PC envahi par TR Vundo Gen

Re

J'ai telechargé FindyKill de Chiquitine29 :

message me disant que la version n'est pas supportee


Je precise aussi que les 14 fenetres de antivir sont impossible a fermer .

A bientôt

RE
J'ai telecharge et lance le logiciel mais je pense qu'il y 1 probleme. Il s'arrete en signalant 1 probleme
j'ai essayé par 3 fois

je joins le rapport obtenu



Wed Nov 12 20:58:48 2008
EliBagle v11.95 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 10 de Noviembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Wed Nov 12 21:00:27 2008
EliBagle v11.95 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 10 de Noviembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Wed Nov 12 21:02:52 2008
EliBagle v11.95 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 10 de Noviembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Wed Nov 12 21:04:27 2008
EliBagle v11.95 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 10 de Noviembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Wed Nov 12 21:04:46 2008
EliBagle v11.95 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 10 de Noviembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Wed Nov 12 21:06:09 2008
EliBagle v11.95 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 10 de Noviembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

Wed Nov 12 21:06:12 2008
EliBagle v11.95 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 10 de Noviembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

excuse moi mais il faudra me dire comment faire en mode sans echec
j'avais deja essayé avec findykill et message affiché : version pas supportee

merci de ta patience

Re
recherche avec findykill effectuee voici le rapport


----------------- FindyKill V4.600 ------------------

* User : cj - AMILO
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 12/11/08 par Chiquitine29
* Recherche effectuée à 21:54:00 le 12/11/2008
* Windows Vista - Internet Explorer 7.0.6000.16757

((((((((((((((((( *** Recherche *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Presence des fichiers dans C:


»»»» Presence des fichiers dans C:\Windows


»»»» Presence des fichiers dans C:\Windows\Prefetch


»»»» Presence des fichiers dans C:\Windows\system32


»»»» Presence des fichiers dans C:\Windows\system32\drivers


»»»» Presence des fichiers dans C:\Users\cj\AppData\Roaming


»»»» Presence des fichiers dans C:\Users\cj\AppData\Local\Temp


»»»» Presence des fichiers dans C:\Users\cj\Local Settings\Temporary Internet Files\Content.IE5


--------------- [ Registre / Startup ] ----------------


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
StartCCC REG_SZ c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
RtHDVCpl REG_SZ RtHDVCpl.exe
SMSERIAL REG_SZ C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
NeroFilterCheck REG_SZ C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
EoEngine REG_SZ
EoWeather REG_SZ
Kleptomania REG_SZ
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSServer REG_SZ rundll32.exe C:\Windows\system32\vtUooMed.dll,#1
avgnt REG_SZ "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
74196f5b REG_SZ rundll32.exe "C:\Windows\system32\rkmyeywb.dll",b

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\avp6_post_uninstall
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
fsc-reg REG_SZ C:\ProgramData\fsc-reg\fscreg.exe 20081016
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
Kleptomania REG_SZ
LaCie Backup REG_SZ C:\LaCie\Backup Software\\LaCieBackup.exe /background


--------------- [ Registre / Clés infectieuses ] ----------------



--------------- [ Etat / Services ] ----------------



+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

Ndisuio - Type de démarrage = 3

EapHost - Type de démarrage = 3

Wlansvc - Type de démarrage = 2

SharedAccess - Type de démarrage = 2

/!\ wuauserv - Type de démarrage = 4

wscsvc - Type de démarrage = 2

/!\ WinDefend - Type de démarrage = 4



--------------- [ Recherche dans supports amovibles] ----------------


+- Informations :

C: - Lecteur fixe
D: - Lecteur fixe

+- Contenu de l'autorun : D:\autorun.inf

[autorun]
shellexecute="resycled\boot.com d:"
shell\Open\command="resycled\boot.com d:"
shell=Open


+- presence des fichiers :

Found ! [17/10/2008 18:16][-r-hs----] - D:\autorun.inf


--------------- [ Registre / Mountpoint2 ] ----------------

Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4dfcd92c-48e8-11dc-bf84-00030d69056d}\Shell\AutoRun\command
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4dfcd92c-48e8-11dc-bf84-00030d69056d}\Shell\open\Command


------------------- ! Fin du rapport ! --------------------

rapport mais il a pas redemarre


----------------- FindyKill V4.600 ------------------

* User : cj - AMILO
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 12/11/08 par Chiquitine29
* Suppression effectuée à 22:08:12 le 12/11/2008
* Windows Vista - Internet Explorer 7.0.6000.16757


((((((((((((((( *** Suppression *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe

