Your computer is infected

malou -  
ludsfa Messages postés 1287 Statut Membre -
Bonjour,
j'ai un virus ds mon pc ( your computer is infected)
j'ai fait la procedure smitfraudfix
mais le pb persiste
voici le rapport
SmitFraudFix v2.347

Rapport fait à 17:17:11.75, 09-09-2008
Executé à partir de C:\Documents and Settings\user\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\windows\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\WinCtrl32.dll détecté, utilisez un scanner de Rootkit

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\user\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="c:\\windows\\system32\\userinit.exe"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

salutations
A voir également:

10 réponses

Réponse 1 / 10
ludsfa Messages postés 1287 Statut Membre 15
 
salut malou,

Sélectionne l'intégralité du texte en gras ci-dessous.



file::
C:\FOUND.000
C:\FOUND.001
C:\FOUND.002
C:\WINDOWS\gmer.ini
C:\WINDOWS\system32\BlockedCookies
C:\WINDOWS\system32\10004.sks
C:\WINDOWS\system32\10001.sks
C:\WINDOWS\system32\10002.sks


folder::
C:\Documents and Settings\user\S87ekhV.exe
C:\Documents and Settings\All Users\Application Data\kfulyrgv
C:\Program Files\SpyRemover Pro C:\WINDOWS\system32\10003.sks
C:\Documents and Settings\user\Application Data\Simply Super Software
C:\Program Files\Trojan Remover


registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"LTXA09sMbw"=-
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
@=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
@=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
@=-





* Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
* Enregistre le sous sur ton bureau sous le nom de CFScript.txt
* Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

http://i266.photobucket.com/albums/ii277/sUBs_/CFScript.gif

* Cela va relancer Combofix.


Un rapport va être créer envois le moi.
1
Réponse 2 / 10
malou
 
une precision
j'obtiens ce rapport en cochant toutes les cases
mais on laissant les cases (services et files) j'obtient rien par le scan
0
Réponse 3 / 10
malou
 
j'ai pas compris comment fonnctionne combofix
0
Réponse 4 / 10
malou
 
ComboFix 08-09-12.09 - user 2008-09-13 16:23:10.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.75 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\user\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RةCUPةRATION N'EST PAS INSTALLةE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\~.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\DelSelf.bat
C:\WINDOWS\system32\drivers\atmapi.sys
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pla.ax
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\shell31.dll
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\WinCtrl32.dl_
C:\WINDOWS\system32\WinCtrl32.dll
C:\WINDOWS\system32\winivstr.exe
C:\WINDOWS\system32\wpcap.dll
C:\WINDOWS\system32\wpx63.cpx
C:\WINDOWS\wiaservb.log
F:\CNAS TARIF.pif

----- BITS: Il y a peut-ˆtre des sites infect‚s -----

http://ygsondheks.info
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF
-------\Service_poof


((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-13 au 2008-09-13 ))))))))))))))))))))))))))))))))))))
.

