Trojan Remover a detecter TDSSserv.sys
Résolu
Bonjour,
j'ai un problème avec mon PC Trojan Remover a détecter TDSSserv.sys comme Rootkit.
j'aimerai supprimer ce dernier avec votre aide pour ça, j'ai installer HijackThis et voila son rapport :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:34:02, on 22/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20861)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lock My PC 4\lockpc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\wamp\wampmanager.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
C:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Startup Faster\sfagent.exe
C:\Program Files\Startup Faster\StrpFstCfg.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Office\OFFICE11\FRONTPG.EXE
C:\Documents and Settings\Hicham\Bureau\ToolsCleaner2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [StartupFaster] "C:\Program Files\Startup Faster\startuploader.exe" -run SFAURUN SFCURUN SFAUSTARTUP SFCUSTARTUP
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: StartupFaster
O4 - Global Startup: StartupFaster
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: fsp_lmwl - C:\WINDOWS\SYSTEM32\fsp_lmwl.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
--
End of file - 6260 bytes
Merci d'avance pour votre aide.
j'ai un problème avec mon PC Trojan Remover a détecter TDSSserv.sys comme Rootkit.
j'aimerai supprimer ce dernier avec votre aide pour ça, j'ai installer HijackThis et voila son rapport :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:34:02, on 22/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20861)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lock My PC 4\lockpc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\wamp\wampmanager.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
C:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Startup Faster\sfagent.exe
C:\Program Files\Startup Faster\StrpFstCfg.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Office\OFFICE11\FRONTPG.EXE
C:\Documents and Settings\Hicham\Bureau\ToolsCleaner2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [StartupFaster] "C:\Program Files\Startup Faster\startuploader.exe" -run SFAURUN SFCURUN SFAUSTARTUP SFCUSTARTUP
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: StartupFaster
O4 - Global Startup: StartupFaster
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: fsp_lmwl - C:\WINDOWS\SYSTEM32\fsp_lmwl.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
--
End of file - 6260 bytes
Merci d'avance pour votre aide.
Configuration: Windows XP SP3 Firefox 3.0.1
13 réponses
-
Modérateur---> Désinstalle HijackThis
---> Supprime ComboFix, CFScript et le dossier Qoobox situé dans C:\
---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download
---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.
---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme
---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php -
ModérateurSalut,
C'est un rootkit tenace.
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\
---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.
Une fois le scan achevé, un rapport va s'afficher : Poste son contenu
/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\
Note : Le rapport se trouve également là : C:\ComboFix.txt -
Salut,
voila j'ai fait exactement ce que vous m'avez demander de faire et le rapport de ComboFix :
ComboFix 08-09-20.05 - Hicham 2008-09-22 1:58:10.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.687 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Hicham\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Hicham\Application Data\Adobe\crc.dat
C:\WINDOWS\eskd.exe
C:\WINDOWS\system32\mmx81669.dll
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-22 au 2008-09-22 ))))))))))))))))))))))))))))))))))))
.
2008-09-22 01:17 . 2008-09-19 02:57 <REP> d-------- C:\SDFix
2008-09-22 00:57 . 2008-09-22 01:37 <REP> d-------- C:\Program Files\Startup Faster
2008-09-21 00:49 . 2008-09-21 06:39 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-09-17 01:55 . 2008-09-17 01:55 <REP> d-------- C:\Program Files\Trend Micro
2008-09-17 00:27 . 2008-09-17 00:27 <REP> d-------- C:\Program Files\Sophos Anti-Rootkit
2008-09-16 01:56 . 2008-09-16 01:56 <REP> d-------- C:\Program Files\VideoLAN
2008-09-14 04:12 . 2008-09-22 02:04 12,980 --a------ C:\WINDOWS\system32\oodbs.lor
2008-09-13 02:08 . 2008-09-17 00:30 <REP> d-------- C:\WINDOWS\system32\oodag
2008-09-13 01:57 . 2008-09-13 01:57 0 --a------ C:\WINDOWS\oodcnt.INI
2008-09-13 01:44 . 2008-09-13 01:44 <REP> d-------- C:\Program Files\OO Software