--------------- [ Fichiers / Dossiers infectieux ] ----------------


»»»» Supression des fichiers dans C:


»»»» Supression des fichiers dans C:\Windows


»»»» Supression des fichiers dans C:\Windows\Prefetch


»»»» Supression des fichiers dans C:\Windows\system32


»»»» Supression des fichiers dans C:\Windows\system32\drivers


»»»» Supression des fichiers dans C:\Users\cj\AppData\Roaming


»»»» Supression des fichiers dans C:\Users\cj\AppData\Local\Temp


»»»» Supression des fichiers dans C:\Users\cj\Local Settings\Temporary Internet Files\Content.IE5


--------------- [ Registre / Clés infectieuses ] ----------------


--------------- [ Etat / Redémarage des services ] ----------------



+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

Ndisuio - Type de démarrage = 3

EapHost - Type de démarrage = 2

Wlansvc - Type de démarrage = 2

SharedAccess - Type de démarrage = 2

wuauserv - Type de démarrage = 2

wscsvc - Type de démarrage = 2

WinDefend - Type de démarrage = 2


--------------- [ Nettoyage des supports amovibles ] ----------------

+- Informations :

C: - Lecteur fixe
D: - Lecteur fixe

+- Suppression des fichiers :

Deleted ! - D:\autorun.inf

--------------- [ Registre / Moutpoint2 ] ----------------

Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4dfcd92c-48e8-11dc-bf84-00030d69056d}\Shell\AutoRun\command
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4dfcd92c-48e8-11dc-bf84-00030d69056d}\Shell\open\Command

--------------- [ Recherche Cracks / Keygen ] ----------------



---------------- ! Fin du rapport ! ------------------




2eme rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:16:30, on 12/11/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\Explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.programme-tv.net/programme-tnt.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.1.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {3acd335b-d907-a29a-2174-ea25a4beb3f1} - {1f3beb4a-52ae-4712-a92a-709db533dca3} - C:\Windows\system32\prrasz.dll
O2 - BHO: (no name) - {3686fb73-d7a9-4b02-8ac4-282e3a5f896c} - (no file)
O2 - BHO: (no name) - {3DFDAF92-A870-4634-96E0-E34CA0FA70A5} - (no file)
O2 - BHO: (no name) - {50B43B6B-D83D-4F52-9B6C-481DA24A8A44} - C:\Windows\system32\yaywwVPI.dll
O2 - BHO: (no name) - {6A1C5703-6B76-4966-AE8D-3D0D20B5743F} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A7B17148-7DE1-4FF9-BB30-3B44823D847B} - (no file)
O2 - BHO: (no name) - {B3E3D623-93C3-4F72-83EB-B223F41E2442} - (no file)
O2 - BHO: (no name) - {FB206BAF-DFF3-4C5D-B226-5902CE72BE68} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\vtUooMed.dll,#1
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [74196f5b] rundll32.exe "C:\Windows\system32\rkmyeywb.dll",b
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20081016
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [LaCie Backup] C:\LaCie\Backup Software\\LaCieBackup.exe /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~4.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~4.0_0\bin\ssv.dll
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: NameServer = 85.255.112.86;85.255.112.189
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: NameServer = 85.255.112.86;85.255.112.189
O20 - AppInit_DLLs: prrasz.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
O23 - Service: Windows Tribute Service - Unknown owner - C:\Windows\system32\kdrgt.exe (file missing)

Re

SmitFraudFix v2.375

Scan done at 22:32:14,51, 12/11/2008
Run from C:\Users\cj\Desktop\CATHIE\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows Vista
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\Explorer.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

hosts file corrupted !

127.0.0.1 www.legal-at-spybot.info
127.0.0.1 legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\

C:\resycled\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\cj


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\cj\AppData\Local\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\cj\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\cj\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=dword:00000001
"AppInit_DLLs"="prrasz.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Your computer may be victim of a DNS Hijack: 85.255.x.x detected !

Description: Intel(R) PRO/Wireless 3945ABG Network Connection
DNS Server Search Order: 85.255.112.86;85.255.112.189

HKLM\SYSTEM\CCS\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: NameServer=85.255.112.86;85.255.112.189
HKLM\SYSTEM\CCS\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: NameServer=85.255.112.86;85.255.112.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: NameServer=85.255.112.86;85.255.112.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: NameServer=85.255.112.86;85.255.112.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{769D4CAD-D715-4AEF-B210-5416C01D2237}: NameServer=85.255.112.86;85.255.112.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{CF2745C1-2265-4234-9C6E-D82DE180127D}: NameServer=85.255.112.86;85.255.112.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

dois-je fermer les 2 FENETRES de
hijackthis
et
smitfraudfix??