2008-09-13 13:24 . 2008-09-13 13:24 <REP> d--hs---- C:\FOUND.002
2008-09-13 13:05 . 2008-09-13 13:05 <REP> d--hs---- C:\FOUND.001
2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\user\Application Data\Grisoft
2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-11 17:35 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-09-11 16:41 . 2008-09-11 16:41 <REP> d-------- C:\Program Files\Trend Micro
2008-09-10 18:06 . 2008-09-11 16:50 250 --a------ C:\WINDOWS\gmer.ini
2008-09-09 17:16 . 2008-09-09 17:16 73,728 --a------ C:\WINDOWS\system32\drivers\796.exe
2008-09-09 16:46 . 2008-09-09 16:46 73,728 --a------ C:\WINDOWS\system32\drivers\203.exe
2008-09-09 15:59 . 2008-09-09 17:17 2,640 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-09 14:48 . 2008-09-09 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\xqzaryhe
2008-09-09 13:57 . 2008-09-09 13:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-09-09 13:57 . 2008-09-09 14:00 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-09-09 13:56 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-09-09 13:56 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-09-09 13:56 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\Program Files\Zone Labs
2008-09-09 13:54 . 2008-09-09 13:54 <REP> d-------- C:\WINDOWS\Internet Logs
2008-09-09 12:21 . 2008-09-09 12:21 73,728 --a------ C:\WINDOWS\system32\drivers\968.exe
2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Documents and Settings\user\Application Data\Simply Super Software
2008-09-08 14:42 . 2008-09-08 14:42 <REP> d-------- C:\Program Files\a-squared Free
2008-09-08 14:08 . 2008-09-08 14:08 130 --a------ C:\Documents and Settings\user\delself.bat
2008-09-08 13:53 . 2008-09-08 13:53 249,856 --a------ C:\WINDOWS\system32\nvrsol32.dll.vir
2008-09-08 13:15 . 2008-09-08 13:15 2,840,059 --a------ C:\WINDOWS\system32\SRPSig.zip
2008-09-08 13:15 . 2008-09-08 13:15 870,601 --a------ C:\WINDOWS\system32\SRPExe.zip
2008-09-08 13:12 . 2008-09-08 13:12 421 --a------ C:\WINDOWS\system32\10002.sks
2008-09-08 13:12 . 2008-09-08 13:12 97 --a------ C:\WINDOWS\system32\10001.sks
2008-09-08 13:12 . 2008-09-08 13:15 72 --a------ C:\WINDOWS\system32\SRPVer.ini
2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10004.sks
2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10003.sks
2008-09-08 13:11 . 2008-09-08 13:17 2,380 --a------ C:\WINDOWS\system32\BlockedCookies
2008-09-08 13:10 . 2008-09-08 13:10 <REP> d-------- C:\Program Files\SpyRemover Pro
2008-09-08 12:26 . 2008-09-08 12:27 313,474 --a------ C:\WINDOWS\system32\winivstr.exe.vir
2008-09-08 12:25 . 2008-09-08 12:25 <REP> d--hs---- C:\FOUND.000
2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\srv
2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\{e0e899ab-f487-11d5-8d29-0050ba6940e3}
2008-09-07 16:26 . 2008-09-07 16:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\kfulyrgv
2008-09-07 16:26 . 2008-09-07 16:26 98,816 --a------ C:\WINDOWS\system32\r4h.e33
2008-09-07 16:26 . 2008-09-07 16:26 64,000 --a------ C:\WINDOWS\system32\fds.i386
2008-09-07 16:26 . 2008-09-07 16:26 42,496 --a------ C:\WINDOWS\system32\drivers\656.exe
2008-09-07 16:26 . 2008-09-07 16:26 29,184 --a------ C:\WINDOWS\iexplorer.exe.vir
2008-09-07 16:26 . 2008-09-07 16:26 21,504 --a------ C:\WINDOWS\system32\sof.586
2008-09-07 16:26 . 2008-09-07 16:28 32 --a-s---- C:\WINDOWS\system32\2633133696.dat
2008-09-07 16:25 . 2008-09-07 16:25 55,063 --a------ C:\Documents and Settings\user\S87ekhV.exe
2008-08-31 13:54 . 2008-08-31 13:54 <REP> d-------- C:\Program Files\Fichiers communs\Adobe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\user32.DLL
2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
2008-08-25 17:13 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-06-21 12:10 8,813,777 ----a-w C:\WINDOWS\system32\SRPRSig.dll
2008-06-21 12:09 6,538,067 ----a-w C:\WINDOWS\system32\SRPFSig.dll
2008-06-21 12:08 623,157 ----a-w C:\WINDOWS\system32\SRPESig.dll
2004-09-03 08:32 3,488 ----a-w C:\WINDOWS\inf\OTHER\CMIAINFO.SYS
2007-01-01 13:28 220 --sha-w C:\WINDOWS\dwin.sys
.
[color=red] C:\WINDOWS\system32\user32.dll ... is infected !! (additional data below) [/color]
578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\user32.DLL
578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\dllcache\user32.dll


