3 - REG:win.ini: load=System
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,System
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S3B.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [lphc1tuj0egbr] C:\WINDOWS\system32\lphc1tuj0egbr.exe
O4 - HKLM\..\Run: [runservices] C:\WINDOWS\services.exe
O4 - HKLM\..\Run: [SMshc7tuj0egbr] C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe
O4 - HKLM\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe
O4 - HKLM\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe
O4 - HKLM\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe
O4 - HKLM\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe
O4 - HKLM\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe
O4 - HKCU\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe
O4 - HKCU\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe
O4 - HKCU\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe
O4 - HKCU\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe
O4 - HKCU\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

PPFFFF !!!!! c'est la giga cata ton PC ! Malaware protector + virus MSN + Vundo + Ect ...

Pour Malaware protector, commences par ce-ci pour voire :

Télécharges RogueRemover :
ici https://www.malwarebytes.com/for-home/products/ 
ou http://www.libellules.ch/dotclear/index.php?2006/11/29/1518-rogue-remover
ou https://www.01net.com/telecharger/

Il permet de se débarrasser de ces pseudo logiciels que l'on appelle " rogue "  

L'outil détecte un nombre grandissant de ces infections comme WinAntivirus, Spyware Remover, DriveCleaner, SpySheriff ou SystemDoctor 2006. L'interface est très simple et pemet de sélectionner le logiciel à éradiquer et de lancer l'analyse des fichiers, dossiers et de la base de registre. 

Repostes un nouveau rapport hijackthis après avoir passé rogue remover...

Primura · Answer

Il n'y a pas de malware protector dans la liste ... même apres mise a jour de la base de données. J'ai essayé les autres malware de la liste mais il me dit que tt est clean

sKe69 · Answer

Bon ... laisses courir et fais ce qui suit :

Télécharges MSNFix.zip (de !aur3n7) : 
http://sosvirus.changelog.fr/MSNFix.zip 
---> décompresses-le sur le Bureau ( = extraire tout ). 

Imperatif : Démarrer en mode sans echec : 
Comment aller en Mode sans échec 
1) Redémarres ton ordi 
2) Tapotes la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreur ...) 

Lances le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau. 
- Exécute l'option R (recherche). 
- Si l'infection est détectée, exécute l'option N (nettoyage) . 
---> Une fois finit, sauvegardes ce rapport sur ton bureau .

Redémarres ton PC ( = retour au mode normal ), 
et postes moi ce rapport accompagné d'un nouveau rapport hijackthis ( fait en mode normal ) dans ta prochaine réponse pour analyse ...

Primura · Answer

MSNFix 1.725  
 
C:\Documents and Settings\S‚bastien\Bureau\MSNFix 
Fix exécuté le 23/06/2008 - 18:43:20,32 By S‚bastien 
mode sans échec           
    
************************ Recherche les fichiers présents      
    
... C:\autorun.inf 
... C:\Autorun.inf 
... C:\svchost.exe 
... C:\WINDOWS\config\svchost.exe 
... C:\WINDOWS\services.exe 
... C:\WINDOWS\System.exe 
... C:\WINDOWS\system32	mp.txt 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... System 
.. OK ... C:\autorun.inf  
.. OK ... C:\Autorun.inf  
.. OK ... C:\svchost.exe  
.. OK ... C:\WINDOWS\config\svchost.exe  
.. OK ... C:\WINDOWS\services.exe  
.. OK ... C:\WINDOWS\System.exe  
.. OK ... C:\WINDOWS\system32	mp.txt  
 
 
 
************************ Nettoyage du registre 
 
 
 
Les fichiers encore présents seront supprimés au prochain redémarrage 
 
 
Aucun Fichier trouvé 
 
 
 
************************ Fichiers suspects 
 
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention 
 
[C:\svchost2.exe] C3D10E0EA22B6337673B097C40FA6466 

[color=#FF0000][b]==>/b/color SVP merci d'envoyer le fichier  [b] C:\DOCUME~1\SBASTI~1\Bureau\Upload_Me.zip /b sur http://upload.changelog.fr

 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 23062008_18460012.zip
 
************************ HKLM\...\Winlogon\Userinit 
 
Userinit = C:\WINDOWS\system32\userinit.exe, 

Important : http://msnfix.changelog.fr/index.php/2008/05/18/32-alerte


------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:47:30, on 23/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\84psjwcuuxz.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\lphc1tuj0egbr.exe
C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Microsoft Security Adviser\msfw.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Security Adviser\msiemon.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Microsoft Security Adviser\mssadv.exe
C:\Program Files\Microsoft Security Adviser\msavsc.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S3B.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [lphc1tuj0egbr] C:\WINDOWS\system32\lphc1tuj0egbr.exe
O4 - HKLM\..\Run: [runservices] C:\WINDOWS\services.exe
O4 - HKLM\..\Run: [SMshc7tuj0egbr] C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe
O4 - HKLM\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe
O4 - HKLM\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe
O4 - HKLM\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe
O4 - HKLM\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe
O4 - HKLM\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe
O4 - HKCU\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe
O4 - HKCU\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe
O4 - HKCU\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe
O4 - HKCU\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe
O4 - HKCU\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

La suite :
Télécharges SDFix sur ton bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe. 

--->Double clique sur SDFix.exe et choisis "Install" .

Puis une fois l'instale faite ,redémarre en mode sans échec . 
Comment aller en Mode sans échec :
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 

Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
--->Tape Y pour lancer le script. 
Le Fix supprime les services du virus et nettoie le registre, de ce fait un redémarrage est nécessaire , donc :
presses une touche pour redémarrer quand il te le sera demandé . 

Le PC va mettre du temps avant de démarrer ( c'est normale ), après le chargement du Bureau presses une touche lorsque "Finished" s'affiche .

Le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier C:\SDFix sous le nom "Report.txt".
Postes ce dernier dans ta prochaine réponse accompagné d'un nouveau rapport Hijakcthis pour analyse ...

Primura · Answer

[b]SDFix: Version 1.196 [/b]
Run by S‚bastien on 23/06/2008 at 19:09

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

[b]Name [/b]: 
{DEF85C80-216A-43ab-AF70-1665EDBE2780}
WINAX55

[b]Path [/b]:
\??\C:\WINDOWS\TEMP\107.tmp 
System32\Drivers\Winax55.sys 

{DEF85C80-216A-43ab-AF70-1665EDBE2780} - Deleted
WINAX55 - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Service WINAX55 - Deleted

[b]Checking Files [/b]: 

Trojan Files Found:

C:\Program Files\Microsoft Security Adviser\msavsc.0xe - Deleted
C:\Program Files\Microsoft Security Adviser\msavsc.exe - Deleted
C:\Program Files\Microsoft Security Adviser\msctrl.0xe - Deleted
C:\Program Files\Microsoft Security Adviser\msctrl.exe - Deleted
C:\Program Files\Microsoft Security Adviser\msfw.exe - Deleted
C:\Program Files\Microsoft Security Adviser\msiemon.exe - Deleted
C:\Program Files\Microsoft Security Adviser\mssadv.exe - Deleted
C:\Program Files\Microsoft Security Adviser\msscan.exe - Deleted
C:\WINDOWS\system32\1.tmp - Deleted
C:\svchost2.exe  - Deleted
C:\WINDOWS\msavsc.dll  - Deleted
C:\WINDOWS\msctrl.dll  - Deleted
C:\WINDOWS\msfw.dll  - Deleted
C:\WINDOWS\msiemon.dll  - Deleted
C:\WINDOWS\mssadv.dll  - Deleted
C:\WINDOWS\msscan.dll  - Deleted
C:\WINDOWS\system32\WinCtrl32.dll  - Deleted
C:\WINDOWS\Temp\ed47fa.$  - Deleted
C:\WINDOWS\system32\drivers\WINAX55.sys - Deleted

[color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the [url=http://www2.gmer.net/mbr/]MBR Rootkit Detector[/url] by Gmer or [url=https://free.drweb.com/cureit]CureIt[/url] by Dr.Web[/color]

Could Not Remove C:\WINDOWS\Temp\bca4e2da.$$$ 
Could Not Remove C:\WINDOWS\Temp\fa56d7ec.$$$ 

Folder C:\Program Files\Microsoft Security Adviser - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-23 19:14:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
"khjeh"=hex:20,02,00,00,6c,26,85,bd,db,37,69,de,3c,b4,bb,f1,26,3b,75,91,8b,..
"hj34z0"=hex:1e,e8,b3,93,83,e8,ad,85,8b,67,62,e5,18,7c,12,41,20,17,d0,c2,0d,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:

WINAX55



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Ex‚cuter une DLL en tant qu'application"
"C:\WINDOWS\system32\84psjwcuuxz.exe"="C:\WINDOWS\system32\84psjwcuuxz.exe:*:Disabled:84psjwcuuxz"
"C:\Program Files\Orange\Connectivity\ConnectivityManager.exe"="C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:

C:\WINDOWS\Temp\bca4e2da.$$$  Found
C:\WINDOWS\Temp\fa56d7ec.$$$  Found

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed 11 Jun 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 18 May 2005     2,585,864 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a2c8f709dd0237a7e496be18e0ba404e\BIT7AF.tmp"

[b]Finished![/b]

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:18:17, on 23/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\84psjwcuuxz.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\lphc1tuj0egbr.exe
C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S3B.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [lphc1tuj0egbr] C:\WINDOWS\system32\lphc1tuj0egbr.exe
O4 - HKLM\..\Run: [SMshc7tuj0egbr] C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe
O4 - HKCU\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

Bien ... une partie de faite ...

1-Télécharges : - CCleaner 
https://www.pcastuces.com/logitheque/ccleaner.htm 
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première.
Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ). 

Un tuto ( aide ): 
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm 

Utilisation:
vas dans "nettoyeur" : fait analyse puis nettoyage 
et vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) . 

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

2-Télécharges VirtumundoBegone sur ton bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

!!Ce déconnecter et fermer toute ces applications le temps de la manipe !!

Double cliquer sur VirtumundoBeGone.exe et suivre les instructions. 
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau . 
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu). 

Postes le rapport VBG accompagné d'un nouveau rapport Hijackthis pour analyse ...

Primura · Answer

[06/23/2008, 20:22:01] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Sébastien\Bureau\VirtumundoBeGone.exe" )
[06/23/2008, 20:22:09] - Detected System Information:
[06/23/2008, 20:22:09] -  Windows Version: 5.1.2600, Service Pack 2
[06/23/2008, 20:22:09] -  Current Username: Sébastien (Admin)
[06/23/2008, 20:22:09] -  Windows is in NORMAL mode.
[06/23/2008, 20:22:09] - Searching for Browser Helper Objects:
[06/23/2008, 20:22:09] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[06/23/2008, 20:22:09] -  BHO 2: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[06/23/2008, 20:22:09] -  BHO 3: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[06/23/2008, 20:22:09] -  BHO 4: {B56F637C-8AF9-43FA-A31B-935F967A00CC} ()
[06/23/2008, 20:22:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/23/2008, 20:22:09] -  Checking for HKLM\...\Winlogon\Notify\comdlg32e
[06/23/2008, 20:22:09] -  Key not found: HKLM\...\Winlogon\Notify\comdlg32e, continuing.
[06/23/2008, 20:22:09] -  BHO 5: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} (EpsonToolBandKicker Class)
[06/23/2008, 20:22:09] -  BHO 6: {FA566E27-2B42-422B-9370-B1157205F1E1} ()
[06/23/2008, 20:22:09] - WARNING: BHO has no default name. Checking for Winlogon reference.
[06/23/2008, 20:22:09] -  Checking for HKLM\...\Winlogon\Notify\dbnmpntwb
[06/23/2008, 20:22:09] -  Key not found: HKLM\...\Winlogon\Notify\dbnmpntwb, continuing.
[06/23/2008, 20:22:09] - Finished Searching Browser Helper Objects
[06/23/2008, 20:22:09] - Finishing up...
[06/23/2008, 20:22:09] - Nothing found! Exiting...