2008-09-12 06:27 . 2008-09-12 06:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-09-12 05:22 . 2008-09-12 05:22 <REP> d-------- C:\Program Files\Bonjour
2008-09-12 05:04 . 2008-09-12 05:04 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared
2008-09-12 04:59 . 2008-09-12 05:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-09-12 04:58 . 2008-08-24 18:29 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-09-12 02:17 . 2008-09-12 06:25 <REP> d-------- C:\Program Files\Conduit
2008-09-11 23:47 . 2008-09-05 00:02 <REP> d-------- C:\Program Files\Paint.NET
2008-09-11 02:08 . 2008-09-11 02:08 <REP> d-------- C:\Program Files\MSXML 4.0
2008-09-10 17:51 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-10 17:48 . 2008-08-17 03:01 <REP> d-------- C:\Program Files\Java
2008-09-10 17:46 . 2008-09-10 17:46 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-09-10 05:02 . 2008-08-14 04:54 <REP> d-------- C:\Program Files\PokerStars
2008-09-10 00:04 . 2007-12-10 13:20 40,046 --a------ C:\WINDOWS\Pagelet.ico
2008-09-10 00:03 . 2008-09-10 01:12 <REP> d-------- C:\Program Files\Sothink DHTML Menu
2008-09-10 00:03 . 2008-09-10 00:04 <REP> d-------- C:\Program Files\Fichiers communs\SourceTec
2008-09-10 00:03 . 2007-12-10 13:20 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-09-10 00:03 . 2007-12-10 13:20 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-09-09 22:48 . 2008-09-22 01:53 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-09-09 22:03 . 2008-09-02 03:47 <REP> d-------- C:\Program Files\FileZilla FTP Client
2008-09-09 22:03 . 2008-09-19 04:01 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\FileZilla
2008-09-09 19:20 . 2008-09-09 19:27 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\Likno
2008-09-09 19:17 . 2003-05-30 10:58 244,232 --a------ C:\WINDOWS\system32\MsFlxGrd.ocx
2008-09-09 19:17 . 2003-05-30 10:58 203,976 --a------ C:\WINDOWS\system32\RichTx32.ocx
2008-09-09 19:17 . 1998-06-18 01:00 49,152 --a------ C:\WINDOWS\system32\MSCDRUN.DLL
2008-09-09 19:16 . 1998-04-24 01:00 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2008-09-09 19:16 . 2001-03-13 15:49 140,288 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-09-09 18:06 . 2008-09-09 18:06 0 ---hs---- C:\WINDOWS\S86739CE6.tmp
2008-09-09 18:04 . 2008-09-09 18:04 <REP> d-------- C:\Program Files\SlySoft
2008-09-09 18:04 . 2008-09-09 18:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-09-09 06:56 . 2008-09-09 06:56 <REP> d-------- C:\Program Files\FileSubmit
2008-09-05 19:53 . 2008-09-05 19:53 244 --ah----- C:\sqmnoopt03.sqm
2008-09-05 19:53 . 2008-09-05 19:53 232 --ah----- C:\sqmdata03.sqm
2008-09-04 18:56 . 2008-09-04 18:56 268 --ah----- C:\sqmdata02.sqm
2008-09-04 18:56 . 2008-09-04 18:56 244 --ah----- C:\sqmnoopt02.sqm
2008-09-03 14:14 . 2001-08-28 14:00 89,856 --a------ C:\WINDOWS\system32\sseriff.fon
2008-09-03 14:13 . 2001-08-28 14:00 81,728 --a------ C:\WINDOWS\system32\seriff.fon
2008-09-01 02:30 . 2008-09-01 02:30 <REP> d-------- C:\Program Files\Active+
2008-08-31 20:02 . 2008-08-31 20:07 <REP> d-------- C:\24H_S6
2008-08-31 01:37 . 2008-04-13 20:34 1,037,824 --a------ C:\WINDOWS\explorer.exe.old
2008-08-31 01:37 . 2008-09-06 06:15 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-08-31 01:32 . 2008-09-20 06:37 <REP> d-------- C:\Program Files\Trojan Remover
2008-08-31 01:32 . 2008-08-31 01:32 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\Simply Super Software
2008-08-31 01:32 . 2008-08-31 01:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
2008-08-31 01:32 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2008-08-31 01:32 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-08-31 01:32 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2008-08-31 01:32 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-08-31 01:32 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2008-08-30 03:45 . 2008-08-30 03:45 <REP> d-------- C:\Program Files\Lock My PC 4
2008-08-30 03:45 . 2007-11-29 11:42 44,400 --a------ C:\WINDOWS\system32\fsp_lmwl.dll
2008-08-30 03:45 . 2007-10-08 22:59 10,096 --a------ C:\WINDOWS\system32\drivers\lmpc4.sys
2008-08-29 23:53 . 2008-08-29 23:53 351 --a------ C:\WINDOWS\wininit.ini
2008-08-29 23:23 . 2008-08-31 00:30 57,727 --a------ C:\WINDOWS\system32\tdssinit.dll.vir
2008-08-29 23:22 . 2008-08-29 23:44 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\TmpRecentIcons
2008-08-29 23:22 . 2008-08-29 19:16 253,952 --------- C:\WINDOWS\pdoskegl.dll_old
