Virtumonde coriace...

Salut,

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique sur combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

envoi un message privé a quikiland ! Il aura surement une solution.

Salut !!

ton pc est rempli d infections vundo :s

fais ceci stp :

télécharge combofix (par sUBs) à cette adresse :

(c est le numéro 5 en bas de la page) : https://www.androidworld.fr/

et enregistre le sur le Bureau.

désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)

Voici un tuto pour bien l'installer et savoir l utiliser : https://www.androidworld.fr/

envois le rapport et ensuite refais un nouveau rapport hijackthis stp

Salut chiquitine !!

Je vois qu on est dans le bon chemin ;-)

je te laisse continuer @+

ok @+

Merci a vous pour votre aide.... La j'ai lancé combofix mais je me demande si ce n'est pas plus simple de le faire en mode sans échec....
Heuresement que j'ai deux p.c pace que je n'arrive pas à öe connecter sur lotre...

non c est en mode normal qui doit etre lancé ;-)

Merci goeffrey95... le compt rendu est en cour d préparation... jle met dés ke c bon....

chiquitine s occupera de toi je pense

@+

Merci à vous...

Voila le raport de combofix


ComboFix 08-08-11.01 - STEEVE MARTIN TOWA 2008-08-14 0:14:08.2 - NTFSx86
Endroit: C:\Documents and Settings\STEEVE MARTIN TOWA\Bureau\bouba\Virus Killer\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\STEEVE MARTIN TOWA\Local Settings\Temporary Internet Files\bestwiner.stt
C:\WINDOWS\b152.exe
C:\WINDOWS\b155.exe
C:\WINDOWS\b156.exe
C:\WINDOWS\BM279ab480.txt
C:\WINDOWS\BM279ab480.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\inf\svchost.exe
C:\WINDOWS\mrofinu1188.exe
C:\WINDOWS\mrofinu1188.exe.tmp
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ddcDvvuV.dll
C:\WINDOWS\system32\fkwtxkty.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\ngpujo.dll
C:\WINDOWS\system32\nhmnedxw.dll
C:\WINDOWS\system32\Nqsuxyay.ini
C:\WINDOWS\system32\Nqsuxyay.ini2
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\vtUonnmm.dll
C:\WINDOWS\system32\VuvvDcdd.ini
C:\WINDOWS\system32\VuvvDcdd.ini2
C:\WINDOWS\system32\whigcpjf.dll
C:\WINDOWS\system32\ytkxtwkf.dll
.
---- Previous Run -------
.
C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\macromedia\Flash Player\#SharedObjects\5H723VYV\interclick.com
C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\macromedia\Flash Player\#SharedObjects\5H723VYV\interclick.com\ud.sol
C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\STEEVE MARTIN TOWA\services.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\adober.exe
C:\WINDOWS\BM279ab480.txt
C:\WINDOWS\BM279ab480.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\inf\svchost.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\mrofinu1188.exe
C:\WINDOWS\system32\awtrsppM.dll
C:\WINDOWS\system32\Mppsrtwa.ini
C:\WINDOWS\system32\Mppsrtwa.ini2
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\vtUmJYqo.dll
C:\WINDOWS\U1RFRVZFIE1BUlRJTiBUT1dB\
C:\WINDOWS\U1RFRVZFIE1BUlRJTiBUT1dB\\asappsrv.dll
C:\WINDOWS\U1RFRVZFIE1BUlRJTiBUT1dB\\command.exe
C:\WINDOWS\U1RFRVZFIE1BUlRJTiBUT1dB\\oYlIlptIKHY1o5lLn21onYx1.vbs
C:\WINDOWS\U1RFRVZFIE1BUlRJTiBUT1dB\command.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CMDSERVICE
-------\Legacy_NETWORK_MONITOR
-------\Service_cmdService

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))))))))
.