Re

j'ai redemarré et voulu faire option 5

impossible internet explorer bloque et antvir ouvre encore toutes les fenetres

A virus or unwanted programme was found TR Vundo;Gen trojan

un autre message au moment du demarrage s'affiche
"erreur de chargement de C:Windows system 32 rkmyewyb;dell

le module specifie est introuvable

au demarrage toujours les dll qui manquent mais plus de trvundo fenetres antivir qui s'ouvrent





ComboFix 08-11-11.01 - cj 2008-11-12 23:37:43.1 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1636 [GMT 1:00]
Lancé depuis: c:\users\cj\Desktop\C-Fix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Pornovid
c:\windows\system32\aloehc.dll
c:\windows\system32\aqmialba.dll
c:\windows\system32\awturSKe.dll
c:\windows\System32\ayGOVvut.ini
c:\windows\System32\ayGOVvut.ini2
c:\windows\system32\biupjcgi.dll
c:\windows\system32\bvdiybxs.dll
c:\windows\system32\bwlhyz.dll
c:\windows\system32\cbXQhGvU.dll
c:\windows\system32\ccuhowkr.dll
c:\windows\system32\ddcAqNhE.dll
c:\windows\system32\ddcDwuVM.dll
c:\windows\system32\efcAPJdd.dll
c:\windows\system32\ejxuve.dll
c:\windows\system32\gausskom.dll
c:\windows\system32\geBtQhfe.dll
c:\windows\system32\goepkcpc.dll
c:\windows\system32\hgGxWqpM.dll
c:\windows\system32\hgGyyywW.dll
c:\windows\system32\hhiped.dll
c:\windows\System32\HjTvDJlm.ini
c:\windows\System32\HjTvDJlm.ini2
c:\windows\System32\IPVwwyay.ini
c:\windows\System32\IPVwwyay.ini2
c:\windows\system32\ixtcfq.dll
c:\windows\system32\orkcxl.dll
c:\windows\system32\outawhed.dll
c:\windows\system32\pmnkKccd.dll
c:\windows\system32\prrasz.dll
c:\windows\system32\qjevrgkr.dll
c:\windows\system32\qoMfeeed.dll
c:\windows\system32\rcnyrx.dll
c:\windows\system32\rdryvpyw.ini
c:\windows\system32\rkajsvtd.ini
c:\windows\system32\rrrjstfn.dll
c:\windows\system32\seqlfj.dll
c:\windows\system32\ssqQjHbC.dll
c:\windows\system32\thtyujau.dll
c:\windows\system32\uajuytht.ini
c:\windows\system32\vtUooMed.dll
c:\windows\system32\yaywwVPI.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Windows Tribute Service


((((((((((((((((((((((((((((( Fichiers créés du 2008-10-12 au 2008-11-12 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans ce laps de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-12 21:51 691 ----a-w c:\users\cj\AppData\Roaming\GetValue.vbs
2008-11-12 21:51 35 ----a-w c:\users\cj\AppData\Roaming\SetValue.bat
2008-11-12 21:16 --------- d-----w c:\program files\Trend Micro
2008-11-12 21:10 --------- d-----w c:\program files\FindyKill
2008-11-12 11:58 --------- d-----w c:\program files\Avira
2008-11-12 11:58 --------- d-----w c:\progra~2\Avira
2008-11-12 11:46 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-11 22:05 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-11 21:02 112,144 ----a-w c:\windows\system32\drivers\kl1.sys
2008-11-08 11:47 20 ---h--w c:\users\All Users\PKP_DLbx.DAT
2008-11-08 11:47 20 ---h--w c:\progra~2\PKP_DLbx.DAT
2008-11-06 13:33 --------- d-----w c:\program files\Common Files\Adobe
2008-10-25 09:25 --------- d-----w c:\users\cj\AppData\Roaming\FileZilla
2008-10-25 09:02 --------- d-----w c:\program files\IziSpot 4
2008-10-20 21:09 20 ---h--w c:\users\All Users\PKP_DLck.DAT
2008-10-20 21:09 20 ---h--w c:\progra~2\PKP_DLck.DAT
2008-10-20 21:09 --------- d-----w c:\users\cj\AppData\Roaming\Nikon
2008-10-20 21:09 --------- d-----w c:\progra~2\Ultima_T15
2008-10-20 21:09 --------- d-----w c:\progra~2\EnterNHelp
2008-10-20 21:06 --------- d-----w c:\program files\Common Files\Nikon
2008-10-20 21:05 --------- d-----w c:\program files\Capture NX 2
2008-10-18 18:40 --------- d-----w c:\program files\Windows Mail
2008-10-17 20:10 --------- d-----w c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-10-17 20:10 --------- d-----w c:\program files\SDHelper (Spybot - Search & Destroy)
2008-10-14 16:13 20 ---h--w c:\users\All Users\PKP_DLbz.DAT
2008-10-14 16:13 20 ---h--w c:\progra~2\PKP_DLbz.DAT
2008-10-13 22:28 --------- d-----w c:\program files\Nikon
2008-10-02 04:25 1,152 --sha-w C:\4l0fao30.sys
2008-10-02 03:49 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-09-18 21:34 --------- d-----w c:\progra~2\WLInstaller
2008-09-09 09:57 85,288 ----a-w c:\users\cj\AppData\Roaming\GDIPFONTCACHEV1.DAT
2008-07-10 19:27 174 --sha-w c:\program files\desktop.ini
2007-11-05 15:38 5,178,077 ----a-w c:\users\Public\DreamMail4_Setup.exe
2007-06-26 16:53 5,705,822 ----a-w c:\users\Public\FreeScanner.exe
2006-05-03 09:06 163,328 --sh--r c:\windows\System32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r c:\windows\System32\msfDX.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-02-16 1232896]
"fsc-reg"="c:\programdata\fsc-reg\fscreg.exe" [2007-05-15 380944]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-09-02 282624]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-10 c:\windows\RtHDVCpl.exe]