2008-08-29 23:22 . 2008-08-29 19:16 229,376 --------- C:\WINDOWS\rqbmvpso.dll_old
2008-08-29 23:22 . 2008-08-29 19:16 86,016 --a------ C:\WINDOWS\rvoelbxt.exe.vir
2008-08-29 23:12 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-08-29 23:08 . 2008-08-29 23:08 <REP> d-------- C:\Documents and Settings\Hicham\WINDOWS
2008-08-29 23:08 . 2002-08-20 14:58 139,264 --a------ C:\WINDOWS\system32\IDEproperty.dll
2008-08-29 23:08 . 2002-10-17 15:14 49,024 --a------ C:\WINDOWS\system32\drivers\sisidex.sys
2008-08-29 23:08 . 2002-08-20 17:19 9,472 --a------ C:\WINDOWS\system32\drivers\sisperf.sys
2008-08-29 23:06 . 2008-08-29 23:06 <REP> d-------- C:\Program Files\SigmaTel
2008-08-29 23:06 . 2002-08-11 15:44 179,664 --a------ C:\WINDOWS\system32\drivers\STAC97.sys
2008-08-29 23:03 . 2008-08-29 23:03 <REP> d-------- C:\WINDOWS\OPTIONS
2008-08-29 23:03 . 2008-08-29 23:03 <REP> d-------- C:\Program Files\Realtek
2008-08-29 23:03 . 2008-08-29 23:03 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\InstallShield
2008-08-29 23:03 . 2008-02-25 20:54 105,088 --a------ C:\WINDOWS\system32\drivers\Rtnicxp.sys
2008-08-29 22:57 . 2003-03-25 17:50 4,096 --a------ C:\WINDOWS\system32\drivers\siside.sys
2008-08-29 22:00 . 2007-09-02 20:56 1,686,016 --a------ C:\WINDOWS\system32\clinetsuitex6.ocx
2008-08-29 22:00 . 2004-03-09 16:45 662,288 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX
2008-08-29 22:00 . 2004-06-14 14:56 427,864 --a------ C:\WINDOWS\system32\XceedZip.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 00:06 --------- d-----w C:\Documents and Settings\Hicham\Application Data\uTorrent
2008-09-22 00:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-09-22 00:04 26,693,664 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-22 00:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-22 00:03 371,060 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 00:03 123,560 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-22 00:03 1,314,848 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-21 23:41 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-09-21 22:57 --------- d-----w C:\Documents and Settings\Hicham\Application Data\URSoft
2008-09-21 22:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-14 01:59 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-09-11 00:08 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-09-10 16:26 --------- d-----w C:\Program Files\Windows Desktop Search
2008-09-09 23:12 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-09-09 23:12 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-09 23:12 --------- d-----w C:\Program Files\uTorrent
2008-09-09 23:12 --------- d-----w C:\Program Files\TopStyle3
2008-09-09 23:12 --------- d-----w C:\Program Files\Media Player Classic
2008-09-09 15:24 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Winamp
2008-09-07 21:31 --------- d-----w C:\Program Files\Everest Poker
2008-09-06 01:13 --------- d-----w C:\Documents and Settings\Hicham\Application Data\OpenOffice.org2
2008-09-04 21:26 --------- d-----w C:\Program Files\AIMP2
2008-08-29 21:50 --------- d-----w C:\Program Files\CuteFTP 8 Pro
2008-08-29 21:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-29 20:13 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-24 19:18 --------- d-----w C:\Program Files\Unlocker
2008-08-24 19:10 --------- d-----w C:\Program Files\Opera
2008-08-18 20:12 --------- d-----w C:\Documents and Settings\Hicham\Application Data\mIRC
2008-08-17 22:37 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Windows Search
2008-08-17 08:16 --------- d-----w C:\Program Files\MSECache
2008-08-17 02:31 --------- d-----w C:\Documents and Settings\Hicham\Application Data\InfraRecorder
2008-08-17 01:03 --------- d-----w C:\Program Files\OpenOffice.org 2.4
2008-08-14 02:36 --------- d-----w C:\Program Files\Microsoft Works
2008-08-13 19:43 --------- d-----w C:\Program Files\Canon
2008-08-13 19:30 --------- d-----w C:\Program Files\Fichiers communs\Canon
2008-08-09 08:58 --------- d-----w C:\Program Files\Fichiers communs\Macromedia
2008-08-09 08:54 --------- d-----w C:\Program Files\Macromedia
2008-08-09 08:48 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-09 00:29 --------- d-----w C:\Program Files\Reference Assemblies
2008-08-09 00:29 --------- d-----w C:\Program Files\MSBuild
2008-08-08 22:34 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Ahead
2008-08-08 22:27 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Bradsoft.com
2008-08-07 21:50 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-07 20:11 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Thunderbird
