alerte de sécurité windows Résolu/Fermé

Question

Bonjour,

Depuis 3jours je suis infécté par un trojan qui me lance des fausses alertes de sécurité windows ...J'ai lancé malwarebytes, enlevé avast pour mettre antivir, combofix aussi, mais j'ai encore les messages, voici mon rapport hijackthis pour que vous puissiez me dire quoi retirer du pécé, merci d'avance !!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:50:42, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ypmvgpet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\ypmvgpet.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [srvwin] C:\WINDOWS\system32\ypmvgpet.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://by130w.bay130.mail.live.com
O15 - Trusted Zone: www.live.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} - https://www.ntrconnect.com/main/mod/setup/ntractivex118_24.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{949D8D2F-5FB8-4D6E-84FA-2A41158AEF7A}: NameServer = 212.27.53.252,212.27.54.252
O21 - SSODL: ProcUi - {63A3F202-0FC6-FBA7-7EDB-0ACC02AF7911} - C:\Program Files\mcrlkab\ProcUi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

eZula · Answer

Bonjour,

télécharge GenProc http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip sur ton bureau

dézippe le dossier, double-clique sur GenProc.bat [img]http://forum.telecharger.01net.com/forum/[/img] et poste le contenu du rapport qui s'ouvre

Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html

cht · Answer

OK voici le rapport genproc

merci d'avance au fait!

Rapport GenProc 2.019 [1] effectué le 24/08/2008 à 15:12:32,80 - Windows XP  

Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. C'est tout.
 
# Etape 1/ Télécharge :  
  
- Toolbar-S&D (Team IDN) https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 sur ton Bureau. Installe simplement le programme en exécutant le fichier téléchargé. 
 
- MSNFix (!aur3n7) http://sosvirus.changelog.fr/MSNFix.zip et décompresse-le sur le Bureau. 
 
 
***** Copie la suite de la procédure dans un fichier texte et redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ (choisis ta session courante "HP_Administrateur") ***** 
 
 
# Etape 2/ 
 
Relance Toolbar-S&D en double-cliquant sur son raccourci situé sur le Bureau. Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression. Un rapport sera généré.
NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter...", tape explorer puis valide. 
 
# Etape 3/ 
 
Lance le fichier MSNFix.bat qui se trouve dans le dossier MSNfix, sur le bureau.
- Exécute l'option R.
- Si l'infection est détectée, exécute l'option N.
- Sauvegarde ce rapport sur ton bureau. 
 
# Etape 4/ 
 
Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout. 
 
# Etape 5/ 

Redémarre normalement et poste, dans la même réponse : 
- Le contenu du rapport MSNfix situé sur le Bureau ; 
- Le contenu du rapport C:\TB.txt ; 
- Un nouveau rapport HijackThis, http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ; 


Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

eZula · Answer

Vas sur ce site https://www.virustotal.com/gui/
Colle dans la case à gauche de "parcourir" :
C:\WINDOWS\system32\ypmvgpet.exe 
en cours de chargement ...mis en file d'attenteen attenteen cours d'analyse clique ensuite sur "Envoyer le fichier" puis patiente jusqu'à apparition du message "Situation actuelle: terminé " ; copie alors le rapport dans ta réponse.

Recommence avec ce chemin : C:\Program Files\mcrlkab\ProcUi.dll

cht · Answer

voici le premier rapport:

http://www.virustotal.com/fr/analisis/8749ff7bd6810d9c16bfea161ce41f2e

cht · Answer

voici le 2eme resultat:

http://www.virustotal.com/fr/analisis/e3543688e3de7c141aee68133540d5ad

g!rly · Answer

Hé dit donc cht, tu es sur combien de topik en même temps ?

eZula · Answer

Fichier ypmvgpet.exe_ reçu le 2008.08.24 15:16:49 (CET)
Situation actuelle: terminé
Résultat: 4/36 (11.11%)

Fortinet 	3.14.0.0 	2008.08.24 	W32/PolySmall.BP!tr
Microsoft 	1.3807 	2008.08.24 	TrojanDownloader:Win32/FakeAlert.C
Panda 	9.0.0.4 	2008.08.24 	Suspicious file
Prevx1 	V2 	2008.08.24 	Adware

Information additionnelle
File size: 98304 bytes
MD5...: 0671ea24de37ecfa03bb6b51e7dedf09
SHA1..: 07afb83de4fae09bc0076cf50de67e26b7cbdf6a
SHA256: c0c9dee3e0a554104bd4f1c8ea0a83cf92a19ddb2f63e2df86c0d5662c1ba451
SHA512: 0b012fb490583e33010a7277a1b345c966b6663d85a95b12db63bdd976329146
4f7ddf92f3b04ebea758f4668a4787a1396c04b4d192dda05e6fd003d16b65e7
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40216c
timedatestamp.....: 0x48acdac4 (Thu Aug 21 03:02:28 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.ajcv 0x1000 0x14900 0x15000 6.86 da1926b7198a1e206088fcff37f31f38
.gzmxc 0x16000 0x62c 0x1000 2.57 b9a8a7738298e2860e587d6ea4360779
.qisypg 0x17000 0x59d4 0x1000 0.48 5ffa62f0bb3f261f0391561b6bb22565