Primura · Answer

Je n'ai pas u besoin de redémarrer le rapport vgb c fait tt seul a la fin
Je redemarre la et je tenvoie le hijack this

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:28:29, on 23/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\84psjwcuuxz.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\lphc1tuj0egbr.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S3B.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [lphc1tuj0egbr] C:\WINDOWS\system32\lphc1tuj0egbr.exe
O4 - HKLM\..\Run: [SMshc7tuj0egbr] C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe
O4 - HKCU\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

Bizard  :/

fais ce-ci : 
Télécharges MalwareByte's : 
ici ftp://ftp.commentcamarche.com/download/mbam-setup.exe
ou ici : http://www.malwarebytes.org/mbam.php
 
un tuto sympa : https://forum.pcastuces.com/sujet.asp?f=31&s=3 

Instales le ( choisis bien "francais" ; ne modifies pas les parramètres d'instale ) et mets le à jour . 

Puis redémarres en mode sans échec : 
Comment aller en Mode sans échec 
1) Redémarres ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreur ...)
 
Lances Malwarebyte's .

Fais un scan dit "complet" ( sélectionnes bien tout tes disks avant le scan )  et supprimes tout ce qu'il peut trouver :
--->une fois le scan terminé , click sur "résultat" : puis vérifies que tous les ojbets infectés soient validés, puis click sur " supression " .

Redémarres ton PC ( mode normal ). 

Postes le rapport sauvegardé après la supression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes) accompagné d'un nouvel hijackthis ( fait en mode normal ) ...

Primura · Answer

Malwarebytes' Anti-Malware 1.18
Version de la base de données: 883

21:08:00 23/06/2008
mbam-log-6-23-2008 (21-08-00).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 85144
Temps écoulé: 12 minute(s), 25 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 18

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\baseukd32.dll (Trojan.Downloader) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SMshc7tuj0egbr (Rogue.MalwareProtector) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\mssadv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mssadv.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\system32\AppCert (Trojan.Downloader) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe (Rogue.MalwareProtector) -> Quarantined and deleted successfully.
C:\svchost.MSNFix (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\shc7tuj0egbr\shc7tuj0egbrSkin.dll (Rogue.MalwareProtector) -> Quarantined and deleted successfully.
C:\WINDOWS\services.MSNFix (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\comdlg32e.dll (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\system32\AppCert\wnl32.dll (Spyware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\filter.drv (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\hb20g.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\hb21g.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\hb22g.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\options.dat (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clbdll.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\clbdriver.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\baseukd32.dll (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\Sébastien\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sébastien\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sébastien\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sébastien\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

Primura · Answer

ca va bcp mieux deja la :) par contre mbam m'a dit quil avait pas pu tt virer et quil avait placer ces fichiers dans supression au demarrage dc je c pas si les fichiers ont été supprimé automatiquement qd g redémarré ..

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:18:10, on 23/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\84psjwcuuxz.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\lphc1tuj0egbr.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S3B.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [lphc1tuj0egbr] C:\WINDOWS\system32\lphc1tuj0egbr.exe
O4 - HKCU\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

Primura · Answer

je crois que malware protector a disparu. jai tjs le fond decran par contre avec une tite fenetre (je c pas si c en rapport) : "blue screen saver configure", "Sysinternals" avec une case a cocher "fake disk"....^^

sKe69 · Answer

Effectivement Malwarebytes a bien bosser ... mais il en reste ...

Télécharges ComboFix (par sUBs) sur ton Bureau (et pas ailleur !): 
http://download.bleepingcomputer.com/sUBs/ComboFix.exe <--- clik droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix et valide . 

----------------------------------------------- ATTENTION ---------------------------------------------------------------
!! déconnectes toi,fermes tes applications en cours et DESACTIVES TES DEFENCES (anti-virus, guardes anti spy-ware, pare-feu) le temps de la manipe : 
en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après  !!
--->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
Tuto ( aide ) ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :
double-cliques C-Fix.exe ( = combofix.exe ) . 

Appuyes sur la touche Y (Yes) pour démarrer le scan . 

Attention : n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi. 
---> si un message d'erreur windows apparait à un momment , clik sur la croix en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! ) 

Le rapport sera crée dans: C:\Combofix.txt 
 
Postes le rapport Combofix accompagné d'un nouveau rapport hijackthis pour analyse ...

Primura · Answer

ComboFix 08-06-20.4 - Sébastien 2008-06-23 21:58:15.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1598 [GMT 2:00] Endroit: C:\Documents and Settings\Sébastien\Bureau\C-Fix.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008 C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\How to Register Malware Protector 2008.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\License Agreement.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Malware Protector 2008.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Register Malware Protector 2008.lnk C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Uninstall.lnk C:\Documents and Settings\Sébastien\Application Data\shc7tuj0egbr C:\Program Files\shc7tuj0egbr C:\WINDOWS\system32\blphc1tuj0egbr.scr C:\WINDOWS\system32\loadsftpf.dat C:\WINDOWS\system32\lphc1tuj0egbr.exe C:\WINDOWS\system32\phc1tuj0egbr.bmp E:\Autorun.inf . ((((((((((((((((((((((((((((( Fichiers créés 2008-05-23 to 2008-06-23 )))))))))))))))))))))))))))))))))))) . 2008-06-23 20:43 . 2008-06-23 20:43 d-------- C:\Documents and Settings\Sébastien\Application Data\Malwarebytes 2008-06-23 20:42 . 2008-06-23 20:42 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-23 20:42 . 2008-06-23 20:42 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-23 20:42 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-23 20:42 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-23 20:08 . 2008-06-23 20:08 d-------- C:\Program Files\CCleaner 2008-06-23 19:08 . 2008-06-23 19:08 d-------- C:\WINDOWS\ERUNT 2008-06-23 19:05 . 2008-06-23 19:15 d-------- C:\SDFix 2008-06-23 18:13 . 2008-06-23 18:14 d-------- C:\Program Files\RogueRemover FREE 2008-06-23 17:35 . 2008-06-23 17:35 d-------- C:\Program Files\Trend Micro 2008-06-22 11:47 . 2004-08-05 14:00 4,224 --a------ C:\WINDOWS\system32\beep.sys 2008-06-11 22:16 . 2008-06-11 22:16 d-------- C:\Program Files\Windows Media Connect 2 2008-06-11 22:15 . 2008-06-11 22:15 d-------- C:\WINDOWS\system32\LogFiles 2008-06-11 22:15 . 2008-06-11 22:16 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-06-02 01:27 . 2008-06-02 01:27 d-------- C:\Documents and Settings\Sébastien\Application Data\vlc 2008-05-31 03:17 . 2008-06-09 00:59 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-31 03:17 . 2008-05-31 03:17 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-28 19:11 . 2008-05-28 19:11 d--h----- C:\WINDOWS\PIF . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-10 16:52 --------- d-----w C:\Program Files\eMule 2008-06-04 16:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-06-03 21:56 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\Lavasoft 2008-05-20 19:20 --------- d-----w C:\Documents and Settings\Sébastien\Application Data eamspeak2 2008-05-17 18:02 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\dbzikwch 2008-05-17 09:50 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\Skype 2008-05-17 09:43 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\skypePM 2008-05-16 18:17 --------- d-----w C:\Program Files\Fichiers communs\Mozilla Shared 2008-05-16 18:17 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\dbzikwch 2008-05-12 16:52 --------- d-----w C:\Program Files\Windows Live 2008-05-12 16:52 --------- d-----w C:\Program Files\MSN Messenger 2008-05-12 16:52 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-05-11 20:40 --------- d-----w C:\Program Files\Skype 2008-05-11 20:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-05-11 20:39 --------- d-----w C:\Program Files\Fichiers communs\Skype 2008-05-04 01:39 5,632 ----a-w C:\WINDOWS\system32\drivers\StarOpen.sys 2008-04-27 19:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-27 12:00 2,770 ----a-w C:\WINDOWS\system32 mp.reg 2008-04-26 19:04 --------- d-----w C:\Program Files\Orange 2008-04-26 19:03 --------- d-----w C:\Program Files\Fichiers communs\France Telecom 2008-04-26 18:32 --------- d-----w C:\Program Files\SAGEM 2008-04-26 18:32 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\InstallShield 2008-04-26 17:05 --------- d-----w C:\Program Files\Wanadoo 2008-04-25 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-24 06:10 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe 2008-04-23 20:14 82,944 ----a-w C:\WINDOWS\system32\IEDFix.exe 2008-04-23 20:14 82,944 ----a-w C:\WINDOWS\system32\404Fix.exe 2008-04-23 18:28 20,608 ----a-w C:\WINDOWS\system32\drivers\zmpyoyvx.dat 2008-04-23 18:28 196,608 ----a-w C:\WINDOWS\system32\libssl32.dll 2008-04-23 18:28 1,015,808 ----a-w C:\WINDOWS\system32\libeay32.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B56F637C-8AF9-43FA-A31B-935F967A00CC}] 2004-08-05 14:00 88064 --a------ C:\WINDOWS\system32\comdlg32e.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FA566E27-2B42-422B-9370-B1157205F1E1}] 2004-08-05 14:00 84992 --a------ c:\windows\system32\dbnmpntwb.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "84psjwcuuxz"="C:\WINDOWS\system32\84psjwcuuxz.exe" [2004-08-05 14:00 17408] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-03 00:27 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-09 09:36 8527872] "nwiz"="nwiz.exe" [2007-10-09 09:36 1626112 C:\WINDOWS\system32 wiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-09 09:36 81920] "DAEMON Tools-1033"="E:\daemon.exe" [2004-08-22 18:05 81920] "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2002-07-22 19:34 135168] "84psjwcuuxz"="C:\WINDOWS\system32\84psjwcuuxz.exe" [2004-08-05 14:00 17408] "SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 20:08 94208] "ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 19:10 102400] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2005-09-23 23:05:26 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\kswhazex] dbnmpntwb.dll 2004-08-05 14:00 84992 C:\WINDOWS\system32\dbnmpntwb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= 3ivxVfWCodec.dll "VIDC.VP31"= vp31vfw.dll "msacm.l3fhg"= mp3fhg.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= "C:\Program Files\eMule\emule.exe"= "C:\WINDOWS\system32\dpvsetup.exe"= "C:\WINDOWS\system32\84psjwcuuxz.exe"= "C:\Program Files\Orange\Connectivity\ConnectivityManager.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10493:TCP"= 10493:TCP:@xpsp2res.dll,-22009 "80:TCP"= 80:TCP:@xpsp2res.dll,-22009 "62206:TCP"= 62206:TCP:@xpsp2res.dll,-22009 "53179:TCP"= 53179:TCP:@xpsp2res.dll,-22009 "47869:TCP"= 47869:TCP:@xpsp2res.dll,-22009 R0 ubqgamqy;ubqgamqy;C:\WINDOWS\system32\drivers\ubqgamqy.sys [2004-08-05 14:00] R2 BackWeb Client - 174112;Securitoo AntiVirus;C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE [2008-01-23 19:59] R2 F-Secure AVP;F-Secure AVP;C:\Program Files\F-Secure\Anti-Virus\fsavp.sys [2001-05-25 11:44] R2 F-Secure F-PROT;F-Secure F-PROT;C:\Program Files\F-Secure\Anti-Virus\fsfp.sys [2008-01-24 18:51] R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Common\FSfilter.sys [2001-06-28 04:05] R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Common\FSgk.sys [2001-06-28 04:05] R2 F-Secure Orion;F-Secure Orion;C:\Program Files\F-Secure\Anti-Virus\fsorion.sys [2008-01-24 18:51] R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Common\FSrec.sys [2001-06-28 04:05] R2 FSpm;F-Secure Policy Manager;C:\Program Files\F-Secure\Common\FSPM.SYS [2002-01-24 19:55] R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\F-Secure\fswsclds.exe [2008-01-24 18:52] R2 mpbcwszj;PCI Bus k91ae Support;C:\WINDOWS\System32\svchost.exe [2004-08-05 14:00] R3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-08 03:00] S1 kbd;kbd;C:\WINDOWS\system32\drivers\kbd.sys [] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs mpbcwszj [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\ \Shell\explore\Command - E:\RECYCLED\INFO.exe \Shell\open\Command - E:\RECYCLED\INFO.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e568e942-b240-11dc-8f6c-806d6172696f}] \Shell\AutoRun\command - D:\Setup.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-23 21:59:17 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-06-23 22:00:00 ComboFix-quarantined-files.txt 2008-06-23 19:59:48 Pre-Run: 27,672,322,048 octets libres Post-Run: 27,670,392,832 octets libres 162