------- Sigcheck -------

2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\user32.DLL
2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-07-16 4670704]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-02-24 185896]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2007-09-13 77824]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"LTXA09sMbw"="C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe" [2008-09-09 73728]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"F:\\eMule\\emule.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-12-01 117785]
S0 Winag27;Winag27;C:\WINDOWS\system32\Drivers\Winag27.sys [ ]
S0 Windj38;Windj38;C:\WINDOWS\system32\Drivers\Windj38.sys [ ]
S0 Windj84;Windj84;C:\WINDOWS\system32\Drivers\Windj84.sys [ ]
S0 Windl84;Windl84;C:\WINDOWS\system32\Drivers\Windl84.sys [ ]
S0 Winfk16;Winfk16;C:\WINDOWS\system32\Drivers\Winfk16.sys [ ]
S0 Winfl16;Winfl16;C:\WINDOWS\system32\Drivers\Winfl16.sys [ ]
S0 Winfl40;Winfl40;C:\WINDOWS\system32\Drivers\Winfl40.sys [ ]
S0 Wingm05;Wingm05;C:\WINDOWS\system32\Drivers\Wingm05.sys [ ]
S0 Winio30;Winio30;C:\WINDOWS\system32\Drivers\Winio30.sys [ ]
S0 Winkq27;Winkq27;C:\WINDOWS\system32\Drivers\Winkq27.sys [ ]
S0 Winkq84;Winkq84;C:\WINDOWS\system32\Drivers\Winkq84.sys [ ]
S0 Winms05;Winms05;C:\WINDOWS\system32\Drivers\Winms05.sys [ ]
S0 Winms38;Winms38;C:\WINDOWS\system32\Drivers\Winms38.sys [ ]
S0 Winms40;Winms40;C:\WINDOWS\system32\Drivers\Winms40.sys [ ]
S0 Winnt62;Winnt62;C:\WINDOWS\system32\Drivers\Winnt62.sys [ ]
S0 Winov05;Winov05;C:\WINDOWS\system32\Drivers\Winov05.sys [ ]
S0 Winvc62;Winvc62;C:\WINDOWS\system32\Drivers\Winvc62.sys [ ]
S0 Winwd30;Winwd30;C:\WINDOWS\system32\Drivers\Winwd30.sys [ ]
S0 Winxe63;Winxe63;C:\WINDOWS\system32\Drivers\Winxe63.sys [ ]
S2 E2ECAP;e2eCap - WDM Video Capture;C:\WINDOWS\system32\DRIVERS\e2ecap.sys [2006-07-10 124416]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57e52f3c-f9b1-11dc-ac10-007304430c3e}]
\Shell\AutoRun\command - H:\juok3st.bat
\Shell\explore\Command - H:\juok3st.bat
\Shell\open\Command - H:\juok3st.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8eb66220-8fa7-11dc-ab6f-007304430c3e}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af67f332-2259-11dc-aa72-007304430c3e}]
\Shell\AutoRun\command - H:\RavMon.exe
\Shell\explore\Command - H:\RavMon.exe -e
\Shell\open\Command - H:\RavMon.exe

*Newly Created Service* - RPCSSVSS
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-SpyRemoverPro - C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
HKLM-Run-Cmaudio - cmicnfg.cpl


.
------- Examen suppl‚mentaire -------
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 -: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
.
------- File Associations (Beta) -------
.
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-13 16:37:25
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Recherche de processus cach‚s ...

Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

Recherche de fichiers cach‚s ...

Scan termin‚ avec succٹs
Fichiers cach‚s: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITSUMWdf]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserLmHosts]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CiSvcAudioSrv]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MDMSchedule]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MessengerProtectedStorage]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdmwuauserv]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netlogonmnmsrvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaMcAfeeFramework]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetection]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetectionCOMSysApp]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrdmserver]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsusnjsvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsVSS]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonBrowserLmHosts]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonThemes]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrkWksNetDDE]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\upnphostMessengerProtectedStorage]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPSTermService]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSNWmiApSrvImapiService]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrvImapiService]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wuauservRemoteAccess]
"ImagePath"=" srv"
.
--------------------- DLLs charg‚es dans les processus actifs ---------------------

PROCESSUS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\NavLogon.dll
.
------------------------ Autres processus actifs ------------------------
.
C:\PROGRAM FILES\A-SQUARED FREE\A2SERVICE.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2008-09-13 16:42:06 - La machine a red‚marr‚ [user]
ComboFix-quarantined-files.txt 2008-09-13 14:41:54

Avant-CF: 5,793,849,344 octets libres
Après-CF: 5,754,134,528 octets libres

302
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 10
malou
 
ComboFix 08-09-12.09 - user 2008-09-13 16:23:10.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.75 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\user\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RةCUPةRATION N'EST PAS INSTALLةE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\~.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\DelSelf.bat
C:\WINDOWS\system32\drivers\atmapi.sys
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pla.ax
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\shell31.dll
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\WinCtrl32.dl_
C:\WINDOWS\system32\WinCtrl32.dll
C:\WINDOWS\system32\winivstr.exe
C:\WINDOWS\system32\wpcap.dll
C:\WINDOWS\system32\wpx63.cpx
C:\WINDOWS\wiaservb.log
F:\CNAS TARIF.pif

----- BITS: Il y a peut-ˆtre des sites infect‚s -----

http://ygsondheks.info
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF
-------\Service_poof


((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-13 au 2008-09-13 ))))))))))))))))))))))))))))))))))))
.

