problem virus Résolu/Fermé

Question

Bonjour
comment allez vous ?

Logfile of HijackThis v1.99.1
Scan saved at 11:37:24, on 26/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus
avapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Razer\DeathAdderazerhid.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Razer\DeathAdderazertra.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Razer\DeathAdderazerofa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Pierre\Bureaublad\PIERRE\progamas\HijackThis.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://breedband.telenet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {487C9905-26A8-42C8-8033-C58AD3D2AEC3} - C:\WINDOWS\system32\hgGxULbc.dll
O2 - BHO: (no name) - {67E26CF6-4517-4A09-9344-85100CE924CC} - C:\WINDOWS\system32\ddcAtUOF.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: FCBHOBHO Class - {8B3868B4-EBA8-48FA-A19B-E1DFB99066FA} - C:\Program Files\FlashCapture\fcbho.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdderazerhid.exe
O4 - HKLM\..\Run: [Synchronization Agent] "D:\Program Files\Sync Manager\agent\syncagent.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BM7ffdb4dc] Rundll32.exe "C:\WINDOWS\system32\vafdllfc.dll",s
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Office2K\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\Office2K\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Save F&lash with FlashCapture - res://C:\Program Files\FlashCapture\fciext.dll/FCIEXT.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\Program Files\FlashCapture\fciext.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - https://www.fileplanet.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: hgGxULbc - C:\WINDOWS\SYSTEM32\hgGxULbc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

 voici mon hijackthis log
je voudrais suprime les negatief mais cene ne marche pas il reviennent tout le temps 

O2 - BHO: (no name) - {487C9905-26A8-42C8-8033-C58AD3D2AEC3} - C:\WINDOWS\system32\hgGxULbc.dll
 O2 - BHO: (no name) - {67E26CF6-4517-4A09-9344-85100CE924CC} - C:\WINDOWS\system32\ddcAtUOF.dll 
O4 - HKLM\..\Run: [BM7ffdb4dc] Rundll32.exe "C:\WINDOWS\system32\vafdllfc.dll",s
O20 - Winlogon Notify: hgGxULbc - C:\WINDOWS\SYSTEM32\hgGxULbc.dll

j'ai deja fais analyse norton mais il ne sais pas les suprimer :S

svp aider moi

merci

cordialement cosse

padup · Accepted Answer

Salut,
télécharge ComboFix par sUBs d'un de ces liens :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/
https://forospyware.com

Sauvegarde le sur ton Bureau.
Double-clique sur Combofix.exe et suis les instructions.
Lorsqu'il aura terminé, un rapport apparaîtra à l'écran un fichier texte.
Copie>colle le contenu du rapport dans ta prochaine réponse.

Le rapport se trouvera aussi ici en  C:\ComboFix.txt



Attention:ne clique pas dans la fenêtre de Combofix pendant l'analyse ;
cela provoquerait le gel du programme.