( 4 imports )
> KERNEL32.dll: GlobalFree, GetProcAddress, LockResource, SetCurrentDirectoryW, CancelWaitableTimer, lstrlenW, GetModuleHandleW, GetCurrentThreadId, VirtualAlloc, ResetEvent, LoadResource, SetLastError, lstrcpyW, FindFirstFileW, GlobalDeleteAtom, LoadLibraryA, GlobalAlloc, SetFilePointer, MoveFileW, FindResourceExW, FreeResource, ResumeThread, DeleteFileW, GetFileSize, FindResourceW, LoadLibraryW
> USER32.dll: FillRect, SystemParametersInfoW, SetLayeredWindowAttributes, DefWindowProcW, RegisterClassExW, GetSysColor, GetKeyState, PostMessageW, SetCursorPos, UpdateWindow, GetWindowDC, DialogBoxParamW, PostQuitMessage, ReleaseCapture, GetWindowTextW, WindowFromPoint, CreateWindowExW, OffsetRect, GetParent, MessageBoxW
> GDI32.dll: SetBkColor, StretchBlt, Rectangle, GetStockObject, DeleteDC, SetDIBits, GetObjectW
> ADVAPI32.dll: RegOpenKeyExW, LookupPrivilegeValueW, RegSetValueExW, GetUserNameW

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=128D4BA1000F7BE380ED01B7BCFBEF00C68F9DE1

=====================================

 Fichier ProcUi.dll_ reçu le 2008.08.24 15:23:54 (CET)
Situation actuelle: terminé
Résultat: 2/36 (5.56%)

AVG 	8.0.0.161 	2008.08.23 	Win32/Heur
Sophos 	4.32.0 	2008.08.24 	Mal/EncPk-DG

Information additionnelle
File size: 102400 bytes
MD5...: e75e9c9c28faca7d3239713b13e06b0d
SHA1..: b430e756e65b3fe5c68f0ff391009e449878ca2d
SHA256: 9e3963f5ed5d52785be2b03ea2bbe427b7a0de55414226e14912a15ee467dde5
SHA512: 40e63860838ffd1dd95d023e85843bdfb88031ba5e5ccbd29cd5b4bc4412759c
9561d0b87baa0367514436430c250192ba99e118aa9b257fcf401223b0105bb3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10001278
timedatestamp.....: 0x48abb36e (Wed Aug 20 06:02:22 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.pmbomp 0x1000 0x13f56 0x14000 6.82 586ce933bd169f46a39a816ebfcc21e1
.ikyfq 0x15000 0x7d3 0x1000 3.18 0bd73a7b11f830532467c13ef3e68654
.vqqmg 0x16000 0x1f3c 0x1000 0.42 4cd0c26bbaae3e7ad114465417e83e59
.reloc 0x18000 0x1942 0x2000 6.00 9fcf7ec9d490d4cc0dd03e9258cf1d93

( 4 imports )
> KERNEL32.dll: GetCurrentThreadId, GlobalAddAtomW, GetCurrentProcessId, FindNextChangeNotification, ResumeThread, ReadProcessMemory, GetModuleHandleW, SetCurrentDirectoryW, GetVersion, GetDriveTypeW, GetCurrentProcess, GetUserDefaultLangID, lstrlenW, SetFilePointer, VirtualFree, SuspendThread, FindNextFileW, FindFirstFileW, WritePrivateProfileStringW, SetEvent, GlobalLock, GetLocalTime, GetModuleFileNameW, GetFileAttributesExW, ResetEvent, QueryDosDeviceW, WriteFile, CreateFileW, FreeResource, WaitForSingleObject, LoadLibraryA, SetEndOfFile, GetProcAddress
> USER32.dll: SetCursor, SetCapture, MessageBoxW, GetParent, GetWindowRect, wsprintfW, TranslateMessage, SendMessageW, RedrawWindow, SetWindowTextW, LoadStringW, SystemParametersInfoW, IsDlgButtonChecked, LoadBitmapW, RegisterClassExW
> GDI32.dll: CreateDCW, LineTo, GetObjectW, CreateBitmap, SetDIBits, BitBlt, GetDeviceCaps, GetClipBox, DPtoLP
> ADVAPI32.dll: RegNotifyChangeKeyValue, StartServiceW, GetUserNameW, RegQueryValueExW, RegCreateKeyExW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegSetValueExW

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer

1. Vas sur ce site http://siri.urz.free.fr/upload
"Lien vers le message du forum où le fichier a été demandé:" colle l'adresse de cette page
"Fichier:" -> colle ce chemin en gras C:\WINDOWS\system32\ypmvgpet.exe et clique sur "upload"
Recommence avec l'autre : C:\Program Files\mcrlkab\ProcUi.dll 
Si tu obtiens un message "La taille du fichier ne doit pas excéder 600Ko, procède de la même manière ici http://secubox.gateweb.org/mad.php

2. Réalise la manip GenProc

3. Télécharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe combofix (sUBs) sur ton Bureau
[*] Double clique combofix.exe[
[*] Tape sur la touche Y (Yes) pour démarrer le scan.
[*] Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

Le rapport se trouve également ici : C:Combofix.txt

cht · Answer

désolé j'ai recu les deux reponses en meme temps donc je ne suis que cette procedure là, je n'en suivrais pas 2 en meme temps pas de soucis

g!rly · Answer

Ok, comme tu veux, j´avais ecrit le script sur l´autre topik...
C´est bien beau d´utiliser combofix, mais il ne va rien supprimer sans script...

eZula · Answer

Ou est l'autre post ?

cht · Answer

voici le rapport combofix:

ComboFix 08-08-23.03 - HP_Administrateur 2008-08-24 15:36:26.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1361 [GMT 2:00]
Endroit: C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-07-24 to 2008-08-24 ))))))))))))))))))))))))))))))))))))
.