2008-08-07 20:11 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Talkback
2008-08-07 17:45 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Notepad++
2008-08-07 15:43 361,344 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-08-07 15:31 --------- d-----w C:\Program Files\Windows Live
2008-08-07 15:29 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-08-07 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-07 15:27 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-08-07 15:26 --------- d-----w C:\Program Files\Nero
2008-08-07 15:02 --------- d-----w C:\Documents and Settings\Hicham\Application Data\GlobalSCAPE
2008-08-07 15:01 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-07 15:01 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-08-07 15:01 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-08-07 14:59 --------- d-----w C:\Program Files\CCleaner
2008-08-07 14:53 --------- d-----w C:\Program Files\Notepad++
2008-08-07 14:47 --------- d-----w C:\Program Files\Winamp
2008-08-07 14:45 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Media Player Classic
2008-08-07 14:37 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-07 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-07 14:18 --------- d-----w C:\Program Files\Foxit Software
2008-08-07 14:03 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-07 13:52 --------- d-----w C:\Program Files\Foxit
2008-08-07 13:50 --------- d-----w C:\Program Files\Services en ligne
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:28 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
2008-07-04 00:33 3,127 ----a-w C:\WINDOWS\system32\presetup.cmd
2008-07-04 00:33 28,672 ----a-w C:\WINDOWS\system32\setupold.exe
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:44 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 16:12 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 08:23 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 08:23 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 08:23 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
.
------- Sigcheck -------
2008-04-13 20:34 1037824 258a42b06858e5bbf50794b66525ea91 C:\WINDOWS\explorer.exe
2008-04-13 20:34 1037824 6db1505a387b3fda3cdc3414c260e712 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartupFaster"="C:\Program Files\Startup Faster\startuploader.exe" [2008-03-22 1393888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
C:\Documents and Settings\Hicham\Menu D‚marrer\Programmes\D‚marrage\StartupFaster
StartupFaster.ini [2008-09-22 280]
WampServer.lnk - C:\wamp\wampmanager.exe [2008-08-07 1152512]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInternetIcon"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fsp_lmwl]
2007-11-29 11:42 44400 C:\WINDOWS\system32\fsp_lmwl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"DisablePagingExecutive"=dword:00000001
"SecondLevelDataCache"=dword:00000200
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"E:\\MiRc\\Thriller\\mirc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592]
R3 LMPC4;LMPC4;C:\WINDOWS\system32\drivers\LMPC4.sys [2007-10-08 10096]
S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\3E.tmp [ ]
S3 STAC97NA;SigmaTel 3D Environmental Audio;C:\WINDOWS\system32\drivers\stac97na.sys [ ]
S3 STAC97NH;STAC97NH;C:\WINDOWS\system32\drivers\stac97nh.sys [2002-09-20 231983]
S3 wampapache;wampapache;c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe [2008-01-18 24635]
Stop Pending3 wampmysqld;wampmysqld;c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe wampmysqld [ ]
*Newly Created Service* - HELPSVC
.
Contenu du dossier 'Tâches planifiées'
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Hicham\Application Data\Mozilla\Firefox\Profiles\ia3bk6z9.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
FF -: plugin - C:\Documents and Settings\Hicham\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 02:04:59
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\C:\WINDOWS\system32\3E.tmp"
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Startup Faster\SFAgent.exe
C:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
.
**************************************************************************
.
Heure de fin: 2008-09-22 2:12:10 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-09-22 00:12:04
Avant-CF: 18.687.213.568 octets libres
Après-CF: 18,615,656,448 octets libres
282
Merci d'avance. -
Modérateur/!\ Seul redcode peut suivre cette procédure /!\
1/
---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.