cosse_538 · Answer

ComboFix 08-06-20.4 - Pierre 2008-06-26 21:08:35.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.1429 [GMT 2:00] Gestart vanuit: C:\Documents and Settings\Pierre\Bureaublad\ComboFix.exe [color=red][b]WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !![/b][/color] . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Common Files\{7CCE8~1 C:\Program Files\Common Files\{7CCE8~1\services.dll C:\Program Files\Common Files\{7CCE8~1\system.dll C:\WINDOWS\BM7ffdb4dc.xml C:\WINDOWS\cookies.ini C:\WINDOWS\hosts C:\WINDOWS\pskt.ini C:\WINDOWS\smdat32a.sys C:\WINDOWS\smdat32m.sys C:\WINDOWS\system32\ajvnlfjd.ini C:\WINDOWS\system32\byfpvsbh.ini C:\WINDOWS\system32\components C:\WINDOWS\system32\components\flx0.dll C:\WINDOWS\system32\components\flx1.dll C:\WINDOWS\system32\components\flx11.dll C:\WINDOWS\system32\components\flx2.dll C:\WINDOWS\system32\components\flx3.dll C:\WINDOWS\system32\components\flx4.dll C:\WINDOWS\system32\ctumyaye.ini C:\WINDOWS\system32\drvdag.dll C:\WINDOWS\system32\FOUtAcdd.ini C:\WINDOWS\system32\FOUtAcdd.ini2 C:\WINDOWS\system32\h@tkeysh@@k.dll C:\WINDOWS\system32\hgGxULbc.dll C:\WINDOWS\system32\higehsg.dll C:\WINDOWS\system32\ianxqhme.ini C:\WINDOWS\system32\khfFuuRk.dll C:\WINDOWS\system32\kRuuFfhk.ini C:\WINDOWS\system32\kRuuFfhk.ini2 C:\WINDOWS\system32\lescnxtd.ini C:\WINDOWS\system32\lraigmmo.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mexwgetv.ini C:\WINDOWS\system32\mlpncroh.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\mxocvaxf.ini C:\WINDOWS\system32\ntaylvkc.ini C:\WINDOWS\system32\obfvfsue.ini C:\WINDOWS\system32\rlvknlg.exe C:\WINDOWS\system32\sdmtmpff.ini C:\WINDOWS\system32\tlxbojuv.ini C:\WINDOWS\system32\urroxtl.dll C:\WINDOWS\system32\user32.dat C:\WINDOWS\system32\wapisu.exe C:\WINDOWS\system32\wqnuxdgg.ini C:\WINDOWS\system32\wrkunfgs.ini C:\WINDOWS\system32\xlpyrahb.ini C:\WINDOWS\system32\xmlkpjbu.ini C:\WINDOWS\system32\yinenano.ini C:\WINDOWS\wr.txt . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF (((((((((((((((((((( Bestanden Gemaakt van 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))) . 2008-06-26 21:02 . 2008-06-26 21:02 106,496 --a------ C:\WINDOWS\system32\bxjtsngr.dll 2008-06-26 21:02 . 2008-06-26 21:02 91,648 --a------ C:\WINDOWS\system32\ebqjenua.dll 2008-06-26 21:02 . 2008-06-26 21:02 80,896 --a------ C:\WINDOWS\system32\onaneniy.dll 2008-06-26 12:15 . 2004-08-04 10:03 340,480 --a------ C:\WINDOWS\system32\Kopie van zipfldr.dll 2008-06-26 12:00 . 2005-08-05 21:40 d--h----- C:\Documents and Settings\Administrator\Sjablonen 2008-06-26 12:00 . 2008-06-26 12:06 d--h----- C:\Documents and Settings\Administrator\Onlangs geopend 2008-06-26 12:00 . 2005-08-05 23:34 d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving 2008-06-26 12:00 . 2005-08-05 23:34 d-------- C:\Documents and Settings\Administrator\Mijn documenten 2008-06-26 12:00 . 2005-08-05 23:34 dr------- C:\Documents and Settings\Administrator\Menu Start 2008-06-26 12:00 . 2005-08-05 23:34 d-------- C:\Documents and Settings\Administrator\Favorieten 2008-06-26 12:00 . 2008-06-26 12:17 d-------- C:\Documents and Settings\Administrator\Bureaublad 2008-06-26 12:00 . 2008-06-26 12:00 d-------- C:\Documents and Settings\Administrator 2008-06-26 09:59 . 2008-06-26 09:59 80,896 --a------ C:\WINDOWS\system32\ommgiarl.dll 2008-06-25 23:26 . 2008-06-25 23:26 0 --a------ C:\WINDOWS\system32\msupdte.exe 2008-06-25 23:23 . 2008-06-25 23:32 63,109,684 --a------ C:\eminem shake that ass.3gp 2008-06-25 23:14 . 2008-06-25 23:23 2,044,654,244 --a------ C:\test.00.avi 2008-06-24 19:24 . 2008-06-25 21:58 d-------- C:\Program Files\Steam 2008-06-20 23:40 . 2008-06-22 23:05 d-------- C:\Program Files\DVD Shrink 2008-06-20 23:23 . 2008-06-22 23:04 d-------- C:\Program Files\No1 DVD Ripper 2008-06-20 23:23 . 2008-06-20 23:25 67 --a------ C:\WINDOWS\#1 DVD Ripper.INI 2008-06-14 23:13 . 2008-06-14 23:13 d--h----- C:\Documents and Settings\Pierre\Application Data\IFViewer 2008-06-14 23:06 . 2008-06-14 23:06 d-------- C:\Program Files\Sun 2008-06-08 16:52 . 2008-06-08 16:52 0 -r-h----- C:\logwmemory.bin 2008-06-08 16:39 . 2008-06-08 16:39 d-------- C:\Westwood 2008-06-08 12:35 . 2008-06-08 12:37 d-------- C:\Documents and Settings\Pierre\Application Data\Command & Conquer 3 Kane's Wrath 2008-06-08 12:34 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll 2008-06-08 12:34 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-06-08 12:34 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll 2008-06-08 12:34 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll 2008-06-08 12:34 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll 2008-06-08 12:34 . 2007-10-22 03:37 17,928 --a------ C:\WINDOWS\system32\X3DAudio1_2.dll 2008-06-02 19:52 . 2008-06-02 19:52 d-------- C:\Documents and Settings\Pierre\Application Data\Lingoes 2008-06-02 19:51 . 2008-06-02 19:59 d-------- C:\Program Files\NJStar Communicator 2008-06-02 19:51 . 2008-06-02 19:59 d-------- C:\Documents and Settings\Pierre\Application Data\NJStar 2008-06-02 18:06 . 2008-06-26 21:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-02 18:06 . 2008-06-02 18:06 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-31 01:23 . 2008-05-31 01:23 8,835 --a--c--- C:\WINDOWS\system32\dpufr.qm . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-26 18:57 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-06-25 21:24 --------- d-----w C:\Documents and Settings\Pierre\Application Data\uTorrent 2008-06-22 21:17 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-22 21:01 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-06-22 21:01 --------- d-----w C:\Program Files\Telemeter 3.0 2008-06-22 20:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-06-22 20:48 --------- d-----w C:\Program Files\Valve 2008-06-22 16:04 --------- d-----w C:\Documents and Settings\Pierre\Application Data\Screenshot Sender 2008-06-19 18:01 --------- d-----w C:\Program Files\AIDA32 - Enterprise System Information 2008-06-18 14:39 --------- d-----w C:\Program Files\DivX 2008-06-17 14:45 68,000 -c--a-w C:\Documents and Settings\Pierre\Application Data\GDIPFONTCACHEV1.DAT 2008-06-14 21:06 --------- d-----w C:\Program Files\Java 2008-06-14 18:00 272,640 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-01 09:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink 2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2008-05-30 23:22 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll 2008-05-30 23:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2008-05-30 23:22 683,520 ----a-w C:\WINDOWS\system32\DivX.dll 2008-05-30 23:22 593,920 -c--a-w C:\WINDOWS\system32\dpuGUI11.dll 2008-05-30 23:22 57,344 -c--a-w C:\WINDOWS\system32\dpv11.dll 2008-05-30 23:22 53,248 -c--a-w C:\WINDOWS\system32\dpuGUI10.dll 2008-05-30 23:22 344,064 -c--a-w C:\WINDOWS\system32\dpus11.dll 2008-05-30 23:22 294,912 -c--a-w C:\WINDOWS\system32\dpu11.dll 2008-05-30 23:22 294,912 -c--a-w C:\WINDOWS\system32\dpu10.dll 2008-05-30 22:42 --------- d-----w C:\Program Files\PKR 2008-05-22 22:22 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2008-05-22 22:22 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-05-22 22:20 200,704 -c--a-w C:\WINDOWS\system32\ssldivx.dll 2008-05-22 22:20 1,044,480 -c--a-w C:\WINDOWS\system32\libdivx.dll 2008-05-22 22:19 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-05-22 22:19 196,608 -c--a-w C:\WINDOWS\system32\dtu100.dll 2008-05-22 22:19 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-05-22 22:18 12,288 -c--a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2008-05-13 13:11 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-05-13 13:10 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-05-13 13:03 20,520 ----a-w C:\WINDOWS\system32\drivers\ggsemc.sys 2008-05-13 13:03 13,352 ----a-w C:\WINDOWS\system32\drivers\ggflt.sys 2008-05-13 13:03 1,419,232 ----a-w C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-05-13 13:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson 2008-05-13 13:01 --------- d-----w C:\Program Files\Sony Ericsson 2008-05-12 10:31 --------- d-----w C:\Program Files\Avanquest update 2008-05-12 10:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-05-10 23:04 11 ----a-w C:\batch.bat 2008-05-08 18:05 817,664 ---h--w C:\WINDOWS\system32\wodfamoh.dll 2008-05-08 17:07 --------- d-----w C:\Documents and Settings\3ht04\Application Data\ATI 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:16 1,291,776 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-02 09:37 --------- d-----w C:\Program Files\Safari 2008-05-02 09:36 --------- d-----w C:\Program Files\Apple Software Update 2008-04-30 13:59 --------- d-----w C:\Program Files\Mininova 2008-04-26 16:37 --------- d-----w C:\Program Files\Conduit 2008-04-26 16:06 --------- d-----w C:\Program Files\DVDlabPro2 2008-04-26 14:14 --------- d-----w C:\Documents and Settings\Pierre\Application Data\LEAPS 2008-04-23 04:22 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-11 14:02 98,304 -c--a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-02-28 17:46 32 -c--a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2004-03-02 19:00 737,280 -c--a-w C:\Program Files\gamex86.dll 2004-03-02 19:00 462,848 -c--a-w C:\Program Files\cgamex86.dll 2004-03-02 19:00 253,952 -c--a-w C:\Program Files\uix86.dll 2004-02-11 19:34 94,208 -c--a-w C:\Program Files\EaxMan.dll 2003-06-17 17:52 370,688 -c--a-w C:\Program Files\mss32.dll 2007-05-09 16:22 150 -csha-r C:\WINDOWS\Regbak.dat 2005-08-06 13:24 32 -csha-w C:\WINDOWS\{28CBEDE3-987C-4BDE-A3F7-98811410581F}.dat 2005-08-06 13:23 32 -csha-w C:\WINDOWS\{C2DBBF1C-0FD1-42C0-BA12-C02C3FB97453}.dat 2005-08-06 13:23 32 -csha-w C:\WINDOWS\system32\{3355EE14-E722-42CE-BCFD-A98CA8979D70}.dat 2005-08-06 13:24 32 -csha-w C:\WINDOWS\system32\{36DC04DD-B19F-4A29-A2CC-2B0856CBEDDC}.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3d50cadc-d7a4-46fb-b7dc-3cad519c109e}] 2008-06-26 21:02 106496 --a------ C:\WINDOWS\system32\bxjtsngr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9275BB75-7807-493D-B3FA-64F853CB7B91}] C:\WINDOWS\system32\ddcAtUOF.