2008-08-22 20:26 . 2008-08-22 20:28 <REP> d-a--c--- C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-22 15:18 . 2008-08-22 15:18 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-08-22 15:07 . 2008-08-22 15:07 <REP> d----c--- C:\Program Files\CCleaner
2008-08-22 13:35 . 2008-08-22 13:35 <REP> d----c--- C:\Program Files\Avira
2008-08-22 13:35 . 2008-08-22 13:35 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Avira
2008-08-21 22:26 . 2008-08-22 09:51 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\.housecall6.6
2008-08-21 20:59 . 2008-08-21 20:59 <REP> d----c--- C:\Program Files\Lavasoft
2008-08-21 20:59 . 2008-08-21 20:59 <REP> d----c--- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-21 20:59 . 2008-08-21 21:00 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-21 07:57 . 2008-08-21 08:03 2,530 --a--c--- C:\WINDOWS\system32\tmp.reg
2008-08-21 07:54 . 2008-08-21 07:54 <REP> d----c--- C:\_OTMoveIt
2008-08-21 07:47 . 2008-08-21 07:47 98,304 --a--c--- C:\WINDOWS\system32\ypmvgpet.exe
2008-08-21 07:29 . 2008-08-21 07:29 <REP> d----c--- C:\Program Files\Trend Micro
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\Malwarebytes
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 00:08 . 2008-08-17 15:01 38,472 --a--c--- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 00:08 . 2008-08-17 15:01 17,144 --a--c--- C:\WINDOWS\system32\drivers\mbam.sys
2008-08-20 08:14 . 2008-08-20 08:14 <REP> d----c--- C:\Program Files\mcrlkab
2008-08-20 08:14 . 2008-08-20 08:14 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\nkvuvodw
2008-08-12 23:37 . 2008-08-13 08:06 <REP> d----c--- C:\Program Files\Free Video Converter
2008-08-09 18:33 . 2008-08-09 18:33 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\dvdcss
2008-08-01 04:57 . 2008-08-01 04:57 <REP> d----c--- C:\Program Files\Sun
2008-08-01 04:57 . 2008-06-10 02:32 73,728 --a--c--- C:\WINDOWS\system32\javacpl.cpl
2008-07-31 10:09 . 2005-02-24 12:10 2,084,864 --a--c--- C:\WINDOWS\system32\AudDesign.dll
2008-07-31 10:09 . 2005-03-11 17:37 1,986,560 --a--c--- C:\WINDOWS\system32\AudFile.dll
2008-07-31 10:09 . 2005-02-24 12:11 1,212,416 --a--c--- C:\WINDOWS\system32\AudioInfos.dll
2008-07-31 10:09 . 2005-02-24 12:11 479,232 --a--c--- C:\WINDOWS\system32\AudioVisu.dll
2008-07-31 10:09 . 2005-02-24 15:21 458,752 --a--c--- C:\WINDOWS\system32\AudPlayer.dll
2008-07-31 10:09 . 2005-03-10 16:00 454,656 --a--c--- C:\WINDOWS\system32\AudioRecord.dll
2008-07-31 10:09 . 2005-02-24 12:10 417,792 --a--c--- C:\WINDOWS\system32\AudDisplay.dll
2008-07-31 10:09 . 2005-02-24 11:51 348,160 --a--c--- C:\WINDOWS\system32\WMAFile.dll
2008-07-31 10:09 . 2003-08-07 15:01 237,568 --a--c--- C:\WINDOWS\system32\lame_enc.dll
2008-07-31 10:09 . 2005-01-10 12:54 116,296 --a--c--- C:\WINDOWS\system32\NCTWMAProfiles.prx
2008-07-30 15:05 . 2008-07-30 15:05 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\Samsung
2008-07-30 15:01 . 2006-05-03 22:53 174,592 --a--c--- C:\WINDOWS\system32\framedyn.dll
2008-07-30 15:00 . 2006-07-24 16:05 5,632 --a--c--- C:\WINDOWS\system32\drivers\StarOpen.sys
2008-07-30 14:55 . 2008-07-30 15:00 <REP> d----c--- C:\WINDOWS\system32\Samsung_USB_Drivers
2008-07-30 14:55 . 2008-07-30 14:55 <REP> d----c--- C:\Program Files\Samsung
2008-07-30 14:55 . 2005-08-30 01:49 94,000 --a--c--- C:\WINDOWS\system32\drivers\ssm_mdm.sys
2008-07-30 14:55 . 2005-08-30 01:47 58,320 --a--c--- C:\WINDOWS\system32\drivers\ssm_bus.sys
2008-07-30 14:55 . 2005-08-30 01:49 8,336 --a--c--- C:\WINDOWS\system32\drivers\ssm_mdfl.sys
2008-07-30 14:55 . 2005-08-30 01:49 6,176 --a--c--- C:\WINDOWS\system32\drivers\ssm_cmnt.sys
2008-07-30 14:55 . 2005-08-30 01:49 6,176 --a--c--- C:\WINDOWS\system32\drivers\ssm_cm.sys
2008-07-30 14:55 . 2005-08-30 01:47 5,840 --a--c--- C:\WINDOWS\system32\drivers\ssm_whnt.sys
2008-07-30 14:55 . 2005-08-30 01:47 5,840 --a--c--- C:\WINDOWS\system32\drivers\ssm_wh.sys
2008-07-30 14:55 . 2005-08-28 20:51 766 --a--c--- C:\WINDOWS\system32\Uninstall.ico