2008-08-13 22:43 . 2008-08-13 22:43 2,048 --a------ C:\WINDOWS\system32\epqmglek.exe
2008-08-13 21:18 . 2008-08-13 21:18 2,048 --a------ C:\WINDOWS\system32\dmtjedvo.exe
2008-08-13 14:54 . 2008-08-13 14:54 2,048 --a------ C:\WINDOWS\system32\vubnevst.exe
2008-08-13 14:51 . 2008-08-13 14:51 <REP> d-------- C:\Program Files\Skra
2008-08-13 14:46 . 2008-08-13 14:46 <REP> d-------- C:\Program Files\Webtools
2008-08-13 14:41 . 2008-08-13 14:41 <REP> d-------- C:\Program Files\Mjcore
2008-08-13 12:58 . 2008-08-13 23:05 <REP> d-------- C:\Program Files\ma-config.com
2008-08-13 12:58 . 2008-08-13 23:05 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\ma-config.com
2008-08-13 00:13 . 2008-08-13 00:13 <REP> dr------- C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\Brother
2008-08-12 08:48 . 2008-08-12 08:48 2,048 --a------ C:\WINDOWS\system32\drhhkkhr.exe
2008-08-12 08:45 . 2008-08-12 08:45 <REP> d-------- C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\Malwarebytes
2008-08-12 08:45 . 2008-08-12 08:45 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-12 08:45 . 2008-07-30 20:15 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-12 08:45 . 2008-07-30 20:15 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-12 08:44 . 2008-08-12 08:45 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-12 08:40 . 2008-08-12 08:40 48,640 --a------ C:\WINDOWS\system32\efcDSIBt.dll.vir
2008-08-12 07:20 . 2008-08-12 07:20 <REP> d----c--- C:\!KillBox
2008-08-12 07:17 . 2008-08-13 22:30 <REP> d----c--- C:\VundoFix Backups
2008-08-11 23:57 . 2008-08-11 23:57 2,048 --a------ C:\WINDOWS\system32\kdqchnik.exe
2008-08-11 00:12 . 2008-08-11 00:12 <REP> d-------- C:\Documents and Settings\STEEVE MARTIN TOWA\.hydrogen
2008-08-10 23:41 . 2008-08-10 23:42 <REP> d-------- C:\WINDOWS\system32\ye2
2008-08-10 23:41 . 2008-08-10 23:41 <REP> d-------- C:\WINDOWS\system32\kBin02
2008-08-10 23:41 . 2008-08-10 23:41 <REP> d-------- C:\WINDOWS\system32\az1
2008-08-10 23:41 . 2008-08-10 23:41 <REP> d----c--- C:\temp\epr1
2008-08-10 23:41 . 2008-08-10 23:41 77 --a------ C:\Documents and Settings\STEEVE MARTIN TOWA\7963.bat
2008-08-09 18:57 . 2008-08-11 00:18 <REP> d----c--- C:\ejay
2008-08-09 18:57 . 2001-07-26 12:59 307,200 --a------ C:\WINDOWS\system32\drumpad.dll
2008-08-09 18:57 . 2001-07-26 12:59 280,576 --a------ C:\WINDOWS\system32\pxd_kom.dll
2008-08-09 18:57 . 2001-07-26 12:59 75,976 --a------ C:\WINDOWS\system32\BASSDEC.dll
2008-08-09 18:57 . 2001-07-26 12:59 45,056 --a------ C:\WINDOWS\system32\fader.dll
2008-08-09 06:06 . 2008-08-09 06:06 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Propellerhead Software
2008-08-09 06:06 . 2008-08-09 06:06 368,640 --a------ C:\WINDOWS\system32\ReWire.dll
2008-08-09 06:06 . 2008-08-09 06:06 233,472 --a------ C:\WINDOWS\system32\REX Shared Library.dll
2008-08-09 06:05 . 2008-08-09 06:06 <REP> d-------- C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\Propellerhead Software
2008-08-08 19:56 . 2008-03-27 15:42 7,477 --a------ C:\WINDOWS\system32\dopdf6.ctm
2008-08-08 19:50 . 2008-08-08 19:53 <REP> d-------- C:\Program Files\CZ-Doc2Pdf
2008-08-06 15:24 . 2008-08-06 15:24 <REP> d-------- C:\Program Files\BlueSquad
2008-08-06 15:21 . 2008-08-06 15:21 410 --a------ C:\WINDOWS\BusinessTranslator.ini
2008-08-06 15:18 . 2008-08-06 15:18 <REP> d-------- C:\Program Files\Business Translator
2008-08-06 12:50 . 2008-08-08 16:31 <REP> d-------- C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\COWON
2008-08-06 12:14 . 2008-08-06 12:28 <REP> d-------- C:\Program Files\VstPlugins
2008-08-06 12:14 . 2002-07-08 00:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm
2008-08-06 12:12 . 2008-08-06 12:12 <REP> d-------- C:\Program Files\Outsim
2008-08-06 12:08 . 2008-08-06 12:36 <REP> d-------- C:\Program Files\Image-Line
2008-08-04 15:28 . 2005-05-09 10:34 55,296 --------- C:\WINDOWS\system32\brinsstr.dll
2008-08-04 15:28 . 2008-08-04 15:28 50 --a------ C:\WINDOWS\system32\bridf05a.dat
2008-08-04 15:27 . 2008-08-04 15:27 <REP> d----c--- C:\Brother
2008-08-04 15:27 . 2004-12-10 16:35 147,456 --------- C:\WINDOWS\brunin03.dll
2008-08-04 15:19 . 2008-08-04 15:19 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-04 15:19 . 2003-09-24 11:37 27,279 --a------ C:\WINDOWS\maxlink.ini
2008-08-04 15:18 . 2008-08-04 15:18 <REP> d-------- C:\Program Files\ScanSoft
2008-08-04 15:18 . 2008-08-04 15:18 <REP> d-------- C:\Program Files\Fichiers communs\ScanSoft Shared
2008-08-04 15:18 . 2008-08-04 15:18 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-08-04 15:10 . 2008-08-04 15:10 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Brother
2008-07-29 02:07 . 2008-08-07 01:41 <REP> d-------- C:\Program Files\Iomatic
2008-07-29 02:07 . 2008-07-29 02:07 2,368 --a------ C:\WINDOWS\system32\SVKP.sys
2008-07-26 03:01 . 2008-07-26 03:01 <REP> d-------- C:\Program Files\Fichiers communs\GTK