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Microsoft Office.lnk - c:\microsoft office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=prrasz.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= i420vfw.dll
"msacm.l3acm"= l3codecp.acm
"msacm.mkdmp3enc"= c:\progra~1\CYBERL~1\PowerDV\Kernel\Burner\MKDMP3Enc.ACM

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\yaywwVPI

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4023748284-3179019453-127378773-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9837156B-FAE2-4061-99F9-3597659A0363}"= c:\program files\CyberLink\PowerDV\PowerDV.exe:CyberLink PowerDV
"TCP Query User{FA3C6C22-6BA3-4E32-9420-61F85048A543}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{03DB72A5-76CF-4558-8076-109711653D94}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{654B6E4E-1D1F-4CD0-89FD-CDB024D54916}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{BDE5D8D9-525F-4EC9-893F-FF68A810B8BC}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{0727B3FF-03FE-4C8A-AB5B-9B309FBE80A4}c:\\program files\\common files\\ahead\\nero web\\setupx.exe"= UDP:c:\program files\common files\ahead\nero web\setupx.exe:MSI starter
"UDP Query User{04FE9CBD-DF00-4BB5-A80E-7CFF2F5C6AAF}c:\\program files\\common files\\ahead\\nero web\\setupx.exe"= TCP:c:\program files\common files\ahead\nero web\setupx.exe:MSI starter
"TCP Query User{55146421-334C-4903-A2E1-D42219B79BB5}c:\\users\\cj\\appdata\\local\\temp\\nero web\\setupxu.exe"= UDP:c:\users\cj\appdata\local\temp\nero web\setupxu.exe:setupxu.exe
"UDP Query User{E9EB3898-C59F-494C-BBB9-D84B758E0A78}c:\\users\\cj\\appdata\\local\\temp\\nero web\\setupxu.exe"= TCP:c:\users\cj\appdata\local\temp\nero web\setupxu.exe:setupxu.exe
"TCP Query User{7AB04A6B-4D4E-4CEF-8B41-762ADFB7A46B}c:\\users\\cj\\appdata\\local\\temp\\nero web\\setupxu.exe"= UDP:c:\users\cj\appdata\local\temp\nero web\setupxu.exe:setupxu.exe
"UDP Query User{5A5DD437-241A-40DB-8E2D-C7FC2F889C64}c:\\users\\cj\\appdata\\local\\temp\\nero web\\setupxu.exe"= TCP:c:\users\cj\appdata\local\temp\nero web\setupxu.exe:setupxu.exe
"{3F854637-0603-4CAD-98BF-3908634D74A2}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{17497EB8-1F67-498C-8C03-3AE599BDF2F9}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{F7AECDF2-2A92-40E9-879B-7014BD656CC6}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{354BFBE8-17EC-470E-9712-812060CFF4E4}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{81AA5553-0BAD-4E8D-A73B-E2C5BEF05583}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"TCP Query User{60AC84D8-FFCB-4FC8-8288-81CA0131F207}c:\\program files\\maïdo production\\izispot 4\\izispot.exe"= UDP:c:\program files\maïdo production\izispot 4\izispot.exe:IziSpot
"UDP Query User{B27DE6B3-1FD4-4AC4-B4EC-540F41245225}c:\\program files\\maïdo production\\izispot 4\\izispot.exe"= TCP:c:\program files\maïdo production\izispot 4\izispot.exe:IziSpot
"TCP Query User{7C673B7C-6F33-456A-A449-CDBFB5D23F51}c:\\program files\\izispot 4\\izispot.exe"= UDP:c:\program files\izispot 4\izispot.exe:IziSpot
"UDP Query User{3CFAAACB-E766-4A79-B342-E062A0513BDC}c:\\program files\\izispot 4\\izispot.exe"= TCP:c:\program files\izispot 4\izispot.exe:IziSpot
"TCP Query User{31BE486E-928E-4698-99DA-5675E3503FEF}c:\\program files\\izispot 4\\izispot.exe"= UDP:c:\program files\izispot 4\izispot.exe:IziSpot