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-24 10:20 --------- dc----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-22 13:07 --------- dc----w C:\Program Files\Yahoo!
2008-08-22 10:45 --------- dc----w C:\Program Files\BeClean
2008-08-20 06:28 --------- dc----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-08-17 15:35 10,856 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-08-15 04:20 --------- dc----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-13 05:59 --------- dc----w C:\Program Files\Fichiers communs\Adobe
2008-08-13 05:58 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\AdobeUM
2008-08-09 15:53 --------- dc----w C:\Program Files\Google
2008-08-01 02:57 --------- dc----w C:\Program Files\Java
2008-07-31 08:09 --------- dc----w C:\Program Files\Free Audio Pack
2008-07-30 14:44 --------- dc----w C:\Program Files\Everest Poker
2008-07-30 13:00 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-07-18 20:10 94,920 -c--a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 -c--a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 -c--a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 -c--a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 -c--a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 -c--a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 -c--a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 -c--a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 -c--a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 -c--a-w C:\WINDOWS\system32\muweb.dll
2008-07-16 16:59 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\MahJong Suite
2008-07-10 21:25 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\ntr
2008-07-10 20:54 --------- dc----w C:\Program Files\MahJong Suite
2008-07-10 20:54 --------- dc----w C:\Documents and Settings\All Users\Application Data\TreeCardGames
2008-07-07 21:26 --------- dc----w C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-07-07 20:31 253,952 -c--a-w C:\WINDOWS\system32\es.dll
2008-06-28 17:24 --------- dc----w C:\Program Files\Fichiers communs\Real
2008-06-24 16:23 74,240 -c--a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:15 671,232 -c--a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 247,808 -c--a-w C:\WINDOWS\system32\mswsock.dll
2007-04-05 21:39 87,608 -c--a-w C:\Documents and Settings\HP_Administrateur\Application Data\ezpinst.exe
2007-04-05 21:39 47,360 -c--a-w C:\Documents and Settings\HP_Administrateur\Application Data\pcouffin.sys
2006-10-20 18:38 251 -c--a-w C:\Program Files\wt3d.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-22 20:08 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2007-02-05 05:05 4354048]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"srvwin"="C:\WINDOWS\system32\ypmvgpet.exe" [2008-08-21 07:47 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 21:34 64512]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 15:15 151552]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-28 09:47 7573504]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 23:14 237568]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 23:34 249856]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 03:23 663552]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 159744]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2007-12-06 12:58 1069920]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"ftutil2"="ftutil2.dll" [2004-06-07 14:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"nwiz"="nwiz.exe" [2006-04-28 09:47 1519616 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-14 05:05 16239616 C:\WINDOWS\RTHDCPL.EXE]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-01 13:33:00 110592]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-07-21 18:05:35 805392]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-26 01:34:59 124400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ProcUi"= {63A3F202-0FC6-FBA7-7EDB-0ACC02AF7911} - C:\Program Files\mcrlkab\ProcUi.dll [2008-08-20 08:14 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"9845:TCP"= 9845:TCP:BitComet 9845 TCP
"9845:UDP"= 9845:UDP:BitComet 9845 UDP
"28521:TCP"= 28521:TCP:port de utorrent
"6346:TCP"= 6346:TCP:g2
"6346:UDP"= 6346:UDP:g2udp
"2979:TCP"= 2979:TCP:g1tcp
"2979:UDP"= 2979:UDP:giudp

R0 IABFilt;Iomega Snapshot Volume Filter;C:\WINDOWS\system32\DRIVERS\IABFilt.sys [2005-07-01 11:15]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 00:53]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-04-12 05:36]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fdb0342-571d-11dc-bed5-001731f80782}]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f252447c-58d3-11dc-beda-001731f80782}]
\Shell\AutoRun\command - W:\RunGame.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

2008-08-16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\7exmabwv.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.windowslive.fr/hotmail/demo/default.asp|http://by130w.bay130.mail.live.com/mail/InboxLight.aspx?n=482154123|http://by130w.bay130.mail.live.com/mail/InboxLight.aspx?FolderID=00000000-0000-0000-0000-000000000001&n=352993303
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1172.2021\npCIDetect11.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-24 15:37:21
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-08-24 15:40:41
ComboFix-quarantined-files.txt 2008-08-24 13:39:39
ComboFix2.txt 2008-08-24 13:06:32
ComboFix3.txt 2008-08-24 12:36:07
ComboFix4.txt 2008-08-22 10:57:53

Pre-Run: 127,233,769,472 octets libres
Post-Run: 127,218,249,728 octets libres

223 --- E O F --- 2008-08-15 04:21:09

cht · Answer

voici le rapport combofix:

ComboFix 08-08-23.03 - HP_Administrateur 2008-08-24 15:36:26.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1361 [GMT 2:00]
Endroit: C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-07-24 to 2008-08-24 ))))))))))))))))))))))))))))))))))))
.