2008-09-13 13:24 . 2008-09-13 13:24 <REP> d--hs---- C:\FOUND.002
2008-09-13 13:05 . 2008-09-13 13:05 <REP> d--hs---- C:\FOUND.001
2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\user\Application Data\Grisoft
2008-09-11 17:35 . 2008-09-11 17:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-09-11 17:35 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-09-11 16:41 . 2008-09-11 16:41 <REP> d-------- C:\Program Files\Trend Micro
2008-09-10 18:06 . 2008-09-11 16:50 250 --a------ C:\WINDOWS\gmer.ini
2008-09-09 17:16 . 2008-09-09 17:16 73,728 --a------ C:\WINDOWS\system32\drivers\796.exe
2008-09-09 16:46 . 2008-09-09 16:46 73,728 --a------ C:\WINDOWS\system32\drivers\203.exe
2008-09-09 15:59 . 2008-09-09 17:17 2,640 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-09 14:48 . 2008-09-09 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\xqzaryhe
2008-09-09 13:57 . 2008-09-09 13:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-09-09 13:57 . 2008-09-09 14:00 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-09-09 13:56 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-09-09 13:56 . 2008-07-09 09:05 42,384 --a------ C:\WINDOWS\zllsputility_loc040c.dll
2008-09-09 13:56 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-09-09 13:55 . 2008-09-09 13:55 <REP> d-------- C:\Program Files\Zone Labs
2008-09-09 13:54 . 2008-09-09 13:54 <REP> d-------- C:\WINDOWS\Internet Logs
2008-09-09 12:21 . 2008-09-09 12:21 73,728 --a------ C:\WINDOWS\system32\drivers\968.exe
2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Program Files\Trojan Remover
2008-09-09 12:05 . 2008-09-09 12:05 <REP> d-------- C:\Documents and Settings\user\Application Data\Simply Super Software
2008-09-08 14:42 . 2008-09-08 14:42 <REP> d-------- C:\Program Files\a-squared Free
2008-09-08 14:08 . 2008-09-08 14:08 130 --a------ C:\Documents and Settings\user\delself.bat
2008-09-08 13:53 . 2008-09-08 13:53 249,856 --a------ C:\WINDOWS\system32\nvrsol32.dll.vir
2008-09-08 13:15 . 2008-09-08 13:15 2,840,059 --a------ C:\WINDOWS\system32\SRPSig.zip
2008-09-08 13:15 . 2008-09-08 13:15 870,601 --a------ C:\WINDOWS\system32\SRPExe.zip
2008-09-08 13:12 . 2008-09-08 13:12 421 --a------ C:\WINDOWS\system32\10002.sks
2008-09-08 13:12 . 2008-09-08 13:12 97 --a------ C:\WINDOWS\system32\10001.sks
2008-09-08 13:12 . 2008-09-08 13:15 72 --a------ C:\WINDOWS\system32\SRPVer.ini
2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10004.sks
2008-09-08 13:12 . 2008-09-08 13:12 0 --a------ C:\WINDOWS\system32\10003.sks
2008-09-08 13:11 . 2008-09-08 13:17 2,380 --a------ C:\WINDOWS\system32\BlockedCookies
2008-09-08 13:10 . 2008-09-08 13:10 <REP> d-------- C:\Program Files\SpyRemover Pro
2008-09-08 12:26 . 2008-09-08 12:27 313,474 --a------ C:\WINDOWS\system32\winivstr.exe.vir
2008-09-08 12:25 . 2008-09-08 12:25 <REP> d--hs---- C:\FOUND.000
2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\srv
2008-09-07 16:34 . 2004-08-04 04:55 25,088 --a------ C:\WINDOWS\system32\{e0e899ab-f487-11d5-8d29-0050ba6940e3}
2008-09-07 16:26 . 2008-09-07 16:26 <REP> d-------- C:\Documents and Settings\All Users\Application Data\kfulyrgv
2008-09-07 16:26 . 2008-09-07 16:26 98,816 --a------ C:\WINDOWS\system32\r4h.e33
2008-09-07 16:26 . 2008-09-07 16:26 64,000 --a------ C:\WINDOWS\system32\fds.i386
2008-09-07 16:26 . 2008-09-07 16:26 42,496 --a------ C:\WINDOWS\system32\drivers\656.exe
2008-09-07 16:26 . 2008-09-07 16:26 29,184 --a------ C:\WINDOWS\iexplorer.exe.vir
2008-09-07 16:26 . 2008-09-07 16:26 21,504 --a------ C:\WINDOWS\system32\sof.586
2008-09-07 16:26 . 2008-09-07 16:28 32 --a-s---- C:\WINDOWS\system32\2633133696.dat
2008-09-07 16:25 . 2008-09-07 16:25 55,063 --a------ C:\Documents and Settings\user\S87ekhV.exe
2008-08-31 13:54 . 2008-08-31 13:54 <REP> d-------- C:\Program Files\Fichiers communs\Adobe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\user32.DLL
2008-09-07 14:26 578,048 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
2008-08-25 17:13 26 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-06-21 12:10 8,813,777 ----a-w C:\WINDOWS\system32\SRPRSig.dll
2008-06-21 12:09 6,538,067 ----a-w C:\WINDOWS\system32\SRPFSig.dll
2008-06-21 12:08 623,157 ----a-w C:\WINDOWS\system32\SRPESig.dll
2004-09-03 08:32 3,488 ----a-w C:\WINDOWS\inf\OTHER\CMIAINFO.SYS
2007-01-01 13:28 220 --sha-w C:\WINDOWS\dwin.sys
.
[color=red] C:\WINDOWS\system32\user32.dll ... is infected !! (additional data below) [/color]
578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\user32.DLL
578,048 2008-09-07 14:26:32 C:\WINDOWS\system32\dllcache\user32.dll