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-12 05:13 --------- d-----w C:\Program Files\PowerArchiver
2008-08-12 00:44 --------- dc----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-11 23:54 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-09 03:19 --------- dc----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-08 14:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-07 17:27 --------- d-----w C:\Program Files\Creative
2008-08-07 17:21 --------- d-----w C:\Program Files\Black Jack Pro
2008-08-04 13:30 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-04 13:23 --------- d-----w C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\Creative
2008-08-04 02:38 --------- d-----w C:\Program Files\DivX
2008-08-03 17:27 --------- d-----w C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\uTorrent
2008-07-30 08:54 --------- d-----w C:\Program Files\Pcsx2_0.9.4
2008-07-30 08:54 --------- d-----w C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\Moyea
2008-07-25 17:20 --------- d-----w C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\LimeWire
2008-07-25 17:04 --------- d-----w C:\Program Files\LimeWire
2008-07-06 06:56 --------- dc----w C:\Documents and Settings\All Users\Application Data\LogMeIn
2008-07-05 08:47 --------- d---a-w C:\Program Files\wsr
2008-06-29 07:54 --------- dc----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-27 16:38 53,248 --sh--w C:\Documents and Settings\STEEVE MARTIN TOWA\winlogon.exe
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 01:33 290,816 -c----w C:\WINDOWS\Setup1.exe
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-26 13:57 42,431 -c--a-w C:\Program Files\AlphaChessHistory.dat
2008-05-16 20:41 230,481 ----a-w C:\WINDOWS\Piolet_Toolbar_Uninstaller_2921.exe
2008-05-14 10:16 8,836 -c--a-w C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\wklnhst.dat
2008-03-25 00:01 1,181,812 -c--a-w C:\Program Files\flvplayer_setup.exe
2008-02-09 12:33 13,555,266 ----a-w C:\Program Files\ProntoEdit4.zip
2007-05-15 23:30 23,245 -c--a-w C:\Program Files\ALPHAC~1History.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 12:00 15360]
"Yodm3D"="C:\DOCUME~1\STEEVE~1\MESDOC~1\OFFICE~1\yodm3D\Yodm3D.exe" [2007-06-26 19:26 2058752]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"Skra"="C:\Program Files\Skra\Skra.exe" [2008-08-13 14:51 33280]
"systems"="c:\windows\inf\svchost.exe" [2007-04-15 21:50 15872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"asjjaa"="c:\program files\uninstall information\jjaaj.exe" [2007-04-15 21:50 15872]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 19:17 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 19:30 40960]
"Windows Logon Applicationedc"="C:\Documents and Settings\STEEVE MARTIN TOWA\winlogon.exe" [2008-06-27 18:38 53248]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 12:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,\