2008-08-22 20:26 . 2008-08-22 20:28 <REP> d-a--c--- C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-22 15:18 . 2008-08-22 15:18 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-08-22 15:07 . 2008-08-22 15:07 <REP> d----c--- C:\Program Files\CCleaner
2008-08-22 13:35 . 2008-08-22 13:35 <REP> d----c--- C:\Program Files\Avira
2008-08-22 13:35 . 2008-08-22 13:35 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Avira
2008-08-21 22:26 . 2008-08-22 09:51 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\.housecall6.6
2008-08-21 20:59 . 2008-08-21 20:59 <REP> d----c--- C:\Program Files\Lavasoft
2008-08-21 20:59 . 2008-08-21 20:59 <REP> d----c--- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-21 20:59 . 2008-08-21 21:00 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-21 07:57 . 2008-08-21 08:03 2,530 --a--c--- C:\WINDOWS\system32\tmp.reg
2008-08-21 07:54 . 2008-08-21 07:54 <REP> d----c--- C:\_OTMoveIt
2008-08-21 07:47 . 2008-08-21 07:47 98,304 --a--c--- C:\WINDOWS\system32\ypmvgpet.exe
2008-08-21 07:29 . 2008-08-21 07:29 <REP> d----c--- C:\Program Files\Trend Micro
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\Malwarebytes
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 00:08 . 2008-08-17 15:01 38,472 --a--c--- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 00:08 . 2008-08-17 15:01 17,144 --a--c--- C:\WINDOWS\system32\drivers\mbam.sys
2008-08-20 08:14 . 2008-08-20 08:14 <REP> d----c--- C:\Program Files\mcrlkab
2008-08-20 08:14 . 2008-08-20 08:14 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\nkvuvodw
2008-08-12 23:37 . 2008-08-13 08:06 <REP> d----c--- C:\Program Files\Free Video Converter
2008-08-09 18:33 . 2008-08-09 18:33 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\dvdcss
2008-08-01 04:57 . 2008-08-01 04:57 <REP> d----c--- C:\Program Files\Sun
2008-08-01 04:57 . 2008-06-10 02:32 73,728 --a--c--- C:\WINDOWS\system32\javacpl.cpl
2008-07-31 10:09 . 2005-02-24 12:10 2,084,864 --a--c--- C:\WINDOWS\system32\AudDesign.dll
2008-07-31 10:09 . 2005-03-11 17:37 1,986,560 --a--c--- C:\WINDOWS\system32\AudFile.dll
2008-07-31 10:09 . 2005-02-24 12:11 1,212,416 --a--c--- C:\WINDOWS\system32\AudioInfos.dll
2008-07-31 10:09 . 2005-02-24 12:11 479,232 --a--c--- C:\WINDOWS\system32\AudioVisu.dll
2008-07-31 10:09 . 2005-02-24 15:21 458,752 --a--c--- C:\WINDOWS\system32\AudPlayer.dll
2008-07-31 10:09 . 2005-03-10 16:00 454,656 --a--c--- C:\WINDOWS\system32\AudioRecord.dll
2008-07-31 10:09 . 2005-02-24 12:10 417,792 --a--c--- C:\WINDOWS\system32\AudDisplay.dll
2008-07-31 10:09 . 2005-02-24 11:51 348,160 --a--c--- C:\WINDOWS\system32\WMAFile.dll
2008-07-31 10:09 . 2003-08-07 15:01 237,568 --a--c--- C:\WINDOWS\system32\lame_enc.dll
2008-07-31 10:09 . 2005-01-10 12:54 116,296 --a--c--- C:\WINDOWS\system32\NCTWMAProfiles.prx
2008-07-30 15:05 . 2008-07-30 15:05 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\Samsung
2008-07-30 15:01 . 2006-05-03 22:53 174,592 --a--c--- C:\WINDOWS\system32\framedyn.dll
2008-07-30 15:00 . 2006-07-24 16:05 5,632 --a--c--- C:\WINDOWS\system32\drivers\StarOpen.sys
2008-07-30 14:55 . 2008-07-30 15:00 <REP> d----c--- C:\WINDOWS\system32\Samsung_USB_Drivers
2008-07-30 14:55 . 2008-07-30 14:55 <REP> d----c--- C:\Program Files\Samsung
2008-07-30 14:55 . 2005-08-30 01:49 94,000 --a--c--- C:\WINDOWS\system32\drivers\ssm_mdm.sys
2008-07-30 14:55 . 2005-08-30 01:47 58,320 --a--c--- C:\WINDOWS\system32\drivers\ssm_bus.sys
2008-07-30 14:55 . 2005-08-30 01:49 8,336 --a--c--- C:\WINDOWS\system32\drivers\ssm_mdfl.sys
2008-07-30 14:55 . 2005-08-30 01:49 6,176 --a--c--- C:\WINDOWS\system32\drivers\ssm_cmnt.sys
2008-07-30 14:55 . 2005-08-30 01:49 6,176 --a--c--- C:\WINDOWS\system32\drivers\ssm_cm.sys
2008-07-30 14:55 . 2005-08-30 01:47 5,840 --a--c--- C:\WINDOWS\system32\drivers\ssm_whnt.sys
2008-07-30 14:55 . 2005-08-30 01:47 5,840 --a--c--- C:\WINDOWS\system32\drivers\ssm_wh.sys
2008-07-30 14:55 . 2005-08-28 20:51 766 --a--c--- C:\WINDOWS\system32\Uninstall.ico