---> Copie le texte ci-dessous par sélection puis Ctrl+C :
KillAll::
File::
C:\WINDOWS\system32\tdssinit.dll.vir
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\drivers\TDSSjcxe.sys
C:\WINDOWS\system32\drivers\tdsserv.sys
C:\WINDOWS\system32\drivers\TDSSserv.sys
C:\WINDOWS\system32\tdssadw.dll
C:\WINDOWS\system32\TDSSerrors.log
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\TDSShpue.dll
C:\WINDOWS\system32\TDSSevri.dll
C:\WINDOWS\system32\TDSSsqoi.dll
C:\WINDOWS\system32\TDSSheer.dll
C:\WINDOWS\system32\TDSSjjsm.dll
C:\WINDOWS\pdoskegl.dll_old
C:\WINDOWS\rqbmvpso.dll_old
C:\WINDOWS\rvoelbxt.exe.vir
C:\WINDOWS\system32\3E.tmp
Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
Driver::
MEMSWEEP2
---> Colle la sélection dans le bloc-notes
---> Enregistre ce fichier sur le bureau (Impératif)
---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes
2/
---> Redémarre en mode sans échec
---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
[*] Une fois le scan achevé, un rapport va s'afficher : poste-le
[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt -
Salut,
Voila le nouveau rapport :
ComboFix 08-09-20.05 - Hicham 2008-09-22 3:09:14.2 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.817 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Hicham\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Hicham\Bureau\CFScript.txt
[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
FILE ::
C:\WINDOWS\pdoskegl.dll_old
C:\WINDOWS\rqbmvpso.dll_old
C:\WINDOWS\rvoelbxt.exe.vir
C:\WINDOWS\system32\3E.tmp
C:\WINDOWS\system32\drivers\tdsserv.sys
C:\WINDOWS\system32\drivers\TDSSjcxe.sys
C:\WINDOWS\system32\drivers\TDSSserv.sys
C:\WINDOWS\system32\tdssadw.dll
C:\WINDOWS\system32\TDSSerrors.log
C:\WINDOWS\system32\TDSSevri.dll
C:\WINDOWS\system32\TDSSheer.dll
C:\WINDOWS\system32\TDSShpue.dll
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssinit.dll.vir
C:\WINDOWS\system32\TDSSjjsm.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\TDSSsqoi.dll
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\pdoskegl.dll_old
C:\WINDOWS\rqbmvpso.dll_old
C:\WINDOWS\rvoelbxt.exe.vir
C:\WINDOWS\system32\tdssinit.dll.vir
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MEMSWEEP2
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-22 au 2008-09-22 ))))))))))))))))))))))))))))))))))))
.
2008-09-22 01:17 . 2008-09-19 02:57 <REP> d-------- C:\SDFix
2008-09-22 00:57 . 2008-09-22 01:37 <REP> d-------- C:\Program Files\Startup Faster
2008-09-21 00:49 . 2008-09-21 06:39 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-09-17 01:55 . 2008-09-17 01:55 <REP> d-------- C:\Program Files\Trend Micro
2008-09-17 00:27 . 2008-09-17 00:27 <REP> d-------- C:\Program Files\Sophos Anti-Rootkit
2008-09-16 01:56 . 2008-09-16 01:56 <REP> d-------- C:\Program Files\VideoLAN
2008-09-14 04:12 . 2008-09-22 03:13 15,534 --a------ C:\WINDOWS\system32\oodbs.lor
2008-09-13 02:08 . 2008-09-17 00:30 <REP> d-------- C:\WINDOWS\system32\oodag
2008-09-13 01:57 . 2008-09-13 01:57 0 --a------ C:\WINDOWS\oodcnt.INI
2008-09-13 01:44 . 2008-09-13 01:44 <REP> d-------- C:\Program Files\OO Software
2008-09-12 06:27 . 2008-09-12 06:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-09-12 05:22 . 2008-09-12 05:22 <REP> d-------- C:\Program Files\Bonjour
2008-09-12 05:04 . 2008-09-12 05:04 <REP> d-------- C:\Program Files\Fichiers communs\Macrovision Shared
2008-09-12 04:59 . 2008-09-12 05:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-09-12 04:58 . 2008-08-24 18:29 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-09-12 02:17 . 2008-09-12 06:25 <REP> d-------- C:\Program Files\Conduit
2008-09-11 23:47 . 2008-09-05 00:02 <REP> d-------- C:\Program Files\Paint.NET
2008-09-11 02:08 . 2008-09-11 02:08 <REP> d-------- C:\Program Files\MSXML 4.0
2008-09-10 17:51 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-10 17:48 . 2008-08-17 03:01 <REP> d-------- C:\Program Files\Java
2008-09-10 17:46 . 2008-09-10 17:46 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-09-10 05:02 . 2008-08-14 04:54 <REP> d-------- C:\Program Files\PokerStars
2008-09-10 00:04 . 2007-12-10 13:20 40,046 --a------ C:\WINDOWS\Pagelet.ico
2008-09-10 00:03 . 2008-09-10 01:12 <REP> d-------- C:\Program Files\Sothink DHTML Menu
2008-09-10 00:03 . 2008-09-10 00:04 <REP> d-------- C:\Program Files\Fichiers communs\SourceTec