"UDP Query User{C6A0E1FC-4E14-465A-B816-F582396CC776}c:\\program files\\izispot 4\\izispot.exe"= TCP:c:\program files\izispot 4\izispot.exe:IziSpot
"TCP Query User{2818CE5C-2376-4597-958B-F4C3CB2E4F56}c:\\program files\\jalbumwin\\jalbumwin.exe"= UDP:c:\program files\jalbumwin\jalbumwin.exe:JalbumWin
"UDP Query User{851A26FA-95CF-4A92-800A-0C1E2A1723E4}c:\\program files\\jalbumwin\\jalbumwin.exe"= TCP:c:\program files\jalbumwin\jalbumwin.exe:JalbumWin
"TCP Query User{3F92DE79-3A57-4674-8C75-F6B23B4F0937}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\english\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\english\setup.exe:Kaspersky Internet Security 2009 Setup
"UDP Query User{EC63183C-DB43-416C-A582-CEBD6067F9EA}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\english\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\english\setup.exe:Kaspersky Internet Security 2009 Setup
"TCP Query User{3836C1C7-C0BF-4E12-A8C3-13BA6F7C504E}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{9E766CC2-B876-41B2-BE58-8637A0E37C6D}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler;c:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-12-08 204800]
R3 atikmdag;atikmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2007-04-11 2589696]
R3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2007-04-04 46592]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23ac21a0-6f1e-11dc-ada3-00030d69056d}]
\shell\AutoRun\command - G:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8212b546-e797-11dc-947f-00030d69056d}]
\shell\AutoRun\command - G:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1a6d69b-5f07-11dd-a2f4-00030d69056d}]
\shell\AutoRun\command - "F:\Install FreeAgent Tools.exe" /run
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{1f3beb4a-52ae-4712-a92a-709db533dca3} - c:\windows\system32\prrasz.dll
BHO-{3686fb73-d7a9-4b02-8ac4-282e3a5f896c} - (no file)
BHO-{3BDB1B6A-1EBA-4FA8-850C-800ADB5FAEFC} - c:\windows\system32\yaywwVPI.dll
BHO-{3DFDAF92-A870-4634-96E0-E34CA0FA70A5} - (no file)
BHO-{6A1C5703-6B76-4966-AE8D-3D0D20B5743F} - (no file)
BHO-{A7B17148-7DE1-4FF9-BB30-3B44823D847B} - (no file)
BHO-{B3E3D623-93C3-4F72-83EB-B223F41E2442} - (no file)
BHO-{FB206BAF-DFF3-4C5D-B226-5902CE72BE68} - (no file)
HKCU-Run-LaCie Backup - c:\lacie\Backup Software\\LaCieBackup.exe
HKCU-Run-Kleptomania - (no file)
HKLM-Run-MSServer - c:\windows\system32\vtUooMed.dll
HKLM-Run-74196f5b - c:\windows\system32\rkmyeywb.dll
HKLM-Run-EoEngine - (no file)
HKLM-Run-EoWeather - (no file)
HKLM-Run-Kleptomania - (no file)
ShellExecuteHooks-{D72B00A2-C507-4D84-8BF0-71BE95506210} - c:\windows\system32\vtUooMed.dll


.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\users\cj\AppData\Roaming\Mozilla\Firefox\Profiles\4q586lfs.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT722797&SearchSource=3&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.europe1.fr/informations/index.jsp
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-12 23:43:15
Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\System32\conime.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Heure de fin: 2008-11-12 23:47:36 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-12 22:47:19

Avant-CF: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Après-CF: 51,687,407,616 octets libres

247 --- E O F --- 2008-10-31 09:08:45