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Documents and Settings\\STEEVE MARTIN TOWA\\Mes documents\\OFFICE One Zip\\Racer_PC_jeu_gratuit\\racer053b4\\racer.exe"=
"C:\\Program Files\\SAS\\SAS 9.1\\sas.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17351:TCP"= 17351:TCP:NortonAV
"13971:TCP"= 13971:TCP:NortonAV
"14445:TCP"= 14445:TCP:NortonAV
"16531:TCP"= 16531:TCP:NortonAV
"14331:TCP"= 14331:TCP:NortonAV
"15158:TCP"= 15158:TCP:NortonAV
"13718:TCP"= 13718:TCP:NortonAV
"12828:TCP"= 12828:TCP:NortonAV
"16464:TCP"= 16464:TCP:NortonAV
"12309:TCP"= 12309:TCP:NortonAV
"16522:TCP"= 16522:TCP:NortonAV
"16807:TCP"= 16807:TCP:NortonAV
"17040:TCP"= 17040:TCP:NortonAV
"16569:TCP"= 16569:TCP:NortonAV
"14017:TCP"= 14017:TCP:NortonAV
"12823:TCP"= 12823:TCP:NortonAV
"12618:TCP"= 12618:TCP:NortonAV
"13260:TCP"= 13260:TCP:NortonAV
"17840:TCP"= 17840:TCP:NortonAV
"12450:TCP"= 12450:TCP:NortonAV
"18200:TCP"= 18200:TCP:NortonAV
"15107:TCP"= 15107:TCP:NortonAV
"13628:TCP"= 13628:TCP:NortonAV
"15136:TCP"= 15136:TCP:NortonAV
"18506:TCP"= 18506:TCP:NortonAV
"12988:TCP"= 12988:TCP:NortonAV
"12982:TCP"= 12982:TCP:NortonAV
"13643:TCP"= 13643:TCP:NortonAV
"15048:TCP"= 15048:TCP:NortonAV
"14436:TCP"= 14436:TCP:NortonAV
"14080:TCP"= 14080:TCP:NortonAV
"13917:TCP"= 13917:TCP:NortonAV
"16753:TCP"= 16753:TCP:NortonAV
"16937:TCP"= 16937:TCP:NortonAV
"14717:TCP"= 14717:TCP:NortonAV
"13530:TCP"= 13530:TCP:NortonAV
"18820:TCP"= 18820:TCP:NortonAV
"18279:TCP"= 18279:TCP:NortonAV
"16191:TCP"= 16191:TCP:NortonAV
"12874:TCP"= 12874:TCP:NortonAV
"14140:TCP"= 14140:TCP:NortonAV
"12872:TCP"= 12872:TCP:NortonAV
"12289:TCP"= 12289:TCP:NortonAV
"6883:TCP"= 6883:TCP:Utorrent
"18146:TCP"= 18146:TCP:NortonAV
"12845:TCP"= 12845:TCP:NortonAV
"17949:TCP"= 17949:TCP:NortonAV
"15863:TCP"= 15863:TCP:NortonAV
"18790:TCP"= 18790:TCP:NortonAV
"14035:TCP"= 14035:TCP:NortonAV
"16447:TCP"= 16447:TCP:NortonAV
"13557:TCP"= 13557:TCP:NortonAV
"12311:TCP"= 12311:TCP:NortonAV
"17785:TCP"= 17785:TCP:NortonAV
"17309:TCP"= 17309:TCP:NortonAV
"14305:TCP"= 14305:TCP:NortonAV
"18990:TCP"= 18990:TCP:NortonAV
"17642:TCP"= 17642:TCP:NortonAV
"15359:TCP"= 15359:TCP:NortonAV
"17115:TCP"= 17115:TCP:NortonAV
"15293:TCP"= 15293:TCP:NortonAV
"17254:TCP"= 17254:TCP:NortonAV
"15317:TCP"= 15317:TCP:NortonAV
"18392:TCP"= 18392:TCP:NortonAV
"15667:TCP"= 15667:TCP:NortonAV
"17640:TCP"= 17640:TCP:NortonAV
"18003:TCP"= 18003:TCP:NortonAV
"13712:TCP"= 13712:TCP:NortonAV
"12965:TCP"= 12965:TCP:NortonAV
"17699:TCP"= 17699:TCP:NortonAV
"12742:TCP"= 12742:TCP:NortonAV
"13364:TCP"= 13364:TCP:NortonAV
"18510:TCP"= 18510:TCP:NortonAV
"13752:TCP"= 13752:TCP:NortonAV
"18717:TCP"= 18717:TCP:NortonAV
"15515:TCP"= 15515:TCP:NortonAV
"12185:TCP"= 12185:TCP:NortonAV
"18544:TCP"= 18544:TCP:NortonAV
"18897:TCP"= 18897:TCP:NortonAV
"14459:TCP"= 14459:TCP:NortonAV
"12383:TCP"= 12383:TCP:NortonAV
"13012:TCP"= 13012:TCP:NortonAV
"16179:TCP"= 16179:TCP:NortonAV
"12014:TCP"= 12014:TCP:NortonAV
"13709:TCP"= 13709:TCP:NortonAV
"13669:TCP"= 13669:TCP:NortonAV
"14262:TCP"= 14262:TCP:NortonAV
"17974:TCP"= 17974:TCP:NortonAV
"15477:TCP"= 15477:TCP:NortonAV
"12357:TCP"= 12357:TCP:NortonAV
"14869:TCP"= 14869:TCP:NortonAV
"14363:TCP"= 14363:TCP:NortonAV
"15760:TCP"= 15760:TCP:NortonAV
"14044:TCP"= 14044:TCP:NortonAV
"12171:TCP"= 12171:TCP:NortonAV
"14467:TCP"= 14467:TCP:NortonAV