2008-09-10 00:03 . 2007-12-10 13:20 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-09-10 00:03 . 2007-12-10 13:20 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-09-09 22:48 . 2008-09-22 01:53 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-09-09 22:03 . 2008-09-02 03:47 <REP> d-------- C:\Program Files\FileZilla FTP Client
2008-09-09 22:03 . 2008-09-19 04:01 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\FileZilla
2008-09-09 19:20 . 2008-09-09 19:27 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\Likno
2008-09-09 19:17 . 2003-05-30 10:58 244,232 --a------ C:\WINDOWS\system32\MsFlxGrd.ocx
2008-09-09 19:17 . 2003-05-30 10:58 203,976 --a------ C:\WINDOWS\system32\RichTx32.ocx
2008-09-09 19:17 . 1998-06-18 01:00 49,152 --a------ C:\WINDOWS\system32\MSCDRUN.DLL
2008-09-09 19:16 . 1998-04-24 01:00 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2008-09-09 19:16 . 2001-03-13 15:49 140,288 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-09-09 18:06 . 2008-09-09 18:06 0 ---hs---- C:\WINDOWS\S86739CE6.tmp
2008-09-09 18:04 . 2008-09-09 18:04 <REP> d-------- C:\Program Files\SlySoft
2008-09-09 18:04 . 2008-09-09 18:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SlySoft
2008-09-09 06:56 . 2008-09-09 06:56 <REP> d-------- C:\Program Files\FileSubmit
2008-09-05 19:53 . 2008-09-05 19:53 244 --ah----- C:\sqmnoopt03.sqm
2008-09-05 19:53 . 2008-09-05 19:53 232 --ah----- C:\sqmdata03.sqm
2008-09-04 18:56 . 2008-09-04 18:56 268 --ah----- C:\sqmdata02.sqm
2008-09-04 18:56 . 2008-09-04 18:56 244 --ah----- C:\sqmnoopt02.sqm
2008-09-03 14:14 . 2001-08-28 14:00 89,856 --a------ C:\WINDOWS\system32\sseriff.fon
2008-09-03 14:13 . 2001-08-28 14:00 81,728 --a------ C:\WINDOWS\system32\seriff.fon
2008-09-01 02:30 . 2008-09-01 02:30 <REP> d-------- C:\Program Files\Active+
2008-08-31 20:02 . 2008-08-31 20:07 <REP> d-------- C:\24H_S6
2008-08-31 01:37 . 2008-04-13 20:34 1,037,824 --a------ C:\WINDOWS\explorer.exe.old
2008-08-31 01:37 . 2008-09-06 06:15 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-08-31 01:32 . 2008-09-20 06:37 <REP> d-------- C:\Program Files\Trojan Remover
2008-08-31 01:32 . 2008-08-31 01:32 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\Simply Super Software
2008-08-31 01:32 . 2008-08-31 01:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
2008-08-31 01:32 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2008-08-31 01:32 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-08-31 01:32 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2008-08-31 01:32 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-08-31 01:32 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2008-08-30 03:45 . 2008-08-30 03:45 <REP> d-------- C:\Program Files\Lock My PC 4
2008-08-30 03:45 . 2007-11-29 11:42 44,400 --a------ C:\WINDOWS\system32\fsp_lmwl.dll
2008-08-30 03:45 . 2007-10-08 22:59 10,096 --a------ C:\WINDOWS\system32\drivers\lmpc4.sys
2008-08-29 23:53 . 2008-08-29 23:53 351 --a------ C:\WINDOWS\wininit.ini
2008-08-29 23:22 . 2008-08-29 23:44 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\TmpRecentIcons
2008-08-29 23:12 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-08-29 23:08 . 2008-08-29 23:08 <REP> d-------- C:\Documents and Settings\Hicham\WINDOWS
2008-08-29 23:08 . 2002-08-20 14:58 139,264 --a------ C:\WINDOWS\system32\IDEproperty.dll
2008-08-29 23:08 . 2002-10-17 15:14 49,024 --a------ C:\WINDOWS\system32\drivers\sisidex.sys
2008-08-29 23:08 . 2002-08-20 17:19 9,472 --a------ C:\WINDOWS\system32\drivers\sisperf.sys
2008-08-29 23:06 . 2008-08-29 23:06 <REP> d-------- C:\Program Files\SigmaTel
2008-08-29 23:06 . 2002-08-11 15:44 179,664 --a------ C:\WINDOWS\system32\drivers\STAC97.sys
2008-08-29 23:03 . 2008-08-29 23:03 <REP> d-------- C:\WINDOWS\OPTIONS
2008-08-29 23:03 . 2008-08-29 23:03 <REP> d-------- C:\Program Files\Realtek
2008-08-29 23:03 . 2008-08-29 23:03 <REP> d-------- C:\Documents and Settings\Hicham\Application Data\InstallShield
2008-08-29 23:03 . 2008-02-25 20:54 105,088 --a------ C:\WINDOWS\system32\drivers\Rtnicxp.sys
2008-08-29 22:57 . 2003-03-25 17:50 4,096 --a------ C:\WINDOWS\system32\drivers\siside.sys
2008-08-29 22:00 . 2007-09-02 20:56 1,686,016 --a------ C:\WINDOWS\system32\clinetsuitex6.ocx
2008-08-29 22:00 . 2004-03-09 16:45 662,288 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX
2008-08-29 22:00 . 2004-06-14 14:56 427,864 --a------ C:\WINDOWS\system32\XceedZip.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 01:16 --------- d-----w C:\Documents and Settings\Hicham\Application Data\uTorrent