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:02:04, on 23/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\84psjwcuuxz.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\systray\systrayapp.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

Primura · Answer

g d freeze assez regulierement et je ne peux plus cliquer sur rien .. alors je redemarre

sKe69 · Answer

Voilà pour la suite et fais exactement ce qui suit :

1-Crée un doc texte sur ton bureau : 
pointes ta souris sur ton bureau , click droit : vas dans "nouveau" et choisis "document texte" . 

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de crée : 

Registry::  
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e568e9­42-b240-11dc-8f6c-806d6172696f}] 


Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi : 
CFScript puis valides ...
 

2-Nettoyage :
!! Déconnectes toi,fermes toute tes application et désactive ton antivirus le temps de la manipe ( tu le réactiveras après )  !! 

--->Sur ton bureau, fais un glisser avec ta souris le fichier CFScript sur l'icone de ComboFix.exe . 

(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide. 

Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!) 

!! Ne touche à rien tant que le scan n'est pas terminé !! 

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire. 

Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )

Primura · Answer

J'ai suivi t instructions .. g glissé le fichier ds C-Fix et il c relancer comme tt a lheure il m'a demandé si jacceptaie les termes (oui/non) j'ai cliqué oui puis il c lancé pareil que la 1ere fois ... je n'ai pas u a cliquer sur 1 pour continuer...

Primura · Answer

tu veux que je post qd mm le rapport c-fix et le hijack this?

Primura · Answer

Je le ferais en rentrant cet aprem. Je serai chez moi vers 16h30 ;) là c back to work -_-'
Dsl de te prendre tt ce tps et merci encore pour ton aide
A tte

Primura · Answer

ComboFix 08-06-20.4 - Sébastien 2008-06-23 22:41:45.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1635 [GMT 2:00] Endroit: C:\Documents and Settings\Sébastien\Bureau\C-Fix.exe Command switches used :: C:\Documents and Settings\Sébastien\Bureau\CFScript.txt * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . ((((((((((((((((((((((((((((( Fichiers créés 2008-05-23 to 2008-06-23 )))))))))))))))))))))))))))))))))))) . 2008-06-23 20:43 . 2008-06-23 20:43 d-------- C:\Documents and Settings\Sébastien\Application Data\Malwarebytes 2008-06-23 20:42 . 2008-06-23 20:42 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-23 20:42 . 2008-06-23 20:42 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-23 20:42 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-23 20:42 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-23 20:08 . 2008-06-23 20:08 d-------- C:\Program Files\CCleaner 2008-06-23 19:08 . 2008-06-23 19:08 d-------- C:\WINDOWS\ERUNT 2008-06-23 19:05 . 2008-06-23 19:15 d-------- C:\SDFix 2008-06-23 18:13 . 2008-06-23 18:14 d-------- C:\Program Files\RogueRemover FREE 2008-06-23 17:35 . 2008-06-23 17:35 d-------- C:\Program Files\Trend Micro 2008-06-22 11:47 . 2004-08-05 14:00 4,224 --a------ C:\WINDOWS\system32\beep.sys 2008-06-11 22:16 . 2008-06-11 22:16 d-------- C:\Program Files\Windows Media Connect 2 2008-06-11 22:15 . 2008-06-11 22:15 d-------- C:\WINDOWS\system32\LogFiles 2008-06-11 22:15 . 2008-06-11 22:16 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-06-02 01:27 . 2008-06-02 01:27 d-------- C:\Documents and Settings\Sébastien\Application Data\vlc 2008-05-31 03:17 . 2008-06-09 00:59 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-31 03:17 . 2008-05-31 03:17 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-28 19:11 . 2008-05-28 19:11 d--h----- C:\WINDOWS\PIF . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-10 16:52 --------- d-----w C:\Program Files\eMule 2008-06-04 16:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-06-03 21:56 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\Lavasoft 2008-05-20 19:20 --------- d-----w C:\Documents and Settings\Sébastien\Application Data eamspeak2 2008-05-17 18:02 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\dbzikwch 2008-05-17 09:50 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\Skype 2008-05-17 09:43 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\skypePM 2008-05-16 18:17 --------- d-----w C:\Program Files\Fichiers communs\Mozilla Shared 2008-05-16 18:17 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\dbzikwch 2008-05-12 16:52 --------- d-----w C:\Program Files\Windows Live 2008-05-12 16:52 --------- d-----w C:\Program Files\MSN Messenger 2008-05-12 16:52 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-05-11 20:40 --------- d-----w C:\Program Files\Skype 2008-05-11 20:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-05-11 20:39 --------- d-----w C:\Program Files\Fichiers communs\Skype 2008-05-04 01:39 5,632 ----a-w C:\WINDOWS\system32\drivers\StarOpen.sys 2008-04-27 19:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-27 12:00 2,770 ----a-w C:\WINDOWS\system32 mp.reg 2008-04-26 19:04 --------- d-----w C:\Program Files\Orange 2008-04-26 19:03 --------- d-----w C:\Program Files\Fichiers communs\France Telecom 2008-04-26 18:32 --------- d-----w C:\Program Files\SAGEM 2008-04-26 18:32 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\InstallShield 2008-04-26 17:05 --------- d-----w C:\Program Files\Wanadoo 2008-04-25 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-24 06:10 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe 2008-04-23 20:14 82,944 ----a-w C:\WINDOWS\system32\IEDFix.exe 2008-04-23 20:14 82,944 ----a-w C:\WINDOWS\system32\404Fix.exe 2008-04-23 18:28 20,608 ----a-w C:\WINDOWS\system32\drivers\zmpyoyvx.dat 2008-04-23 18:28 196,608 ----a-w C:\WINDOWS\system32\libssl32.dll 2008-04-23 18:28 1,015,808 ----a-w C:\WINDOWS\system32\libeay32.dll . ((((((((((((((((((((((((((((( snapshot@2008-06-23_21.59.43,29 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-23 19:54:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-23 20:38:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B56F637C-8AF9-43FA-A31B-935F967A00CC}] 2004-08-05 14:00 88064 --a------ C:\WINDOWS\system32\comdlg32e.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FA566E27-2B42-422B-9370-B1157205F1E1}] 2004-08-05 14:00 84992 --a------ c:\windows\system32\dbnmpntwb.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "84psjwcuuxz"="C:\WINDOWS\system32\84psjwcuuxz.exe" [2004-08-05 14:00 17408] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-03 00:27 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-09 09:36 8527872] "nwiz"="nwiz.exe" [2007-10-09 09:36 1626112 C:\WINDOWS\system32 wiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-09 09:36 81920] "DAEMON Tools-1033"="E:\daemon.exe" [2004-08-22 18:05 81920] "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2002-07-22 19:34 135168] "84psjwcuuxz"="C:\WINDOWS\system32\84psjwcuuxz.exe" [2004-08-05 14:00 17408] "SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 20:08 94208] "ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 19:10 102400] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2005-09-23 23:05:26 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\kswhazex] dbnmpntwb.dll 2004-08-05 14:00 84992 C:\WINDOWS\system32\dbnmpntwb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= 3ivxVfWCodec.dll "VIDC.VP31"= vp31vfw.dll "msacm.l3fhg"= mp3fhg.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= "C:\Program Files\eMule\emule.exe"= "C:\WINDOWS\system32\dpvsetup.exe"= "C:\WINDOWS\system32\84psjwcuuxz.exe"= "C:\Program Files\Orange\Connectivity\ConnectivityManager.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10493:TCP"= 10493:TCP:@xpsp2res.dll,-22009 "80:TCP"= 80:TCP:@xpsp2res.dll,-22009 "62206:TCP"= 62206:TCP:@xpsp2res.dll,-22009 "53179:TCP"= 53179:TCP:@xpsp2res.dll,-22009 "47869:TCP"= 47869:TCP:@xpsp2res.dll,-22009 R0 ubqgamqy;ubqgamqy;C:\WINDOWS\system32\drivers\ubqgamqy.sys [2004-08-05 14:00] R2 BackWeb Client - 174112;Securitoo AntiVirus;C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE [2008-01-23 19:59] R2 F-Secure AVP;F-Secure AVP;C:\Program Files\F-Secure\Anti-Virus\fsavp.sys [2001-05-25 11:44] R2 F-Secure F-PROT;F-Secure F-PROT;C:\Program Files\F-Secure\Anti-Virus\fsfp.sys [2008-01-24 18:51] R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Common\FSfilter.sys [2001-06-28 04:05] R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Common\FSgk.sys [2001-06-28 04:05] R2 F-Secure Orion;F-Secure Orion;C:\Program Files\F-Secure\Anti-Virus\fsorion.sys [2008-01-24 18:51] R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Common\FSrec.sys [2001-06-28 04:05] R2 FSpm;F-Secure Policy Manager;C:\Program Files\F-Secure\Common\FSPM.SYS [2002-01-24 19:55] R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\F-Secure\fswsclds.exe [2008-01-24 18:52] R2 mpbcwszj;PCI Bus k91ae Support;C:\WINDOWS\System32\svchost.exe [2004-08-05 14:00] R3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-08 03:00] S1 kbd;kbd;C:\WINDOWS\system32\drivers\kbd.sys [] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs mpbcwszj [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\ \Shell\explore\Command - E:\RECYCLED\INFO.exe \Shell\open\Command - E:\RECYCLED\INFO.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e568e942-b240-11dc-8f6c-806d6172696f}] \Shell\AutoRun\command - D:\Setup.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-23 22:42:42 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-06-23 22:43:27 ComboFix-quarantined-files.txt 2008-06-23 20:43:14 ComboFix2.txt 2008-06-23 20:35:52 ComboFix3.txt 2008-06-23 20:00:01 Pre-Run: 27,643,109,376 octets libres Post-Run: 27,670,441,984 octets libres 154

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:36:56, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32\84psjwcuuxz.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [84psjwcuuxz] C:\WINDOWS\system32\84psjwcuuxz.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

Bien ... il ya pas mal de chose qui m'intrigue sur ton rapport hijack ...