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-24 10:20 --------- dc----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-22 13:07 --------- dc----w C:\Program Files\Yahoo!
2008-08-22 10:45 --------- dc----w C:\Program Files\BeClean
2008-08-20 06:28 --------- dc----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-08-17 15:35 10,856 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-08-15 04:20 --------- dc----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-13 05:59 --------- dc----w C:\Program Files\Fichiers communs\Adobe
2008-08-13 05:58 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\AdobeUM
2008-08-09 15:53 --------- dc----w C:\Program Files\Google
2008-08-01 02:57 --------- dc----w C:\Program Files\Java
2008-07-31 08:09 --------- dc----w C:\Program Files\Free Audio Pack
2008-07-30 14:44 --------- dc----w C:\Program Files\Everest Poker
2008-07-30 13:00 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-07-18 20:10 94,920 -c--a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 -c--a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 -c--a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 -c--a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 -c--a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 -c--a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 -c--a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 -c--a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 -c--a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 -c--a-w C:\WINDOWS\system32\muweb.dll
2008-07-16 16:59 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\MahJong Suite
2008-07-10 21:25 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\ntr
2008-07-10 20:54 --------- dc----w C:\Program Files\MahJong Suite
2008-07-10 20:54 --------- dc----w C:\Documents and Settings\All Users\Application Data\TreeCardGames
2008-07-07 21:26 --------- dc----w C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-07-07 20:31 253,952 -c--a-w C:\WINDOWS\system32\es.dll
2008-06-28 17:24 --------- dc----w C:\Program Files\Fichiers communs\Real
2008-06-24 16:23 74,240 -c--a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:15 671,232 -c--a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 247,808 -c--a-w C:\WINDOWS\system32\mswsock.dll
2007-04-05 21:39 87,608 -c--a-w C:\Documents and Settings\HP_Administrateur\Application Data\ezpinst.exe
2007-04-05 21:39 47,360 -c--a-w C:\Documents and Settings\HP_Administrateur\Application Data\pcouffin.sys
2006-10-20 18:38 251 -c--a-w C:\Program Files\wt3d.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-22 20:08 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2007-02-05 05:05 4354048]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"srvwin"="C:\WINDOWS\system32\ypmvgpet.exe" [2008-08-21 07:47 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 21:34 64512]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 15:15 151552]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-28 09:47 7573504]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 23:14 237568]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 23:34 249856]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 03:23 663552]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 159744]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2007-12-06 12:58 1069920]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"ftutil2"="ftutil2.dll" [2004-06-07 14:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"nwiz"="nwiz.exe" [2006-04-28 09:47 1519616 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-14 05:05 16239616 C:\WINDOWS\RTHDCPL.EXE]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-01 13:33:00 110592]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-07-21 18:05:35 805392]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-26 01:34:59 124400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ProcUi"= {63A3F202-0FC6-FBA7-7EDB-0ACC02AF7911} - C:\Program Files\mcrlkab\ProcUi.dll [2008-08-20 08:14 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"9845:TCP"= 9845:TCP:BitComet 9845 TCP
"9845:UDP"= 9845:UDP:BitComet 9845 UDP
"28521:TCP"= 28521:TCP:port de utorrent
"6346:TCP"= 6346:TCP:g2
"6346:UDP"= 6346:UDP:g2udp
"2979:TCP"= 2979:TCP:g1tcp
"2979:UDP"= 2979:UDP:giudp

R0 IABFilt;Iomega Snapshot Volume Filter;C:\WINDOWS\system32\DRIVERS\IABFilt.sys [2005-07-01 11:15]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 00:53]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-04-12 05:36]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fdb0342-571d-11dc-bed5-001731f80782}]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f252447c-58d3-11dc-beda-001731f80782}]
\Shell\AutoRun\command - W:\RunGame.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

2008-08-16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\7exmabwv.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.windowslive.fr/hotmail/demo/default.asp|http://by130w.bay130.mail.live.com/mail/InboxLight.aspx?n=482154123|http://by130w.bay130.mail.live.com/mail/InboxLight.aspx?FolderID=00000000-0000-0000-0000-000000000001&n=352993303
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1172.2021\npCIDetect11.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-24 15:37:21
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-08-24 15:40:41
ComboFix-quarantined-files.txt 2008-08-24 13:39:39
ComboFix2.txt 2008-08-24 13:06:32
ComboFix3.txt 2008-08-24 12:36:07
ComboFix4.txt 2008-08-22 10:57:53

Pre-Run: 127,233,769,472 octets libres
Post-Run: 127,218,249,728 octets libres

223 --- E O F --- 2008-08-15 04:21:09

g!rly · Answer

L´autre topik est ici :

http://www.commentcamarche.net/forum/affich 7644912 trojan spy html bankfraud dq#dernier

cht · Answer

je n'avais pas glissé le txt dans combofix, maintenant que c'est fait voici le log de combofix:

ComboFix 08-08-23.03 - HP_Administrateur 2008-08-24 15:47:09.6 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1419 [GMT 2:00]
Endroit: C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Administrateur\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

FILE ::
C:\WINDOWS\system32\ypmvgpet.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\mcrlkab
C:\Program Files\mcrlkab\ProcUi.dll
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb125\res\ErrorPageTemplate.css
C:\Program Files\Search Settings\kb125\res\help.gif
C:\Program Files\Search Settings\kb125\res\pixel.gif
C:\Program Files\Search Settings\kb125\res\tab_icon.png
C:\Program Files\Search Settings\kb125\res\tabdata.js
C:\Program Files\Search Settings\kb125\res\tablib.js
C:\Program Files\Search Settings\kb125\res\tabwelcome_en.html
C:\Program Files\Search Settings\kb125\res\toolbar_background.gif
C:\Program Files\Search Settings\kb125\res\vista_directions.png
C:\Program Files\Search Settings\kb125\res\xp_directions.png
C:\Program Files\Search Settings\kb125\res\yahoo_search.gif
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ypmvgpet.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-24 to 2008-08-24 ))))))))))))))))))))))))))))))))))))
.