------- Sigcheck -------

2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\user32.DLL
2008-09-07 16:26 578048 e7889e529904597373304d4fcfe25429 C:\WINDOWS\system32\dllcache\user32.dll

2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
2004-08-04 03:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-07-16 4670704]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-02-24 185896]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2007-09-13 77824]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"LTXA09sMbw"="C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe" [2008-09-09 73728]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winag27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj38.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windj84.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Windl84.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfk16.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl16.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winfl40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wingm05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winio30.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkq84.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms38.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winms40.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winnt62.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winov05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winvc62.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winwd30.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxe63.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"F:\\eMule\\emule.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-12-01 117785]
S0 Winag27;Winag27;C:\WINDOWS\system32\Drivers\Winag27.sys [ ]
S0 Windj38;Windj38;C:\WINDOWS\system32\Drivers\Windj38.sys [ ]
S0 Windj84;Windj84;C:\WINDOWS\system32\Drivers\Windj84.sys [ ]
S0 Windl84;Windl84;C:\WINDOWS\system32\Drivers\Windl84.sys [ ]
S0 Winfk16;Winfk16;C:\WINDOWS\system32\Drivers\Winfk16.sys [ ]
S0 Winfl16;Winfl16;C:\WINDOWS\system32\Drivers\Winfl16.sys [ ]
S0 Winfl40;Winfl40;C:\WINDOWS\system32\Drivers\Winfl40.sys [ ]
S0 Wingm05;Wingm05;C:\WINDOWS\system32\Drivers\Wingm05.sys [ ]
S0 Winio30;Winio30;C:\WINDOWS\system32\Drivers\Winio30.sys [ ]
S0 Winkq27;Winkq27;C:\WINDOWS\system32\Drivers\Winkq27.sys [ ]
S0 Winkq84;Winkq84;C:\WINDOWS\system32\Drivers\Winkq84.sys [ ]
S0 Winms05;Winms05;C:\WINDOWS\system32\Drivers\Winms05.sys [ ]
S0 Winms38;Winms38;C:\WINDOWS\system32\Drivers\Winms38.sys [ ]
S0 Winms40;Winms40;C:\WINDOWS\system32\Drivers\Winms40.sys [ ]
S0 Winnt62;Winnt62;C:\WINDOWS\system32\Drivers\Winnt62.sys [ ]
S0 Winov05;Winov05;C:\WINDOWS\system32\Drivers\Winov05.sys [ ]
S0 Winvc62;Winvc62;C:\WINDOWS\system32\Drivers\Winvc62.sys [ ]
S0 Winwd30;Winwd30;C:\WINDOWS\system32\Drivers\Winwd30.sys [ ]
S0 Winxe63;Winxe63;C:\WINDOWS\system32\Drivers\Winxe63.sys [ ]
S2 E2ECAP;e2eCap - WDM Video Capture;C:\WINDOWS\system32\DRIVERS\e2ecap.sys [2006-07-10 124416]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57e52f3c-f9b1-11dc-ac10-007304430c3e}]
\Shell\AutoRun\command - H:\juok3st.bat
\Shell\explore\Command - H:\juok3st.bat
\Shell\open\Command - H:\juok3st.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8eb66220-8fa7-11dc-ab6f-007304430c3e}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af67f332-2259-11dc-aa72-007304430c3e}]
\Shell\AutoRun\command - H:\RavMon.exe
\Shell\explore\Command - H:\RavMon.exe -e
\Shell\open\Command - H:\RavMon.exe