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\84psjwcuuxz.exe 
Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse. 

(Si VirusTotal indique que le fichier a déjà été analysé, clique sur le bouton Ré-analyse le fichier maintenant ).


--->Et recommence pour ces deux autres fichier :
C:\WINDOWS\SYSTEM32\dbnmpntwb.dll 
C:\WINDOWS\system32\comdlg32e.dll 

Postes moi donc les 3 rapports pour vérifier ...

Primura · Answer

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.6.24.0 2008.06.24 - 
AntiVir 7.8.0.59 2008.06.24 TR/Crypt.Morphine.Gen 
Authentium 5.1.0.4 2008.06.24 W32/Heuristic-159!Eldorado 
Avast 4.8.1195.0 2008.06.23 - 
AVG 7.5.0.516 2008.06.24 Packed.Morphine.C 
BitDefender 7.2 2008.06.24 - 
CAT-QuickHeal 9.50 2008.06.23 (Suspicious) - DNAScan 
ClamAV 0.93.1 2008.06.24 - 
DrWeb 4.44.0.09170 2008.06.24 - 
eSafe 7.0.17.0 2008.06.24 Suspicious File 
eTrust-Vet 31.6.5900 2008.06.24 - 
Ewido 4.0 2008.06.24 - 
F-Prot 4.4.4.56 2008.06.23 W32/Heuristic-159!Eldorado 
F-Secure 7.60.13501.0 2008.06.24 Suspicious:W32/Malware!Gemini 
Fortinet 3.14.0.0 2008.06.24 - 
GData 2.0.7306.1023 2008.06.24 - 
Ikarus T3.1.1.26.0 2008.06.24 Trojan.Crypt.Morphine 
Kaspersky 7.0.0.125 2008.06.24 Heur.Trojan.Generic 
McAfee 5323 2008.06.23 New Malware.bl 
Microsoft 1.3604 2008.06.24 VirTool:Win32/Obfuscator.Q 
NOD32v2 3213 2008.06.24 a variant of Win32/Small.BB 
Norman 5.80.02 2008.06.24 - 
Panda 9.0.0.4 2008.06.23 Suspicious file 
Prevx1 V2 2008.06.24 - 
Rising 20.50.10.00 2008.06.24 - 
Sophos 4.30.0 2008.06.24 Mal/EncPk-CL 
Sunbelt 3.0.1153.1 2008.06.15 - 
Symantec 10 2008.06.24 Trojan Horse 
TheHacker 6.2.92.359 2008.06.24 - 
TrendMicro 8.700.0.1004 2008.06.24 Cryp_Morphine 
VBA32 3.12.6.8 2008.06.23 - 
VirusBuster 4.5.11.0 2008.06.23 - 
Webwasher-Gateway 6.6.2 2008.06.24 Win32.Malware.gen!88 
Information additionnelle 
File size: 17408 bytes 
MD5...: b80f8b842a28a57036b7bbc190915b44 
SHA1..: 5a90d32fc16c05a35fba290a01db347bce3c9368 
SHA256: 4e95273db2ee9fc6ff2157d10e3ed700a5c6043a8ab5819e4b818db293411d0f 
SHA512: b5ca69001894415a94a9c2a20e2745cf83bf2981c5ad22385f2352cfb442fcac
b767a0c0edc283895d47314f1e0bcf964de8a141831291b785f03e2e37234736 
PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x512864
timedatestamp.....: 0x36a1ec48 (Sun Jan 17 13:57:28 1999)
machinetype.......: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x7000 0x3e00 7.83 3a956159b40c9b5ecc93b7f5a54d3c83
.idata 0x8000 0x1000 0x200 1.34 d6ff1ac067d1010328dc15981ca9605c

( 1 imports ) 
> KERNEL32.dll: LoadLibraryExA, GetProcAddress, LeaveCriticalSection

( 0 exports ) 
 
packers (F-Prot): UPX 
packers (Authentium): UPX

Primura · Answer

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.6.24.0 2008.06.24 - 
AntiVir 7.8.0.59 2008.06.24 - 
Authentium 5.1.0.4 2008.06.24 - 
Avast 4.8.1195.0 2008.06.23 - 
AVG 7.5.0.516 2008.06.24 - 
BitDefender 7.2 2008.06.24 - 
CAT-QuickHeal 9.50 2008.06.23 - 
ClamAV 0.93.1 2008.06.24 - 
DrWeb 4.44.0.09170 2008.06.24 - 
eSafe 7.0.17.0 2008.06.24 Suspicious File 
eTrust-Vet 31.6.5900 2008.06.24 - 
Ewido 4.0 2008.06.24 - 
F-Prot 4.4.4.56 2008.06.23 - 
F-Secure 7.60.13501.0 2008.06.24 - 
Fortinet 3.14.0.0 2008.06.24 - 
GData 2.0.7306.1023 2008.06.24 - 
Ikarus T3.1.1.26.0 2008.06.24 - 
Kaspersky 7.0.0.125 2008.06.24 - 
McAfee 5323 2008.06.23 - 
Microsoft 1.3604 2008.06.24 - 
NOD32v2 3213 2008.06.24 - 
Norman 5.80.02 2008.06.24 - 
Panda 9.0.0.4 2008.06.23 - 
Prevx1 V2 2008.06.24 - 
Rising 20.50.10.00 2008.06.24 Packer.Win32.Morphine.b 
Sophos 4.30.0 2008.06.24 - 
Sunbelt 3.0.1153.1 2008.06.15 - 
Symantec 10 2008.06.24 - 
TheHacker 6.2.92.359 2008.06.24 - 
TrendMicro 8.700.0.1004 2008.06.24 - 
VBA32 3.12.6.8 2008.06.23 - 
VirusBuster 4.5.11.0 2008.06.23 - 
Webwasher-Gateway 6.6.2 2008.06.24 Win32.Malware.gen 
Information additionnelle 
File size: 84992 bytes 
MD5...: b81b18c28a3eb0e98c6274cc36a07b19 
SHA1..: b6e2131445836cf958178e6b8599bcb6c0473a09 
SHA256: 237c0ab71ae30701c7a3860c9e15601eb7b13c43c153aa6c333b9bbb07f78199 
SHA512: 94096c66fed3ce26e8b1a589a01a9ce73944464b21ad44b4059c3109efd7402f
38653fdeaf5043c3267a73909b09be34275cde77eecef0051fe11dc379744f0e 
PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x542a89
timedatestamp.....: 0x201c9cc5 (Tue Jan 27 11:40:53 1987)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x33000 0x13e00 7.99 359a4af6667107622235ab4ba9e38d27
.idata 0x34000 0x1b4 0x200 3.71 e9241a9e23d9cb235d9077de8c88bfed
.edata 0x35000 0xe0 0x200 2.58 38cd6f9caf480399fab006c052810b89
.rsrc 0x36000 0x600 0x600 2.48 9bcb7466027d39d67189cce183165904

( 4 imports ) 
> KERNEL32.dll: GetCalendarInfoA, SetConsoleCP, GetProcAddress, VerifyVersionInfoW, LoadLibraryExA, SwitchToFiber, GetConsoleAliasA
> advapi32.dll: FreeSid
> oleaut32.dll: SysFreeString
> user32.dll: wvsprintfA

( 7 exports ) 
DllCanUnloadNow, DllGetClassObject, Olcgbol, DllMain, DllRegisterServer, DllUnregisterServer, ServiceMain

Primura · Answer

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.6.24.0 2008.06.24 Win-Trojan/Podnuha.88064.R 
AntiVir 7.8.0.59 2008.06.24 RKit/Podnuha.CB 
Authentium 5.1.0.4 2008.06.24 - 
Avast 4.8.1195.0 2008.06.23 Win32:Rootkit-gen 
AVG 7.5.0.516 2008.06.24 Downloader.Delf.12.AN 
BitDefender 7.2 2008.06.24 - 
CAT-QuickHeal 9.50 2008.06.23 Rootkit.Podnuha.cb 
ClamAV 0.93.1 2008.06.24 Trojan.Rootkit-950 
DrWeb 4.44.0.09170 2008.06.24 Trojan.DownLoader.56883 
eSafe 7.0.17.0 2008.06.24 Suspicious File 
eTrust-Vet 31.6.5900 2008.06.24 Win32/Kvol!generic 
Ewido 4.0 2008.06.24 Rootkit.Podnuha.cb 
F-Prot 4.4.4.56 2008.06.23 - 
F-Secure 7.60.13501.0 2008.06.24 Rootkit.Win32.Podnuha.cb 
Fortinet 3.14.0.0 2008.06.24 W32/Podnuha.CB!tr.rkit 
GData 2.0.7306.1023 2008.06.24 Rootkit.Win32.Podnuha.cb 
Ikarus T3.1.1.26.0 2008.06.24 Virus.Trojan.Win32.Pakes.cdw 
Kaspersky 7.0.0.125 2008.06.24 Rootkit.Win32.Podnuha.cb 
McAfee 5323 2008.06.23 Boaxxe.dll 
Microsoft 1.3604 2008.06.24 Trojan:Win32/Boaxxe.B 
NOD32v2 3213 2008.06.24 a variant of Win32/Agent.NSG 
Norman 5.80.02 2008.06.24 W32/Rootkit.EQF 
Panda 9.0.0.4 2008.06.23 Adware/GoodSearchNow 
Prevx1 V2 2008.06.24 Malware Downloader 
Rising 20.50.10.00 2008.06.24 Trojan.Clicker.Win32.Delf.mm 
Sophos 4.30.0 2008.06.24 - 
Sunbelt 3.0.1153.1 2008.06.15 Constructor.Podnuha.CB 
Symantec 10 2008.06.24 Trojan Horse 
TheHacker 6.2.92.359 2008.06.24 Trojan/Podnuha.cb 
TrendMicro 8.700.0.1004 2008.06.24 TROJ_BOAXXE.AB 
VBA32 3.12.6.8 2008.06.23 Rootkit.Win32.Podnuha.cb 
VirusBuster 4.5.11.0 2008.06.23 Rootkit.Podnuha.Gen.2 
Webwasher-Gateway 6.6.2 2008.06.24 - 
Information additionnelle 
File size: 88064 bytes 
MD5...: aca57db147b631c7c307b7592aab4a9e 
SHA1..: 6fb7e8cc1016c172c8e9a3f168d6f4bfc9628c77 
SHA256: c633f0a24c44a47accef232a1dc77105c8c58fdc87a0a56966aab1213ebca884 
SHA512: 72428c8bbefaa2029c110cb66124eea64f7bbb0004e74e0ecbcee6645129c050
810b688063d57d8e643bbff7acb3c9e8ffdbbb8b436ae8164c06de527937057b 
PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x43a800
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x25000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x26000 0x15000 0x14a00 7.90 d69c1098e2015afd82b5cbd2f15d1e6b
.rsrc 0x3b000 0x1000 0xa00 3.54 f9c0ba2ef28b9c9dfe01dd56280b30f0