2008-09-22 01:15 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-22 01:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-09-22 01:14 26,747,424 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-22 01:06 371,684 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-22 01:06 123,824 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-22 01:06 1,314,848 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-21 23:41 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-09-21 22:57 --------- d-----w C:\Documents and Settings\Hicham\Application Data\URSoft
2008-09-21 22:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-14 01:59 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-09-11 00:08 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-09-10 16:26 --------- d-----w C:\Program Files\Windows Desktop Search
2008-09-09 23:12 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-09-09 23:12 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-09 23:12 --------- d-----w C:\Program Files\uTorrent
2008-09-09 23:12 --------- d-----w C:\Program Files\TopStyle3
2008-09-09 23:12 --------- d-----w C:\Program Files\Media Player Classic
2008-09-09 15:24 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Winamp
2008-09-07 21:31 --------- d-----w C:\Program Files\Everest Poker
2008-09-06 01:13 --------- d-----w C:\Documents and Settings\Hicham\Application Data\OpenOffice.org2
2008-09-04 21:26 --------- d-----w C:\Program Files\AIMP2
2008-08-29 21:50 --------- d-----w C:\Program Files\CuteFTP 8 Pro
2008-08-29 21:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-29 20:13 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-24 19:18 --------- d-----w C:\Program Files\Unlocker
2008-08-24 19:10 --------- d-----w C:\Program Files\Opera
2008-08-18 20:12 --------- d-----w C:\Documents and Settings\Hicham\Application Data\mIRC
2008-08-17 22:37 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Windows Search
2008-08-17 08:16 --------- d-----w C:\Program Files\MSECache
2008-08-17 02:31 --------- d-----w C:\Documents and Settings\Hicham\Application Data\InfraRecorder
2008-08-17 01:03 --------- d-----w C:\Program Files\OpenOffice.org 2.4
2008-08-14 02:36 --------- d-----w C:\Program Files\Microsoft Works
2008-08-13 19:43 --------- d-----w C:\Program Files\Canon
2008-08-13 19:30 --------- d-----w C:\Program Files\Fichiers communs\Canon
2008-08-09 08:58 --------- d-----w C:\Program Files\Fichiers communs\Macromedia
2008-08-09 08:54 --------- d-----w C:\Program Files\Macromedia
2008-08-09 08:48 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-08-09 00:29 --------- d-----w C:\Program Files\Reference Assemblies
2008-08-09 00:29 --------- d-----w C:\Program Files\MSBuild
2008-08-08 22:34 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Ahead
2008-08-08 22:27 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Bradsoft.com
2008-08-07 21:50 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-07 20:11 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Thunderbird
2008-08-07 20:11 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Talkback
2008-08-07 17:45 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Notepad++
2008-08-07 15:43 361,344 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-08-07 15:31 --------- d-----w C:\Program Files\Windows Live
2008-08-07 15:29 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-08-07 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-07 15:27 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2008-08-07 15:26 --------- d-----w C:\Program Files\Nero
2008-08-07 15:02 --------- d-----w C:\Documents and Settings\Hicham\Application Data\GlobalSCAPE
2008-08-07 15:01 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-07 15:01 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-08-07 15:01 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-08-07 14:59 --------- d-----w C:\Program Files\CCleaner
2008-08-07 14:53 --------- d-----w C:\Program Files\Notepad++
2008-08-07 14:47 --------- d-----w C:\Program Files\Winamp
2008-08-07 14:45 --------- d-----w C:\Documents and Settings\Hicham\Application Data\Media Player Classic
2008-08-07 14:37 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-07 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-07 14:18 --------- d-----w C:\Program Files\Foxit Software
2008-08-07 14:03 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-07 13:52 --------- d-----w C:\Program Files\Foxit
2008-08-07 13:50 --------- d-----w C:\Program Files\Services en ligne
.