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-01 21:08 171448] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:03 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-28 21:05 344064] "LVCOMS"="C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54 127022] "LogitechGalleryRepair"="C:\Program Files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 18:32 155648] "LogitechImageStudioTray"="C:\Program Files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 18:31 61440] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2003-07-15 14:36 54512] "ccRegVfy"="C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2003-07-15 14:42 60344] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2005-08-06 17:47 100056] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ] "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 23:55 54832] "Launch LGDCore"="C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" [2006-07-23 03:22 1126400] "Launch LCDMon"="C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe" [ ] "DeathAdder"="C:\Program Files\Razer\DeathAdder\razerhid.exe" [2006-12-06 22:30 159744] "Synchronization Agent"="D:\Program Files\Sync Manager\agent\syncagent.exe" [ ] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-12-06 19:37 69216] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Logitech Utility"="Logi_MwX.Exe" [2002-11-08 12:50 19968 C:\WINDOWS\LOGI_MWX.EXE] "AME_CSA"="amecsa.cpl,RUN_DLL" [] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] "SysMon"="" [] "WabKey"="" [] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "7cce8740"="C:\WINDOWS\system32\onaneniy.dll" [2008-06-26 21:02 80896] "BM7ffdb4dc"="C:\WINDOWS\system32\ebqjenua.dll" [2008-06-26 21:02 91648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:03 15360] "Picasa Media Detector"="D:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 23:18 443968] C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\ Microsoft Office.lnk - C:\Program Files\Office2K\Office10\OSA.EXE [2001-02-13 11:01:04 83360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^MetaCafe.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\MetaCafe.lnk backup=C:\WINDOWS\pss\MetaCafe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Pierre^Menu Start^Programma's^Opstarten^MetaCafe.lnk] path=C:\Documents and Settings\Pierre\Menu Start\Programma's\Opstarten\MetaCafe.lnk backup=C:\WINDOWS\pss\MetaCafe.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Pierre^Menu Start^Programma's^Opstarten^MyWebSearch Email Plugin.lnk] path=C:\Documents and Settings\Pierre\Menu Start\Programma's\Opstarten\MyWebSearch Email Plugin.lnk backup=C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] C:\Program Files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe] --a------ 2007-03-05 13:57 1103480 C:\Program Files\FilePlanet\Download Manager\DLM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA] C:\Program Files\Kaaza Gold\Kazaa Gold\kpp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobMapUpdater] --a------ 2008-02-10 18:39 1773184 C:\Program Files\MobMapUpdater\MobMapUpdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Obj Setup] C:\DOCUME~1\Pierre\APPLIC~1\NAMEAB~1\Save Axis Wait.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM] --a--c--- 2005-09-15 00:17 512000 C:\Program Files\Philips\Philips Device Manager\Bin\DeviceManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsLime] --a--c--- 2005-09-08 17:10 159744 C:\Program Files\Philips\Philips Lime Service\bin\LimeAlive.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebCamRT.exe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave] C:\Program Files\Save\Save.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher] --a--c--- 2004-03-18 09:33 892928 C:\Program Files\Logitech\iTouch\iTouch.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\GameSpy Arcade\Aphex.exe"= "C:\Program Files\Internet Explorer\iexplore.exe"= "C:\Program Files\EA GAMES\Need for Speed Underground 2\SPEED2.EXE"= "C:\Program Files\Sierra On-Line\SIGSPat.exe"= "C:\WINDOWS\system32\dpvsetup.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Java\jre1.5.0_04\bin\javaw.exe"= "C:\WINDOWS\system32\CIMSVR.exe"= "C:\Program Files\Mozilla Firefox\firefox.exe"= "C:\StubInstaller.exe"= "C:\Program Files\LimeWire\LimeWire.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe"= "C:\WINDOWS\system32\rtcshare.exe"= "D:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe"= "D:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"= "C:\Documents and Settings\Pierre\Bureaublad\PIERRE\progamas\utorrent.exe"= "D:\Program Files\W40kWA.exe"= "C:\Program Files\uTorrent\uTorrent.exe"= "D:\Program Files\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= "C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager 1.0\MediaManager.exe"= "D:\Unreal Anthology\UT2004\System\UT2004.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B0D039E0-C6F0-CC70-A44C-B49BC97A72AA}] C:\WINDOWS\system32\My_Server.exe . Inhoud van de 'Gedeelde Taken' map "2008-06-18 18:44:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-26 09:19:01 C:\WINDOWS\Tasks\Controleren op updates voor Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE "2006-12-27 13:00:05 C:\WINDOWS\Tasks\Norton AntiVirus - Analyser mon ordinateur.job" - C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~2\Tasks\mycomp.sca "2008-06-25 14:36:15 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-26 21:20:26 Windows 5.1.2600 Service Pack 2 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}] "ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl" . Voltooingstijd: 2008-06-26 21:29:53 ComboFix-quarantined-files.txt 2008-06-26 19:29:49 Pre-Run: 62,819,618,816 bytes beschikbaar Post-Run: 63,729,786,880 bytes beschikbaar 313 --- E O F --- 2008-06-20 16:41:13 voici :)