( 7 imports ) 
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree
> advapi32.dll: RegCloseKey
> ole32.dll: IsEqualGUID
> oleaut32.dll: VariantCopy
> shell32.dll: SHGetMalloc
> user32.dll: SetTimer
> wininet.dll: InternetCrackUrlA

( 4 exports ) 
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
 
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=4EE7FDD4003418FB584701D769F67F000FD2F7E7 
packers (Kaspersky): PE_Patch.UPX, UPX 
packers (F-Prot): UPX 
packers (Avast): UPX

Primura · Answer

g d gros pb de freeze et d'internet explorer qui rencontre d erreurs ... je suis en sans echec avec reseau jespere que ca pose pas de pb sinon je pouvais pas faire les analyses

Primura · Answer

ComboFix 08-06-20.4 - Sébastien 2008-06-24 17:47:33.4 - NTFSx86 MINIMAL Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1810 [GMT 2:00] Endroit: C:\Documents and Settings\Sébastien\Bureau\C-Fix.exe Command switches used :: C:\Documents and Settings\Sébastien\Bureau\CFScript.txt [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: C:\WINDOWS\system32\84psjwcuuxz.exe C:\WINDOWS\system32\comdlg32e.dll C:\windows\system32\dbnmpntwb.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\84psjwcuuxz.exe C:\WINDOWS\system32\comdlg32e.dll . . . . Echec de suppression C:\windows\system32\dbnmpntwb.dll . . . . Echec de suppression . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_mpbcwszj -------\Service_mpbcwszj ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-24 to 2008-06-24 )))))))))))))))))))))))))))))))))))) . 2008-06-24 17:25 . 2008-06-24 17:25 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-06-24 17:25 . 2008-06-24 17:25 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-06-23 20:42 . 2008-06-23 20:42 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-23 20:42 . 2008-06-23 20:42 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-23 20:42 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-23 20:42 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-23 20:08 . 2008-06-23 20:08 d-------- C:\Program Files\CCleaner 2008-06-23 19:08 . 2008-06-23 19:08 d-------- C:\WINDOWS\ERUNT 2008-06-23 19:05 . 2008-06-23 19:15 d-------- C:\SDFix 2008-06-23 18:13 . 2008-06-23 18:14 d-------- C:\Program Files\RogueRemover FREE 2008-06-23 17:35 . 2008-06-23 17:35 d-------- C:\Program Files\Trend Micro 2008-06-22 11:47 . 2004-08-05 14:00 4,224 --a------ C:\WINDOWS\system32\beep.sys 2008-06-11 22:16 . 2008-06-11 22:16 d-------- C:\Program Files\Windows Media Connect 2 2008-06-11 22:15 . 2008-06-11 22:15 d-------- C:\WINDOWS\system32\LogFiles 2008-06-11 22:15 . 2008-06-11 22:16 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-05-31 03:17 . 2008-06-09 00:59 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-31 03:17 . 2008-05-31 03:17 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-28 19:11 . 2008-05-28 19:11 d--h----- C:\WINDOWS\PIF . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-10 16:52 --------- d-----w C:\Program Files\eMule 2008-06-04 16:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-05-16 18:17 --------- d-----w C:\Program Files\Fichiers communs\Mozilla Shared 2008-05-16 18:17 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\dbzikwch 2008-05-12 16:52 --------- d-----w C:\Program Files\Windows Live 2008-05-12 16:52 --------- d-----w C:\Program Files\MSN Messenger 2008-05-12 16:52 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-05-11 20:40 --------- d-----w C:\Program Files\Skype 2008-05-11 20:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-05-11 20:39 --------- d-----w C:\Program Files\Fichiers communs\Skype 2008-05-04 01:39 5,632 ----a-w C:\WINDOWS\system32\drivers\StarOpen.sys 2008-04-27 19:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-27 12:00 2,770 ----a-w C:\WINDOWS\system32\tmp.reg 2008-04-26 19:04 --------- d-----w C:\Program Files\Orange 2008-04-26 19:03 --------- d-----w C:\Program Files\Fichiers communs\France Telecom 2008-04-26 18:32 --------- d-----w C:\Program Files\SAGEM 2008-04-26 17:05 --------- d-----w C:\Program Files\Wanadoo 2008-04-25 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-24 06:10 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe 2008-04-23 20:14 82,944 ----a-w C:\WINDOWS\system32\IEDFix.exe 2008-04-23 20:14 82,944 ----a-w C:\WINDOWS\system32\404Fix.exe 2008-04-23 18:28 196,608 ----a-w C:\WINDOWS\system32\libssl32.dll 2008-04-23 18:28 1,015,808 ----a-w C:\WINDOWS\system32\libeay32.dll . ((((((((((((((((((((((((((((( snapshot@2008-06-23_21.59.43,29 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-23 19:54:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-24 15:49:15 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B56F637C-8AF9-43FA-A31B-935F967A00CC}] 2004-08-05 14:00 88064 --a------ C:\WINDOWS\system32\comdlg32e.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FA566E27-2B42-422B-9370-B1157205F1E1}] 2004-08-05 14:00 84992 --a------ c:\windows\system32\dbnmpntwb.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-03 00:27 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-09 09:36 8527872] "nwiz"="nwiz.exe" [2007-10-09 09:36 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-09 09:36 81920] "DAEMON Tools-1033"="E:\daemon.exe" [2004-08-22 18:05 81920] "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2002-07-22 19:34 135168] "SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 20:08 94208] "ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 19:10 102400] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\kswhazex] dbnmpntwb.dll 2004-08-05 14:00 84992 C:\WINDOWS\system32\dbnmpntwb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= 3ivxVfWCodec.dll "VIDC.VP31"= vp31vfw.dll "msacm.l3fhg"= mp3fhg.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= "C:\Program Files\eMule\emule.exe"= "C:\WINDOWS\system32\dpvsetup.exe"= "C:\Program Files\Orange\Connectivity\ConnectivityManager.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10493:TCP"= 10493:TCP:@xpsp2res.dll,-22009 "80:TCP"= 80:TCP:@xpsp2res.dll,-22009 "62206:TCP"= 62206:TCP:@xpsp2res.dll,-22009 "53179:TCP"= 53179:TCP:@xpsp2res.dll,-22009 "47869:TCP"= 47869:TCP:@xpsp2res.dll,-22009 R0 ubqgamqy;ubqgamqy;C:\WINDOWS\system32\drivers\ubqgamqy.sys [2004-08-05 14:00] R2 BackWeb Client - 174112;Securitoo AntiVirus;C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE [2008-01-23 19:59] R2 F-Secure AVP;F-Secure AVP;C:\Program Files\F-Secure\Anti-Virus\fsavp.sys [2001-05-25 11:44] R2 F-Secure F-PROT;F-Secure F-PROT;C:\Program Files\F-Secure\Anti-Virus\fsfp.sys [2008-01-24 18:51] R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Common\FSfilter.sys [2001-06-28 04:05] R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Common\FSgk.sys [2001-06-28 04:05] R2 F-Secure Orion;F-Secure Orion;C:\Program Files\F-Secure\Anti-Virus\fsorion.sys [2008-01-24 18:51] R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Common\FSrec.sys [2001-06-28 04:05] R2 FSpm;F-Secure Policy Manager;C:\Program Files\F-Secure\Common\FSPM.SYS [2002-01-24 19:55] R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\F-Secure\fswsclds.exe [2008-01-24 18:52] R3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-08 03:00] S1 kbd;kbd;C:\WINDOWS\system32\drivers\kbd.sys [] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs mpbcwszj [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e568e942-b240-11dc-8f6c-806d6172696f}] \Shell\AutoRun\command - D:\Setup.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-24 17:49:46 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\F-Secure\Common\FSMA32.exe C:\Program Files\F-Secure\Common\FSMB32.exe C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\[u]0[/u]\FTRTSVC.exe C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\F-Secure\Common\fch32.exe C:\Program Files\F-Secure\Common\FAMEH32.exe C:\Program Files\F-Secure\Common\fsgk32.exe C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Orange\Launcher\Launcher.exe C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\[u]0[/u]\AlertModule.exe C:\Program Files\Orange\Deskboard\Deskboard.exe C:\Program Files\Orange\Connectivity\ConnectivityManager.exe C:\Program Files\Orange\Connectivity\corecom\CoreCom.exe C:\Program Files\Orange\Connectivity\corecom\OraConfigRecover.exe C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\[u]0[/u]\FTCOMModule.exe . ************************************************************************** . Temps d'accomplissement: 2008-06-24 17:51:23 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-24 15:51:19 ComboFix2.txt 2008-06-23 20:43:28 ComboFix3.txt 2008-06-23 20:35:52 ComboFix4.txt 2008-06-23 20:00:01 Pre-Run: 27,569,487,872 octets libres Post-Run: 27,613,659,136 octets libres 178

sKe69 · Answer

Cela n'a pas totalement marcher ... Peux tu me repposter un nouvel hijack pour voire ...

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:02:46, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

Maintenant essayes cela pour voire :

Téléchargez ceci (de gchris) : http://gchrisftp.free.fr/divers/Ad-Fix/Ad-Fix.zip 

Dézippez-le sur votre bureau (clic droit -> extraire tout). 

Important : vérifiez que vous êtes bien connecté à internet.
 
Dans le dossier créé, double-cliquez sur le fichier "Ad-Fix.bat" ou "Ad-fix" 
Choisissez l'option 1. 

Si vous avez un message de votre pare-feu qui vous demande si vous voulez autoriser le fichier URL2FILE.EXE à 
se connecter à Internet ---> autorisez, c'est nécessaire à ad-fix pour vérifier la version.
 
Quand c'est finit (cela peut prendre plusieurs minutes), un rapport s'ouvre avec le bloc-notes. 
Merci de faire un copier/coller ici du contenu du rapport (Ad-Fix.txt) .