*Newly Created Service* - RPCSSVSS
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-SpyRemoverPro - C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
HKLM-Run-Cmaudio - cmicnfg.cpl


.
------- Examen suppl‚mentaire -------
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 -: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
.
------- File Associations (Beta) -------
.
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-13 16:37:25
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Recherche de processus cach‚s ...

Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

Recherche de fichiers cach‚s ...

Scan termin‚ avec succٹs
Fichiers cach‚s: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITSUMWdf]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserLmHosts]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CiSvcAudioSrv]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MDMSchedule]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MessengerProtectedStorage]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdmwuauserv]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netlogonmnmsrvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaMcAfeeFramework]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetection]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentShellHWDetectionCOMSysApp]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgrdmserver]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsusnjsvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsVSS]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonBrowserLmHosts]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogonThemes]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrkWksNetDDE]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\upnphostMessengerProtectedStorage]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPSTermService]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSNWmiApSrvImapiService]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrvImapiService]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wuauservRemoteAccess]
"ImagePath"=" srv"
.
--------------------- DLLs charg‚es dans les processus actifs ---------------------

PROCESSUS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\NavLogon.dll
.
------------------------ Autres processus actifs ------------------------
.
C:\PROGRAM FILES\A-SQUARED FREE\A2SERVICE.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2008-09-13 16:42:06 - La machine a red‚marr‚ [user]
ComboFix-quarantined-files.txt 2008-09-13 14:41:54

Avant-CF: 5,793,849,344 octets libres
Après-CF: 5,754,134,528 octets libres

302
0
Réponse 6 / 10
ludsfa Messages postés 1287 Statut Membre 15
 
salut,


Télécharge Gmer:
http://www2.gmer.net/gmer.zip
Dézippe le dans un dossier ou sur ton bureau:
http://www.7-zip.org/fr/

Déconnecte toi d'Internet puis et ferme tous les programmes.
Double-clique sur Gmer.exe.

IMPORTANT: Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.

Clique sur l'onglet rootkit.
A droite, coche Files et Services.
Clique maintenant sur Scan.

Lorsque le scan est terminé, clique sur Copy.

Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et copie/colle le contenu ici.
-1
Réponse 7 / 10
ludsfa Messages postés 1287 Statut Membre 15
 
Bonjour,

Télécharge ComboFix (de sUBs) sur ton Bureau.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
* Double clique sur ComboFix.exe.
* Accepte la licence en cliquant sur Oui.
* Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.


Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

Aide : Comment utiliser ComboFix.
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
-1
malou
 
j'ai pas compris le fonctiionnement de combofix
j'ai fait avec hijack
voici le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:41:46, on 11-09-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\windows\explorer.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=c:\windows\explorer.exe
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [advap32] "C:\DOCUME~1\user\LOCALS~1\Temp\loader.exe" /r
O4 - HKLM\..\Run: [SpyRemoverPro] C:\PROGRA~1\SPYREM~1\SpyRemoverPro.exe
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKLM\..\Policies\Explorer\Run: [LTXA09sMbw] C:\Documents and Settings\All Users\Application Data\xqzaryhe\dapwbozq.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C935A448-A7B1-4F04-885B-12507C6CD6FB}: NameServer = 41.221.20.4 193.251.169.165
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Service de transfert intelligent en arrière-plan BITSUMWdf (BITSUMWdf) - Unknown owner - .exe (file missing)
O23 - Service: Explorateur d'ordinateur BrowserLmHosts (BrowserLmHosts) - Unknown owner - .exe (file missing)
O23 - Service: Service d'indexation CiSvcAudioSrv (CiSvcAudioSrv) - Unknown owner - .exe (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Machine Debug Manager (MDM) - Network Associates, Inc. - (no file)
O23 - Service: Machine Debug Manager MDMSchedule (MDMSchedule) - Unknown owner - .exe (file missing)
O23 - Service: Affichage des messages MessengerProtectedStorage (MessengerProtectedStorage) - Unknown owner - .exe (file missing)
O23 - Service: DSDM DDE réseau NetDDEdsdmwuauserv (NetDDEdsdmwuauserv) - Unknown owner - .exe (file missing)
O23 - Service: Ouverture de session réseau Netlogonmnmsrvc (Netlogonmnmsrvc) - Unknown owner - .exe (file missing)
O23 - Service: NLA (Network Location Awareness) NlaMcAfeeFramework (NlaMcAfeeFramework) - Unknown owner - .exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Services IPSEC PolicyAgentShellHWDetection (PolicyAgentShellHWDetection) - Unknown owner - .exe (file missing)
O23 - Service: Services IPSEC PolicyAgentShellHWDetection PolicyAgentShellHWDetectionCOMSysApp (PolicyAgentShellHWDetectionCOMSysApp) - Unknown owner - .exe (file missing)
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance RDSessMgrdmserver (RDSessMgrdmserver) - Unknown owner - .exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Appel de procédure distante (RPC) RpcSsusnjsvc (RpcSsusnjsvc) - Unknown owner - .exe (file missing)
O23 - Service: Connexion secondaire seclogonThemes (seclogonThemes) - Unknown owner - .exe (file missing)
O23 - Service: Client de suivi de lien distribué TrkWksNetDDE (TrkWksNetDDE) - Unknown owner - .exe (file missing)
O23 - Service: Hôte de périphérique universel Plug-and-Play upnphostMessengerProtectedStorage (upnphostMessengerProtectedStorage) - Unknown owner - .exe (file missing)
O23 - Service: Onduleur UPSTermService (UPSTermService) - Unknown owner - .exe (file missing)
O23 - Service: Carte de performance WMI WmiApSrvImapiService (WmiApSrvImapiService) - Unknown owner - .exe (file missing)
O23 - Service: Mises à jour automatiques wuauservRemoteAccess (wuauservRemoteAccess) - Unknown owner - .exe (file missing)
0
Réponse 8 / 10
ludsfa Messages postés 1287 Statut Membre 15
 
salut malou,


Si tu as passer combofix peux tu m'envoyer le rapport.
-1
Réponse 9 / 10
ludsfa Messages postés 1287 Statut Membre 15
 
salut,





Télécharge ComboFix (de sUBs) sur ton Bureau.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
* Double clique sur ComboFix.exe.
* Accepte la licence en cliquant sur Oui.
* Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.


Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)
-1
malou
 
bonjour
j'ai telechargé combofix
j'ai fait un scan
le message" your computer is infected" a disparu
je pense que tout est reglé
je te remercie
0
Réponse 10 / 10
ludsfa Messages postés 1287 Statut Membre 15
 
salut malou,


peux tu m'envoyer le rapport car il y à certainement des infections que combofix n'à pas supprimé.
-1

Discussions similaires

Spam SMS : your messenger vérification code is ***
Metheor -
Radinoz -

1 réponse
Page bleue : your PC ran into a problem and needs to restart
pitchalou -
Malekal_morte- -

2 réponses
Comment résoudre "The requested URL was rejected"
Cguya -
jeannets -

3 réponses
Sms étranges "... is your instagram code"
Anon_4067 -
lablg23 -

5 réponses
Rtc battery low
Laeti28 -
Laeti28 -

15 réponses