------- Sigcheck -------
2008-04-13 20:34 1037824 258a42b06858e5bbf50794b66525ea91 C:\WINDOWS\explorer.exe
2008-04-13 20:34 1037824 6db1505a387b3fda3cdc3414c260e712 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartupFaster"="C:\Program Files\Startup Faster\startuploader.exe" [2008-03-22 1393888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
C:\Documents and Settings\Hicham\Menu D‚marrer\Programmes\D‚marrage\StartupFaster
StartupFaster.ini [2008-09-22 280]
WampServer.lnk - C:\wamp\wampmanager.exe [2008-08-07 1152512]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoInternetIcon"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fsp_lmwl]
2007-11-29 11:42 44400 C:\WINDOWS\system32\fsp_lmwl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"DisablePagingExecutive"=dword:00000001
"SecondLevelDataCache"=dword:00000200
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"E:\\MiRc\\Thriller\\mirc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592]
R3 LMPC4;LMPC4;C:\WINDOWS\system32\drivers\LMPC4.sys [2007-10-08 10096]
R3 wampapache;wampapache;c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe [2008-01-18 24635]
S3 STAC97NA;SigmaTel 3D Environmental Audio;C:\WINDOWS\system32\drivers\stac97na.sys [ ]
S3 STAC97NH;STAC97NH;C:\WINDOWS\system32\drivers\stac97nh.sys [2002-09-20 231983]
Stop Pending3 wampmysqld;wampmysqld;c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe wampmysqld [ ]
.
Contenu du dossier 'Tâches planifiées'
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 03:15:07
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Startup Faster\SFAgent.exe
C:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
.
**************************************************************************
.
Heure de fin: 2008-09-22 3:23:52 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-09-22 01:22:46
ComboFix2.txt 2008-09-22 00:12:15
Avant-CF: 18.681.733.120 octets libres
Après-CF: 18,675,613,696 octets libres
278
Merci. -
ModérateurPoste un nouveau rapport HijackThis.
-
Salut,
Le voila :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:51:32, on 22/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20861)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Startup Faster\sfAgent.exe
c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\wamp\wampmanager.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [StartupFaster] "C:\Program Files\Startup Faster\startuploader.exe" -run SFAURUN SFCURUN SFAUSTARTUP SFCUSTARTUP
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: StartupFaster
O4 - Global Startup: StartupFaster
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O20 - Winlogon Notify: fsp_lmwl - C:\WINDOWS\SYSTEM32\fsp_lmwl.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe
-
ModérateurC:\WINDOWS\SYSTEM32\fsp_lmwl.dll
Fais analyser ce fichier sur VirusTotal :
https://www.virustotal.com/gui/ -
Salut,
voila le rapport :
http://www.pcpratique.be/uploads/Resultat.htm
Merci. -
ModérateurTu as encore des problèmes ?
-
Salut,
je viens de redémarrer est c'est super pas de problèmes.
Merci Destrio5 pour votre aide c'est super sympa de votre part.
Mille Mercis. -
Salut,
j'ai fait tous ce que vous m'avez dit est ce que c'est OK.
Et Merci -
ModérateurBonne journée ;)