Primura · Answer

Ad-Fix v0.101e
         by gchris
 
 
OPTION 1 (Scan) :
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                  Démarré à : 

18:09:03,93 24/06/2008  


                  Executé depuis : 

C:\Documents and Settings\S‚bastien\Bureau\Ad-Fix


                  Os : 

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
            Recherche de fichier manquant
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
           Recherche de fichiers cachés (pas forcément mauvais)
 
 
    Fichiers cachés à la racine du disque système :
 
boot.ini
Bootfont.bin
IO.SYS
MSDOS.SYS
NTDETECT.COM
ntldr
pagefile.sys
sqmdata00.sqm
sqmnoopt00.sqm
 
    Fichiers cachés dans le répertoire Windows :
 
QTFont.qfn
WindowsShell.Manifest
winnt.bmp
winnt256.bmp
 
    Fichiers cachés dans le répertoire System32 :
 
cdplayer.exe.manifest
ezsidmv.dat
logonui.exe.manifest
ncpa.cpl.manifest
nwc.cpl.manifest
sapi.cpl.manifest
WindowsLogon.manifest
wuaucpl.cpl.manifest
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
           Analyse du registre
 

---------- USER AGENT -- POST PLATFORM

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

----------

----------  AppInit_DLLs

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

----------
 
 
   Complete!
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
           Recherche de fichiers et dossiers
 
 
 
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Terminé à 18:11:06,90

sKe69 · Answer

pas grand chose ... :-/

Nettoyage Ad-fix :
Démarrer en mode sans échec : 
Comment aller en Mode sans échec 
1) Redémarres ton ordi 
2) Tapotes la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreur ...) 

--->Lancez de nouveau Ad-fix 

Choisissez l'option 2 
(Le bureau ou les icônes vont disparaître, c'est normal.) 
Quand c'est terminé, pressez la touche "entrée" pour redémarrer l'ordinateur. 

Copiez collez ici, le contenu du nouveau rapport générer (le sauvegarder de façon à le retrouver), accompagné d'un nouveau rapport hijackthis ( celui-ci fais en mode normal ) pour analyse ...

Primura · Answer

Ad-Fix v0.101e
         by gchris
 
 
OPTION 2 (Fix) :
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                  Démarré à : 

18:30:26,46 24/06/2008  
en mode sans échec


                  Executé depuis : 

C:\Documents and Settings\S‚bastien\Bureau\Ad-Fix


                  Os : 

Microsoft Windows XP [version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
            Recherche de fichier manquant
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
             Nettoyage du registre
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
             Suppression des fichiers
 
 
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Terminé à 18:32:43,09 


Redémarrage effectué

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:36:40, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

Mets Malwaresbytes à jour , et relances un scan complet en mode sans échec ,

--->une fois le scan terminé , click sur "résultat" : puis vérifies que tous les ojbets infectés soient validés, puis click sur " supression " .

Redémarres ton PC ( mode normal ). 

Postes le rapport sauvegardé après la supression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes) accompagné d'un nouvel hijackthis ( fait en mode normal ) ...

Primura · Answer

Malwarebytes' Anti-Malware 1.18
Version de la base de données: 883

21:08:00 23/06/2008
mbam-log-6-23-2008 (21-08-00).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 85144
Temps écoulé: 12 minute(s), 25 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 18

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\baseukd32.dll (Trojan.Downloader) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SMshc7tuj0egbr (Rogue.MalwareProtector) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\mssadv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mssadv.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\system32\AppCert (Trojan.Downloader) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\shc7tuj0egbr\shc7tuj0egbr.exe (Rogue.MalwareProtector) -> Quarantined and deleted successfully.
C:\svchost.MSNFix (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\shc7tuj0egbr\shc7tuj0egbrSkin.dll (Rogue.MalwareProtector) -> Quarantined and deleted successfully.
C:\WINDOWS\services.MSNFix (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\comdlg32e.dll (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\system32\AppCert\wnl32.dll (Spyware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\filter.drv (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\hb20g.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\hb21g.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\hb22g.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\options.dat (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clbdll.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\clbdriver.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\baseukd32.dll (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\Sébastien\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sébastien\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sébastien\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sébastien\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:21:51, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - C:\WINDOWS\SYSTEM32\dbnmpntwb.dll
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

on vas utiliser un autre Anti-virus :

1-Télécharges AntiVir ici :
https://www.pcastuces.com/logitheque/antivir.htm
ou
https://www.avira.com/

Anti-virus gratuit ( en anglais ) 

2-Désactives complètement F-Secure ( on le réactiveras plus tard ) et veielle à ce qu'il le reste ...

3-Installes AntiVir et mets le à jour .

Aide AntiVir : https://www.malekal.com/avira-free-security-antivirus-gratuit/

puis fais ce petit réglage :
*******************************
une fois antivir ouvert click sur configuration et coche la case "expert mode" .
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High 
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir. 
puis sur la droite coche les case suivantes : 
scan boot sectors of selected drives 
scan master boot sectors 
scan memory 
search foe rootkit before scan 
decoche : 
ignore off line files 
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level 
*********************************

Redémarres en mode sans échec et lances un scan complet de ton PC : met tout ce qu'il peut trouver en quarantaine .
---> retournes en mode normal et poste moi le rapport d'AntiVir accompagné d'un nouvel hijackthis pour analyse ...

Primura · Answer

il a parlé de trojan sur ce fichier "comdlg32e.dll " mais je pouvais pas le mettre en quarantaine ... je suis en cours de scannage la

Primura · Answer

Avira AntiVir Personal
Report file date: mardi 24 juin 2008  20:30

Scanning for 1165085 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Save mode with network
Username:         Sébastien
Computer name:    ADMIN

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.3.62       337408 Bytes  21/03/2008 19:12:34
ANTIVIR3.VDF  : 7.0.3.68        57856 Bytes  25/03/2008 08:27:50
Engineversion : 8.1.0.28  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.19       229754 Bytes  07/04/2008 15:34:44
AESCN.DLL     : 8.1.0.12       115060 Bytes  07/04/2008 15:34:44
AERDL.DLL     : 8.1.0.19       418164 Bytes  07/04/2008 15:34:44
AEPACK.DLL    : 8.1.1.0        364918 Bytes  18/03/2008 11:20:42
AEOFFICE.DLL  : 8.1.0.15       192889 Bytes  07/04/2008 15:34:44
AEHEUR.DLL    : 8.1.0.15      1147253 Bytes  07/04/2008 15:34:44
AEHELP.DLL    : 8.1.0.11       115061 Bytes  07/04/2008 15:34:43
AEGEN.DLL     : 8.1.0.15       299379 Bytes  07/04/2008 15:34:43
AEEMU.DLL     : 8.1.0.5        430450 Bytes  07/04/2008 15:34:43
AECORE.DLL    : 8.1.0.25       168309 Bytes  08/04/2008 09:58:32
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: mardi 24 juin 2008  20:30

Starting search for hidden objects.
The driver could not be initialized.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
14 processes with 14 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!
Master boot sector HD1
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!
Boot sector 'E:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '32' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\Autorun.MSNFix
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.2
      [NOTE]      The file was moved to '48d53dc4.qua'!
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\Sébastien\Bureau\Upload_Me.zip
  [0] Archive type: ZIP
  --> DOCUME~1/SBASTI~1/Bureau/Upload_Me/svchost.exe
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
    --> DOCUME~1/SBASTI~1/Bureau/Upload_Me/svchost2.exe
          [DETECTION] Contains suspicious code HEUR/Malware
    --> DOCUME~1/SBASTI~1/Bureau/Upload_Me/System.exe
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '48cd3dd8.qua'!
C:\Documents and Settings\Sébastien\Bureau\MSNFix\23062008_18460012.zip
  [0] Archive type: ZIP
  --> backup/Autorun.inf
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.2
  --> backup/svchost.exe
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
    --> backup/System.exe
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '48913d9b.qua'!
C:\QooBox\Quarantine\catchme2008-06-23_215907,40.zip
  [0] Archive type: ZIP
    --> WINAX55.sys
      [1] Archive type: RSRC
      --> Object
          [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was moved to '48d53ead.qua'!
C:\QooBox\Quarantine\catchme2008-06-24_174827,65.zip
  [0] Archive type: ZIP
    --> comdlg32e.dll
          [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was moved to '49b3f71e.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\84psjwcuuxz.exe.vir
      [DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
      [NOTE]      The file was moved to '48d13e80.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\lphc1tuj0egbr.exe.vir
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was moved to '48c93ebc.qua'!
C:\QooBox\Quarantine\E\Autorun.inf.vir
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.2
      [NOTE]      The file was moved to '48d53ec1.qua'!
C:\Recycled\INFO.EXE
  [0] Archive type: RSRC
  --> Object
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '48a73e9a.qua'!
C:\SDFix\backups\backups.zip
  [0] Archive type: ZIP
  --> backups/msavsc.0xe
      [DETECTION] Is the Trojan horse TR/Agent.dfv
  --> backups/msctrl.0xe
      [DETECTION] Is the Trojan horse TR/Agent.dfv
  --> backups/mssadv.dll
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
  --> backups/mssadv.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
    --> backups/svchost2.exe
          [DETECTION] Contains suspicious code HEUR/Malware
      [NOTE]      The file was moved to '48c43eae.qua'!
C:\WINDOWS\System.MSNFix
  [0] Archive type: RSRC
  --> Object
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '48d43ec8.qua'!
C:\WINDOWS\Config\Svchost.MSNFix
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '48c43ec8.qua'!
C:\WINDOWS\Config\System.exe
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '48d43ecb.qua'!
C:\WINDOWS\system32\comdlg32e.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 26003
      [WARNING]   
Begin scan in 'E:\' <Nouveau nom>
E:\Recycled\INFO.EXE
  [0] Archive type: RSRC
  --> Object
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '48a740a1.qua'!


End of the scan: mardi 24 juin 2008  20:43
Used time: 13:26 min

The scan has been done completely.

   4288 Scanning directories
 176037 Files were scanned
     20 viruses and/or unwanted programs were found
      3 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     14 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 176017 Files not concerned
   1058 Archives were scanned
      2 Warnings
     14 Notes

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:52:40, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll (file missing)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - dbnmpntwb.dll (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

Primura · Answer

il m'a demandé ce que je voulais faire du trojan lorsuqe j'ai redémarré je l'ai mis en quarantaine je c pas si ca a marché ... par contre antivir c relancé tt seul et procède a un nouveau scan

Primura · Answer

et il trouve encore d trucs

Primura · Answer

et je suis pas en safe mode ..