2008-08-22 20:26 . 2008-08-22 20:28 <REP> d-a--c--- C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-22 15:18 . 2008-08-22 15:18 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-08-22 15:07 . 2008-08-22 15:07 <REP> d----c--- C:\Program Files\CCleaner
2008-08-22 13:35 . 2008-08-22 13:35 <REP> d----c--- C:\Program Files\Avira
2008-08-22 13:35 . 2008-08-22 13:35 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Avira
2008-08-21 22:26 . 2008-08-22 09:51 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\.housecall6.6
2008-08-21 20:59 . 2008-08-21 20:59 <REP> d----c--- C:\Program Files\Lavasoft
2008-08-21 20:59 . 2008-08-21 20:59 <REP> d----c--- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-21 20:59 . 2008-08-21 21:00 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-21 07:57 . 2008-08-21 08:03 2,530 --a--c--- C:\WINDOWS\system32\tmp.reg
2008-08-21 07:54 . 2008-08-21 07:54 <REP> d----c--- C:\_OTMoveIt
2008-08-21 07:29 . 2008-08-21 07:29 <REP> d----c--- C:\Program Files\Trend Micro
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\Malwarebytes
2008-08-21 00:08 . 2008-08-21 00:08 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 00:08 . 2008-08-17 15:01 38,472 --a--c--- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 00:08 . 2008-08-17 15:01 17,144 --a--c--- C:\WINDOWS\system32\drivers\mbam.sys
2008-08-20 08:14 . 2008-08-20 08:14 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\nkvuvodw
2008-08-12 23:37 . 2008-08-13 08:06 <REP> d----c--- C:\Program Files\Free Video Converter
2008-08-09 18:33 . 2008-08-09 18:33 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\dvdcss
2008-08-01 04:57 . 2008-08-01 04:57 <REP> d----c--- C:\Program Files\Sun
2008-08-01 04:57 . 2008-06-10 02:32 73,728 --a--c--- C:\WINDOWS\system32\javacpl.cpl
2008-07-31 10:09 . 2005-02-24 12:10 2,084,864 --a--c--- C:\WINDOWS\system32\AudDesign.dll
2008-07-31 10:09 . 2005-03-11 17:37 1,986,560 --a--c--- C:\WINDOWS\system32\AudFile.dll
2008-07-31 10:09 . 2005-02-24 12:11 1,212,416 --a--c--- C:\WINDOWS\system32\AudioInfos.dll
2008-07-31 10:09 . 2005-02-24 12:11 479,232 --a--c--- C:\WINDOWS\system32\AudioVisu.dll
2008-07-31 10:09 . 2005-02-24 15:21 458,752 --a--c--- C:\WINDOWS\system32\AudPlayer.dll
2008-07-31 10:09 . 2005-03-10 16:00 454,656 --a--c--- C:\WINDOWS\system32\AudioRecord.dll
2008-07-31 10:09 . 2005-02-24 12:10 417,792 --a--c--- C:\WINDOWS\system32\AudDisplay.dll
2008-07-31 10:09 . 2005-02-24 11:51 348,160 --a--c--- C:\WINDOWS\system32\WMAFile.dll
2008-07-31 10:09 . 2003-08-07 15:01 237,568 --a--c--- C:\WINDOWS\system32\lame_enc.dll
2008-07-31 10:09 . 2005-01-10 12:54 116,296 --a--c--- C:\WINDOWS\system32\NCTWMAProfiles.prx
2008-07-30 15:05 . 2008-07-30 15:05 <REP> d----c--- C:\Documents and Settings\HP_Administrateur\Application Data\Samsung
2008-07-30 15:01 . 2006-05-03 22:53 174,592 --a--c--- C:\WINDOWS\system32\framedyn.dll
2008-07-30 15:00 . 2006-07-24 16:05 5,632 --a--c--- C:\WINDOWS\system32\drivers\StarOpen.sys
2008-07-30 14:55 . 2008-07-30 15:00 <REP> d----c--- C:\WINDOWS\system32\Samsung_USB_Drivers
2008-07-30 14:55 . 2008-07-30 14:55 <REP> d----c--- C:\Program Files\Samsung
2008-07-30 14:55 . 2005-08-30 01:49 94,000 --a--c--- C:\WINDOWS\system32\drivers\ssm_mdm.sys
2008-07-30 14:55 . 2005-08-30 01:47 58,320 --a--c--- C:\WINDOWS\system32\drivers\ssm_bus.sys
2008-07-30 14:55 . 2005-08-30 01:49 8,336 --a--c--- C:\WINDOWS\system32\drivers\ssm_mdfl.sys
2008-07-30 14:55 . 2005-08-30 01:49 6,176 --a--c--- C:\WINDOWS\system32\drivers\ssm_cmnt.sys
2008-07-30 14:55 . 2005-08-30 01:49 6,176 --a--c--- C:\WINDOWS\system32\drivers\ssm_cm.sys
2008-07-30 14:55 . 2005-08-30 01:47 5,840 --a--c--- C:\WINDOWS\system32\drivers\ssm_whnt.sys
2008-07-30 14:55 . 2005-08-30 01:47 5,840 --a--c--- C:\WINDOWS\system32\drivers\ssm_wh.sys
2008-07-30 14:55 . 2005-08-28 20:51 766 --a--c--- C:\WINDOWS\system32\Uninstall.ico