R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2008-07-29 02:07]
R2 tdudf;TOSHIBA UDF File System Driver;C:\WINDOWS\system32\DRIVERS\tdudf.sys [2006-04-18 15:12]
S3 ATIXBAR;ATI WDM Audio Video Crossbar (Microsoft Corporation);C:\WINDOWS\system32\DRIVERS\atinxbxx.sys [2004-08-03 23:29]
S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2007-07-04 17:17]
S3 lg3gbus;LGE KU580 driver (WDM);C:\WINDOWS\system32\DRIVERS\lg3gbus.sys [2007-04-26 14:35]
S3 lg3gmdfl;LGE KU580 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\lg3gmdfl.sys [2007-04-26 14:36]
S3 lg3gmdm;LGE KU580 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\lg3gmdm.sys [2007-04-26 14:36]
S3 lg3gmgmt;LGE KU580 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\lg3gmgmt.sys [2007-04-26 14:36]
S3 lg3gnd5;LGE KU580 USB Ethernet Emulation (NDIS);C:\WINDOWS\system32\DRIVERS\lg3gnd5.sys [2007-04-26 14:36]
S3 lg3gobex;LGE KU580 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\lg3gobex.sys [2007-04-26 14:36]
S3 lg3gunic;LGE KU580 USB Ethernet Emulation (WDM);C:\WINDOWS\system32\DRIVERS\lg3gunic.sys [2007-04-26 14:36]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\Auto\command - G:\Windows.scr
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1f27b6e8-46d6-11dd-8fd5-0016d426e6d5}]
\Shell\AutoRun\command - F:\=Windows.scrmmsuwrpf.exe
\Shell\explore\Command - F:\=Windows.scrmmsuwrpf.exe
\Shell\open\Command - F:\=Windows.scrmmsuwrpf.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42574a67-14fd-11dd-8fba-0016d426e6d5}]
\Shell\Auto\command - F:\Windows.scr
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a5c1126-45b8-11db-8e97-0016e360c45a}]
\Shell\AutoRun\command - F:\ypbygfvt.exe
\Shell\explore\Command - F:\ypbygfvt.exe
\Shell\open\Command - F:\ypbygfvt.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ddc9f5f-c4e8-11dc-8f78-0016e360c45a}]
\Shell\Auto\command - G:\Windows.scr
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6efbe485-d361-11dc-8f89-0016d426e6d5}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8fffaec9-4b28-11dd-8fd6-0016d426e6d5}]
\Shell\AutoRun\command - en\default=1qsikdbgd.exe
\Shell\explore\Command - en\default=1qsikdbgd.exe
\Shell\open\Command - en\default=1qsikdbgd.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc45fe71-e9d4-11dc-8fa1-0016d426e6d5}]
\Shell\Auto\command - G:\Windows.scr
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dedf5106-01c6-11dd-8fb0-0016d426e6d5}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eaed7bf9-f674-11dc-8fa4-0016d426e6d5}]
\Shell\Auto\command - H:\Windows.scr
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Windows.scr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{edbd698c-35bd-11dd-8fcd-0016d426e6d5}]
\Shell\AutoRun\command - F:\iwwlvhei.exe
\Shell\explore\Command - F:\iwwlvhei.exe
\Shell\open\Command - F:\iwwlvhei.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{edbd6992-35bd-11dd-8fcd-0016d426e6d5}]
\Shell\AutoRun\command - F:\dnlrrnoi.exe
\Shell\explore\Command - F:\dnlrrnoi.exe
\Shell\open\Command - F:\dnlrrnoi.exe