Primura · Answer

Avira AntiVir Personal
Report file date: mardi 24 juin 2008  20:49

Scanning for 1165085 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    ADMIN

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.3.62       337408 Bytes  21/03/2008 19:12:34
ANTIVIR3.VDF  : 7.0.3.68        57856 Bytes  25/03/2008 08:27:50
Engineversion : 8.1.0.28  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.19       229754 Bytes  07/04/2008 15:34:44
AESCN.DLL     : 8.1.0.12       115060 Bytes  07/04/2008 15:34:44
AERDL.DLL     : 8.1.0.19       418164 Bytes  07/04/2008 15:34:44
AEPACK.DLL    : 8.1.1.0        364918 Bytes  18/03/2008 11:20:42
AEOFFICE.DLL  : 8.1.0.15       192889 Bytes  07/04/2008 15:34:44
AEHEUR.DLL    : 8.1.0.15      1147253 Bytes  07/04/2008 15:34:44
AEHELP.DLL    : 8.1.0.11       115061 Bytes  07/04/2008 15:34:43
AEGEN.DLL     : 8.1.0.15       299379 Bytes  07/04/2008 15:34:43
AEEMU.DLL     : 8.1.0.5        430450 Bytes  07/04/2008 15:34:43
AECORE.DLL    : 8.1.0.25       168309 Bytes  08/04/2008 09:58:32
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: mardi 24 juin 2008  20:49

Starting search for hidden objects.
'32886' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'update.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '0' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned
Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'nSvcIp.exe' - '1' Module(s) have been scanned
Scan process 'fsav32.exe' - '1' Module(s) have been scanned
Scan process 'fsgk32.exe' - '1' Module(s) have been scanned
Scan process 'FAMEH32.exe' - '1' Module(s) have been scanned
Scan process 'nSvcAppFlt.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'fch32.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'BACKWE~1.EXE' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'FSMB32.exe' - '1' Module(s) have been scanned
Scan process 'fswsclds.exe' - '1' Module(s) have been scanned
Scan process 'FSMA32.exe' - '1' Module(s) have been scanned
Scan process 'SERVIC~1.EXE' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'CoreCom.exe' - '1' Module(s) have been scanned
Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned
Scan process 'Deskboard.exe' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
Scan process 'FSM32.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
51 processes with 51 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!
Master boot sector HD1
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!
Boot sector 'E:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '30' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{9E928109-185D-4FF1-8D69-AAC35F6496F2}\RP2\A0000085.EXE
  [0] Archive type: RSRC
  --> Object
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '4891433a.qua'!
C:\System Volume Information\_restore{9E928109-185D-4FF1-8D69-AAC35F6496F2}\RP2\A0000086.exe
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '49fe831b.qua'!
Begin scan in 'E:\' <Nouveau nom>
E:\System Volume Information\_restore{9E928109-185D-4FF1-8D69-AAC35F6496F2}\RP2\A0000087.EXE
  [0] Archive type: RSRC
  --> Object
      [DETECTION] Contains detection pattern of the worm WORM/VB.NPM.1
      [NOTE]      The file was moved to '489144f9.qua'!


End of the scan: mardi 24 juin 2008  21:02
Used time: 13:16 min

The scan has been done completely.

   4303 Scanning directories
 176226 Files were scanned
      3 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      3 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 176223 Files not concerned
   1053 Archives were scanned
      1 Warnings
      3 Notes
  32886 Objects were scanned with rootkit scan
      0 Hidden objects were found

Primura · Answer

voila le nouveau scan qu'il a fait tt seul apres redemarrage de mon pc

sKe69 · Answer

Il y a déjà du mieux une fois que Antivir à finit de bosser , recommence en mode sans échec  et postes moi le dernier rapport obtenu avec de nouveau un rapport Hijackthis ... je répètes , en modes sans échec et sans prise en charge du réseau ... merci  ;) 

PS : Le scan vas être beaucoup plus long , c'est normal ... mais aussi plus efficace !

mareus · Answer

bonjour

deja est ce que tu as vu ça ? http://wwwds.free-h.net/essais.html

Primura · Answer

c quoi?

Primura · Answer

il me relance un scan a nouveau apres redemarrage. je tenvoi le rapport en safe mode celui fait apres le demarrage et le hijack this d qu'il a fini...

Primura · Answer

antivir me telecharge de nvelles mise a jour alors que je l'ai fait tt a lheure je capte pas ... il me dit que j'ai pas fait de derniere mise a jour

Primura · Answer

Avira AntiVir Personal
Report file date: mardi 24 juin 2008  21:23

Scanning for 1165085 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Save mode
Username:         Sébastien
Computer name:    ADMIN

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.3.62       337408 Bytes  21/03/2008 19:12:34
ANTIVIR3.VDF  : 7.0.3.68        57856 Bytes  25/03/2008 08:27:50
Engineversion : 8.1.0.28  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.19       229754 Bytes  07/04/2008 15:34:44
AESCN.DLL     : 8.1.0.12       115060 Bytes  07/04/2008 15:34:44
AERDL.DLL     : 8.1.0.19       418164 Bytes  07/04/2008 15:34:44
AEPACK.DLL    : 8.1.1.0        364918 Bytes  18/03/2008 11:20:42
AEOFFICE.DLL  : 8.1.0.15       192889 Bytes  07/04/2008 15:34:44
AEHEUR.DLL    : 8.1.0.15      1147253 Bytes  07/04/2008 15:34:44
AEHELP.DLL    : 8.1.0.11       115061 Bytes  07/04/2008 15:34:43
AEGEN.DLL     : 8.1.0.15       299379 Bytes  07/04/2008 15:34:43
AEEMU.DLL     : 8.1.0.5        430450 Bytes  07/04/2008 15:34:43
AECORE.DLL    : 8.1.0.25       168309 Bytes  08/04/2008 09:58:32
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: mardi 24 juin 2008  21:23

Starting search for hidden objects.
The driver could not be initialized.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'userinit.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
12 processes with 12 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!
Master boot sector HD1
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!
Boot sector 'E:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '31' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
Begin scan in 'E:\' <Nouveau nom>


End of the scan: mardi 24 juin 2008  21:33
Used time: 10:22 min

The scan has been done completely.

   4289 Scanning directories
 175733 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 175733 Files not concerned
   1053 Archives were scanned
      1 Warnings
      0 Notes

Primura · Answer

Avira AntiVir Personal
Report file date: mardi 24 juin 2008  21:36

Scanning for 1165085 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    ADMIN

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.3.62       337408 Bytes  21/03/2008 19:12:34
ANTIVIR3.VDF  : 7.0.3.68        57856 Bytes  25/03/2008 08:27:50
Engineversion : 8.1.0.28  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.19       229754 Bytes  07/04/2008 15:34:44
AESCN.DLL     : 8.1.0.12       115060 Bytes  07/04/2008 15:34:44
AERDL.DLL     : 8.1.0.19       418164 Bytes  07/04/2008 15:34:44
AEPACK.DLL    : 8.1.1.0        364918 Bytes  18/03/2008 11:20:42
AEOFFICE.DLL  : 8.1.0.15       192889 Bytes  07/04/2008 15:34:44
AEHEUR.DLL    : 8.1.0.15      1147253 Bytes  07/04/2008 15:34:44
AEHELP.DLL    : 8.1.0.11       115061 Bytes  07/04/2008 15:34:43
AEGEN.DLL     : 8.1.0.15       299379 Bytes  07/04/2008 15:34:43
AEEMU.DLL     : 8.1.0.5        430450 Bytes  07/04/2008 15:34:43
AECORE.DLL    : 8.1.0.25       168309 Bytes  08/04/2008 09:58:32
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: mardi 24 juin 2008  21:36

Starting search for hidden objects.
'32610' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'dwwin.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned
Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'nSvcIp.exe' - '1' Module(s) have been scanned
Scan process 'fsav32.exe' - '1' Module(s) have been scanned
Scan process 'nSvcAppFlt.exe' - '1' Module(s) have been scanned
Scan process 'fsgk32.exe' - '1' Module(s) have been scanned
Scan process 'FAMEH32.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'fch32.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'BACKWE~1.EXE' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'fswsclds.exe' - '1' Module(s) have been scanned
Scan process 'FSMB32.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'FSMA32.exe' - '1' Module(s) have been scanned
Scan process 'SERVIC~1.EXE' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'update.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'CoreCom.exe' - '1' Module(s) have been scanned
Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned
Scan process 'Deskboard.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
Scan process 'FSM32.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
52 processes with 52 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [INFO]      No virus was found!
Master boot sector HD1
      [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [INFO]      No virus was found!
Boot sector 'E:\'
      [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '29' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
Begin scan in 'E:\' <Nouveau nom>


End of the scan: mardi 24 juin 2008  21:50
Used time: 14:25 min

The scan has been done completely.

   4303 Scanning directories
 175968 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 175968 Files not concerned
   1053 Archives were scanned
      1 Warnings
      0 Notes
  32610 Objects were scanned with rootkit scan
      0 Hidden objects were found

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:56:32, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32undll32.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll (file missing)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - dbnmpntwb.dll (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

Nickel ! 

1-Fermes toutes tes applications et déconnectes toi .

Relance Hijackthis mais click sur " Do a scan only " 
Tu vois donc apparaitre le résultat du scan : une multitudes de lignes ,chacunes précédées d'un carré vide . 
Tu vas clické sur les carré des lignes suivantes : 

O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll (file missing)
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll (file missing) 
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe 
O20 - Winlogon Notify: kswhazex - dbnmpntwb.dll (file missing) 

Tu cliques en bas sur le bouton FIX CHECKED et valides .

2- Vides les quarantaines respectives de Malwarebytes , de F-Secure et de AntiVir ...

3- refais un coup de CCleaner ( registre compris ) 

4- Avant de poursuivre ; tu te retrouves dans la situation suivante : tu as 2 antivirus actifs sur ton PC , Il faut en suprimé un impérativement ( stabilité du système , faille de sécurité ... ) , donc dis moi lequel veux tu gardés ? F-Secure , tu as acheter la licence ou est-ce une version démo ou autre ... ?

Primura · Answer

bah je paye 5 euros ts les mois pour f-secure je l'ai u avec wanadoo a l'époque ... ca me derange pas de payer. tt ce que je veux savoir c lequel est le plsu efficace?
Sinon comment je fais pour vider les quarantaines?

sKe69 · Answer

Sinon comment je fais pour vider les quarantaines? --->regardes les tuto que je t'ai filé ^^ , et suprimes tout ce qui s'y trouve ...
F-Secure : http://www.malekal.com/tutorial_FIS2007.php
AntiVir : https://www.malekal.com/avira-free-security-antivirus-gratuit/
Malwarebytes : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Ensuite , si tu payes F-Sécure pas de prb ! Retournes en mode sans échec , puis vas dans "ajout/suppression de prg" ( via paneau de configuration ) et supprimes AntiVir . Puis tjrs en mode sans échec , refais un coup de CCleaner ( registre compris ) .

Redémarres ton PC et postes un nouveau hijackthis pour contrôle ...

Primura · Answer

je ne c pas comment enlevé les quarantaines de f-secure .. g trouvé pour mbam et antivir

Primura · Answer

oki merci

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:58:11, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - dbnmpntwb.dll (file missing)
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

y a un hic ... fais exactement ce qui suit :

Suprimes le doc CFScript.txt que tu as sur ton bureau et on va en faire un autre : 

1-Crée un doc texte sur ton bureau : 
pointes ta souris sur ton bureau , click droit : vas dans "nouveau" et choisis "document texte" . 

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de crée : 

Registry:: 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B56F637C-8AF9-43FA-A31B-935F967A00CC}] 

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FA566E27-2B42-422B-9370-B1157205F1E1}] 

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\kswhazex]


Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi : 
CFScript puis valides ...
 

2-Nettoyage :
!! Déconnectes toi,fermes toute tes application et désactive ton antivirus le temps de la manipe ( tu le réactiveras après )  !! 