padup · Answer

Copie (Ctrl+C) le texte se situant dans le cadre ci-dessous : 


File::
C:\WINDOWS\system32\bxjtsngr.dll
C:\WINDOWS\system32\ebqjenua.dll
C:\WINDOWS\system32\onaneniy.dll 
C:\WINDOWS\system32\ommgiarl.dll 
C:\WINDOWS\system32\msupdte.exe 
C:\WINDOWS\system32\ddcAtUOF.dll 

Registry:
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3d50cadc-d7a4-46fb-b7dc-3cad519c109e}] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9275BB75-7807-493D-B3FA-64F853CB7B91}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"7cce8740"=-
"BM7ffdb4dc"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]

Folder::
C:\DOCUME~1\Pierre\APPLIC~1\NAMEAB~1
C:\Program Files\Save


Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte que tu as copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt

Glisse maintenant le fichier ComboFix-Do.txt dans Combofix.exe comme  
dans l'image du lien ci-dessous :
http://i266.photobucket.com/albums/ii277/sUBs_/CFScript.gif

Une fenêtre bleue va apparaître avec ce message "Type 1 to continue, or 2 to abort" , tape 1 puis valide .
Tu peux ne pas avoir ce message.
Ton Bureau va disparaître à plusieurs reprises, pas d'inquiétude c'est normal, ne touche surtout à rien pendant le scan de Combofix.

Une fois le scan terminé, poste le contenu du rapport obtenu.

cosse_538 · Answer

plus necesaire je viens de suprimer tout les virus
combofix a suprimer la racine du virus qui re instalais les fiche spam.
donc j'ai su les fixeé merci beaucoup

padup · Answer

c'est toi qui voit.bonne route.

Problem virus

5 réponses

Discussions similaires