*Newly Created Service* - COMHOST
.
- - - - ORPHANS REMOVED - - - -

BHO-{6E30FC18-BB6D-4336-AC95-7E886C7E1FEC} - C:\WINDOWS\system32\qoMeDSkk.dll
HKCU-Run-Scrabblev2.exe - D:\Autres\SCRA#4OD.EXE
HKCU-Run-toscdspd - TOSCDSPD.EXE
HKLM-Run-BM279ab480 - C:\WINDOWS\system32\nhmnedxw.dll
HKLM-RunServices-Kaspersky Antivirus. - C:\WINDOWS\system32\antivirus.exe
ShellExecuteHooks-{57DF73C0-833C-48B7-9146-1E18930D57FF} - C:\WINDOWS\system32\vtUonnmm.dll

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\STEEVE MARTIN TOWA\Application Data\Mozilla\Firefox\Profiles\o5qj8oh5.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://yahoomail.com/
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-14 00:22:21
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Documents and Settings\STEEVE MARTIN TOWA\winlogon.exe
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\WINDOWS\system32\RAMASST.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-14 0:29:34 - machine was rebooted [STEEVE MARTIN TOWA]
ComboFix-quarantined-files.txt 2008-08-13 22:29:25

Pre-Run: 6,568,701,952 octets libres
Post-Run: 6,747,488,256 octets libres

398 --- E O F --- 2008-08-12 06:45:51

salut

refais un scan hijackthis et post le rapport stp