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-24 10:20 --------- dc----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-22 13:07 --------- dc----w C:\Program Files\Yahoo!
2008-08-22 10:45 --------- dc----w C:\Program Files\BeClean
2008-08-20 06:28 --------- dc----w C:\Program Files\DaemonTools_WhenUSave_Installer
2008-08-17 15:35 10,856 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-08-15 04:20 --------- dc----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-13 05:59 --------- dc----w C:\Program Files\Fichiers communs\Adobe
2008-08-13 05:58 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\AdobeUM
2008-08-09 15:53 --------- dc----w C:\Program Files\Google
2008-08-01 02:57 --------- dc----w C:\Program Files\Java
2008-07-31 08:09 --------- dc----w C:\Program Files\Free Audio Pack
2008-07-30 14:44 --------- dc----w C:\Program Files\Everest Poker
2008-07-30 13:00 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-07-18 20:10 94,920 -c--a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 -c--a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 -c--a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 -c--a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 -c--a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 -c--a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 -c--a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 -c--a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 -c--a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 -c--a-w C:\WINDOWS\system32\muweb.dll
2008-07-16 16:59 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\MahJong Suite
2008-07-10 21:25 --------- dc----w C:\Documents and Settings\HP_Administrateur\Application Data\ntr
2008-07-10 20:54 --------- dc----w C:\Program Files\MahJong Suite
2008-07-10 20:54 --------- dc----w C:\Documents and Settings\All Users\Application Data\TreeCardGames
2008-07-07 21:26 --------- dc----w C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-07-07 20:31 253,952 -c--a-w C:\WINDOWS\system32\es.dll
2008-06-28 17:24 --------- dc----w C:\Program Files\Fichiers communs\Real
2008-06-24 16:23 74,240 -c--a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:15 671,232 -c--a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 247,808 -c--a-w C:\WINDOWS\system32\mswsock.dll
2007-04-05 21:39 87,608 -c--a-w C:\Documents and Settings\HP_Administrateur\Application Data\ezpinst.exe
2007-04-05 21:39 47,360 -c--a-w C:\Documents and Settings\HP_Administrateur\Application Data\pcouffin.sys
2006-10-20 18:38 251 -c--a-w C:\Program Files\wt3d.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-22 20:08 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2007-02-05 05:05 4354048]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 21:34 64512]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 15:15 151552]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-28 09:47 7573504]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 23:14 237568]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 23:34 249856]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 03:23 663552]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 159744]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"ftutil2"="ftutil2.dll" [2004-06-07 14:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"nwiz"="nwiz.exe" [2006-04-28 09:47 1519616 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-14 05:05 16239616 C:\WINDOWS\RTHDCPL.EXE]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-01 13:33:00 110592]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-07-21 18:05:35 805392]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-26 01:34:59 124400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\WINDOWS\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"9845:TCP"= 9845:TCP:BitComet 9845 TCP
"9845:UDP"= 9845:UDP:BitComet 9845 UDP
"28521:TCP"= 28521:TCP:port de utorrent
"6346:TCP"= 6346:TCP:g2
"6346:UDP"= 6346:UDP:g2udp
"2979:TCP"= 2979:TCP:g1tcp
"2979:UDP"= 2979:UDP:giudp

R0 IABFilt;Iomega Snapshot Volume Filter;C:\WINDOWS\system32\DRIVERS\IABFilt.sys [2005-07-01 11:15]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 00:53]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-04-12 05:36]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fdb0342-571d-11dc-bed5-001731f80782}]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f252447c-58d3-11dc-beda-001731f80782}]
\Shell\AutoRun\command - W:\RunGame.exe
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

2008-08-16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-24 15:48:05
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

**************************************************************************
.
Temps d'accomplissement: 2008-08-24 15:51:32
ComboFix-quarantined-files.txt 2008-08-24 13:50:30
ComboFix2.txt 2008-08-24 13:40:42
ComboFix3.txt 2008-08-24 13:06:32
ComboFix4.txt 2008-08-24 12:36:07
ComboFix5.txt 2008-08-24 13:46:56

Pre-Run: 127,221,293,056 octets libres
Post-Run: 127,201,366,016 octets libres

228 --- E O F --- 2008-08-15 04:21:09

g!rly · Answer

Ok cht,

Je te laisse en compagnie de Ezula

Bye`

eZula · Answer

cht, continue là-bas http://www.commentcamarche.net/forum/affich 7644912 trojan spy html bankfraud dq#dernier

je préviens la modération

cht · Answer

ok merci pour tout je ne verrais qu'avec ezula ma soluce merci

g!rly · Answer

Bon ce topik est fermé...

Alerte de sécurité windows

18 réponses

Newsletters