--->Sur ton bureau, fais un glisser avec ta souris le fichier CFScript sur l'icone de ComboFix.exe . 

(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tape 1 puis valide. 

Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!) 

!! Ne touche à rien tant que le scan n'est pas terminé !! 

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire. 

Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )

Primura · Answer

ComboFix 08-06-20.4 - Sébastien 2008-06-24 23:28:18.5 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1640 [GMT 2:00] Endroit: C:\Documents and Settings\Sébastien\Bureau\C-Fix.exe Command switches used :: C:\Documents and Settings\Sébastien\Bureau\CFScript.txt * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . ((((((((((((((((((((((((((((( Fichiers créés 2008-05-24 to 2008-06-24 )))))))))))))))))))))))))))))))))))) . 2008-06-24 22:35 . 2008-06-24 22:35 dr------- C:\Documents and Settings\LocalService\Favoris 2008-06-24 20:19 . 2008-06-24 22:57 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-06-24 18:30 . 2004-05-05 09:40 16,384 --a------ C:\WINDOWS\system32 estart.exe 2008-06-24 18:08 . 2007-02-09 10:26 184,320 --a------ C:\WINDOWS\system32\delnext.exe 2008-06-24 17:51 . 2008-06-24 17:51 d-------- C:\Documents and Settings\SÚbastien 2008-06-24 17:25 . 2008-06-24 17:25 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-06-24 17:25 . 2008-06-24 17:25 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-06-23 20:43 . 2008-06-23 20:43 d-------- C:\Documents and Settings\Sébastien\Application Data\Malwarebytes 2008-06-23 20:42 . 2008-06-23 20:42 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-23 20:42 . 2008-06-23 20:42 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-23 20:42 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-23 20:42 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-23 20:08 . 2008-06-23 20:08 d-------- C:\Program Files\CCleaner 2008-06-23 19:08 . 2008-06-23 19:08 d-------- C:\WINDOWS\ERUNT 2008-06-23 19:05 . 2008-06-23 19:15 d-------- C:\SDFix 2008-06-23 18:13 . 2008-06-23 18:14 d-------- C:\Program Files\RogueRemover FREE 2008-06-23 17:35 . 2008-06-23 17:35 d-------- C:\Program Files\Trend Micro 2008-06-22 11:47 . 2004-08-05 14:00 4,224 --a------ C:\WINDOWS\system32\beep.sys 2008-06-11 22:16 . 2008-06-11 22:16 d-------- C:\Program Files\Windows Media Connect 2 2008-06-11 22:15 . 2008-06-11 22:15 d-------- C:\WINDOWS\system32\LogFiles 2008-06-11 22:15 . 2008-06-11 22:16 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-06-02 01:27 . 2008-06-02 01:27 d-------- C:\Documents and Settings\Sébastien\Application Data\vlc 2008-05-31 03:17 . 2008-06-09 00:59 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-31 03:17 . 2008-05-31 03:17 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-28 19:11 . 2008-05-28 19:11 d--h----- C:\WINDOWS\PIF . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-24 20:39 --------- d-----w C:\Program Files\F-Secure 2008-06-10 16:52 --------- d-----w C:\Program Files\eMule 2008-06-04 16:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-06-03 21:56 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\Lavasoft 2008-05-20 19:20 --------- d-----w C:\Documents and Settings\Sébastien\Application Data eamspeak2 2008-05-17 18:02 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\dbzikwch 2008-05-17 09:50 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\Skype 2008-05-17 09:43 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\skypePM 2008-05-16 18:17 --------- d-----w C:\Program Files\Fichiers communs\Mozilla Shared 2008-05-16 18:17 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\dbzikwch 2008-05-12 16:52 --------- d-----w C:\Program Files\Windows Live 2008-05-12 16:52 --------- d-----w C:\Program Files\MSN Messenger 2008-05-12 16:52 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-05-11 20:40 --------- d-----w C:\Program Files\Skype 2008-05-11 20:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-05-11 20:39 --------- d-----w C:\Program Files\Fichiers communs\Skype 2008-05-04 01:39 5,632 ----a-w C:\WINDOWS\system32\drivers\StarOpen.sys 2008-04-27 19:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-27 12:00 2,770 ----a-w C:\WINDOWS\system32 mp.reg 2008-04-26 19:04 --------- d-----w C:\Program Files\Orange 2008-04-26 19:03 --------- d-----w C:\Program Files\Fichiers communs\France Telecom 2008-04-26 18:32 --------- d-----w C:\Program Files\SAGEM 2008-04-26 18:32 --------- d-----w C:\Documents and Settings\Sébastien\Application Data\InstallShield 2008-04-26 17:05 --------- d-----w C:\Program Files\Wanadoo 2008-04-25 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-24 06:10 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe 2008-04-23 20:14 82,944 ----a-w C:\WINDOWS\system32\IEDFix.exe 2008-04-23 20:14 82,944 ----a-w C:\WINDOWS\system32\404Fix.exe 2008-04-23 18:28 196,608 ----a-w C:\WINDOWS\system32\libssl32.dll 2008-04-23 18:28 1,015,808 ----a-w C:\WINDOWS\system32\libeay32.dll . ((((((((((((((((((((((((((((( snapshot@2008-06-23_21.59.43,29 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-23 19:54:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-24 20:57:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B56F637C-8AF9-43FA-A31B-935F967A00CC}] C:\WINDOWS\system32\comdlg32e.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FA566E27-2B42-422B-9370-B1157205F1E1}] c:\windows\system32\dbnmpntwb.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-03 00:27 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-09 09:36 8527872] "nwiz"="nwiz.exe" [2007-10-09 09:36 1626112 C:\WINDOWS\system32 wiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-09 09:36 81920] "DAEMON Tools-1033"="E:\daemon.exe" [2004-08-22 18:05 81920] "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2002-07-22 19:34 135168] "SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 20:08 94208] "ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 19:10 102400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\kswhazex] dbnmpntwb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.3iv2"= 3ivxVfWCodec.dll "VIDC.VP31"= vp31vfw.dll "msacm.l3fhg"= mp3fhg.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= "C:\Program Files\MSN Messenger\livecall.exe"= "C:\Program Files\eMule\emule.exe"= "C:\WINDOWS\system32\dpvsetup.exe"= "C:\Program Files\Orange\Connectivity\ConnectivityManager.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "10493:TCP"= 10493:TCP:@xpsp2res.dll,-22009 "80:TCP"= 80:TCP:@xpsp2res.dll,-22009 "62206:TCP"= 62206:TCP:@xpsp2res.dll,-22009 "53179:TCP"= 53179:TCP:@xpsp2res.dll,-22009 "47869:TCP"= 47869:TCP:@xpsp2res.dll,-22009 R0 ubqgamqy;ubqgamqy;C:\WINDOWS\system32\drivers\ubqgamqy.sys [2004-08-05 14:00] R2 BackWeb Client - 174112;Securitoo AntiVirus;C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE [2008-01-23 19:59] R2 F-Secure AVP;F-Secure AVP;C:\Program Files\F-Secure\Anti-Virus\fsavp.sys [2001-05-25 11:44] R2 F-Secure F-PROT;F-Secure F-PROT;C:\Program Files\F-Secure\Anti-Virus\fsfp.sys [2008-01-24 18:51] R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Common\FSfilter.sys [2001-06-28 04:05] R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Common\FSgk.sys [2001-06-28 04:05] R2 F-Secure Orion;F-Secure Orion;C:\Program Files\F-Secure\Anti-Virus\fsorion.sys [2008-01-24 18:51] R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Common\FSrec.sys [2001-06-28 04:05] R2 FSpm;F-Secure Policy Manager;C:\Program Files\F-Secure\Common\FSPM.SYS [2002-01-24 19:55] R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\F-Secure\fswsclds.exe [2008-01-24 18:52] R3 P1130VID;Creative WebCam NX Pro;C:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-08 03:00] S1 kbd;kbd;C:\WINDOWS\system32\drivers\kbd.sys [] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs mpbcwszj [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e568e942-b240-11dc-8f6c-806d6172696f}] \Shell\AutoRun\command - D:\Setup.exe *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-24 23:29:08 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-06-24 23:29:48 ComboFix-quarantined-files.txt 2008-06-24 21:29:39 ComboFix2.txt 2008-06-24 15:51:23 ComboFix3.txt 2008-06-23 20:43:28 ComboFix4.txt 2008-06-23 20:35:52 ComboFix5.txt 2008-06-23 20:00:01 Pre-Run: 27,427,885,056 octets libres Post-Run: 27,423,293,440 octets libres 151

Primura · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:32:16, on 24/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32undll32.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\systray\systrayapp.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {B56F637C-8AF9-43FA-A31B-935F967A00CC} - C:\WINDOWS\system32\comdlg32e.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FA566E27-2B42-422B-9370-B1157205F1E1} - c:\windows\system32\dbnmpntwb.dll (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: kswhazex - dbnmpntwb.dll (file missing)
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

sKe69 · Answer

pas marcher ... :-/

Télécharges SmitfraudFix (de S!Ri, balltrap34 et moe31 ) :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

!!Déconnectes toi,fermes toute tes applications et désactives tes défences ( anti-virus ,anti-spyware,...) le temps de la manipe !!

Installes le soft à la racine de C\ ( et pas ailleur! --->"C\:SmitfraudFix.exe" ) : double clique sur l'.exe pour le décompresser et lancer le fix.
 
Utilisation ----> option 1 - Recherche : 
Double clique sur smitfraudfix.cmd Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
 
Postes le rapport ( rapport.txt qui se trouve sous C\: ) et attends la suite . 

(Attention : process.exe est détecté par certains antivirus comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)

Primura · Answer

SmitFraudFix v2.328

Rapport fait à  0:03:05,34, 25/06/2008
Executé à partir de C:\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32undll32.exe
C:\PROGRA~1\SECURI~1\174112\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\PROGRA~1\SECURI~1\174112\Program\BACKWE~1.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Orange\systray\systrayapp.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\System32\svchost.exe
E:\OFFICE11\WINWORD.EXE
C:\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\S‚bastien


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\S‚bastien\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SBASTI~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CS2\Services\Tcpip\..\{97B30D23-BA44-4D1C-B87C-1BD26F2B2139}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

sKe69 · Answer

Nada ...
ré-essayes la manipe CFScript du post 76 mais en mode sans échec ... et postes moi les rapports ( dernier combo et hijack fais en mode normal après combofix biensûr ) ...

green day · Answer

Salut à vous

effectivement ce cas semble assez coriace ! tu es tombé sur le gros lot ;-)

télécharge OTMoveIt (de Old_Timer) sur ton Bureau : 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

shcas8j0ec0t.exe
C:\Program Files\shcev9j0e1b1\Uninstall.exe
C:\Program Files\shcev9j0e1b1\shcev9j0e1b1.exe
shcev9j0e1b1.exe
MalwareProtector2008Setup.exe
MalwareProtector2008.exe


redémarre en mode sans echec
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en gras ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre Results. 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 
il te sera peut-être demander de redémarrer le pc pour achever la suppression. 
si c'est le cas accepte par Yes.

@+

Malware Protecotr 2008

75 réponses

Discussions similaires

Newsletters