Infecté par le virus Mal_otorun2

Voilà le rapport UsbFix.txt :



-------------- UsbFix V2.413.2 ---------------

* User : Mike PC - MIKE-PC
* Outils mis a jours le 29/11/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 21:07:24 le 30/11/2008
* Windows Xp - Internet Explorer 7.0.5730.13


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\MIKEPC~1\LOCALS~1\Temp\7.tmp\b2e.exe
C:\WINDOWS\system32\RUNDLL32.EXE

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur fixe

H: - Lecteur amovible


+- Contenu de l'autorun : C:\autorun.inf



+- Contenu de l'autorun : D:\autorun.inf



+- Contenu de l'autorun : E:\autorun.inf



+- Contenu de l'autorun : H:\autorun.inf



--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe


+- Listing des fichiers présents :

[10/08/2005 04:25][--a------] C:\AUTOEXEC.BAT
[05/08/2004 05:00][-rahs----] C:\NTDETECT.COM
[30/05/2008 18:50][-rahs----] C:\boot.ini
[30/11/2008 19:15][d--------] C:\autorun.inf
[30/11/2008 21:07][--a------] C:\UsbFix.txt
[10/08/2005 03:55][--a------] C:\CONFIG.SYS
[10/08/2005 03:55][--a------] C:\IO.SYS
[10/08/2005 03:55][--a------] C:\MSDOS.SYS
[10/08/2005 03:55][--a------] C:\pagefile.sys
[10/08/2005 03:55][--a------] C:\hiberfil.sys

--------------- [ Lecteur D ] ----------------

D: - Lecteur fixe


+- Listing des fichiers présents :

[30/11/2008 19:15][d--------] D:\autorun.inf

--------------- [ Lecteur E ] ----------------

E: - Lecteur fixe


+- Listing des fichiers présents :

[04/08/2004 00:55][--a------] E:\setupSNK.exe
[30/11/2008 19:15][d--------] E:\autorun.inf

--------------- [ Lecteur H ] ----------------

H: - Lecteur amovible


+- Listing des fichiers présents :

[30/11/2008 19:15][d--------] H:\autorun.inf

--------------- [ Registre / Startup ] ----------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
OE="C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
msnmsgr="C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz=nwiz.exe /install
LaunchApp=Alaunch
SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
MSPY2002=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
LVCOMSX=C:\WINDOWS\system32\LVCOMSX.EXE
LogitechCameraService(E)=C:\WINDOWS\system32\ElkCtrl.exe /automation
eDataSecurity Loader=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
Acer ePresentation HPD=C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
ePower_DMC=C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
Boot=C:\Acer\Empowering Technology\ePower\Boot.exe
BluetoothAuthenticationAgent=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
eRecoveryService=C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
RTHDCPL=RTHDCPL.EXE
Alcmtr=ALCMTR.EXE
AzMixerSel=C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
pccguide.exe="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
DAEMON Tools="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
Logitech Hardware Abstraction Layer=KHALMNPR.EXE
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
Kernel and Hardware Abstraction Layer=KHALMNPR.EXE
NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

--------------- [ Registre / Mountpoint2 ] ----------------


-> Recherche négative.

--------------- [ Nettoyage des disques ] ----------------

Echec de la supression !! - [30/11/2008 19:15] C:\autorun.inf
Echec de la supression !! - [30/11/2008 19:15] C:\autorun.inf
Supprimé ! - [30/11/2008 19:15][d--------] C:\autorun.inf
Echec de la supression !! - [30/11/2008 21:07] D:\autorun.inf
Supprimé ! - [26/11/2008 17:51][-r-hs----] D:\resycled\boot.com
Echec de la supression !! - [30/11/2008 21:07] D:\autorun.inf
Supprimé ! - [30/11/2008 21:07][d--------] D:\autorun.inf
Supprimé ! - [30/11/2008 21:07][dr-hs----] D:\resycled
Echec de la supression !! - [30/11/2008 19:15] E:\autorun.inf
Supprimé ! - [26/11/2008 17:51][-r-hs----] E:\resycled\boot.com
Echec de la supression !! - [30/11/2008 19:15] E:\autorun.inf
Supprimé ! - [30/11/2008 19:15][d--------] E:\autorun.inf
Supprimé ! - [30/11/2008 18:43][dr-hs----] E:\resycled
Echec de la supression !! - [30/11/2008 19:15] H:\autorun.inf
Supprimé ! - [26/11/2008 17:51][-r-hs----] H:\resycled\boot.com
Echec de la supression !! - [30/11/2008 19:15] H:\autorun.inf
Supprimé ! - [30/11/2008 19:15][d--------] H:\autorun.inf
Supprimé ! - [30/11/2008 18:43][dr-hs----] H:\resycled

--------------- [ Resumé ] ----------------

-> /!\ Le resultat doit etre interprété par un spécialiste /!\

[10/08/2005 04:25][--a------] C:\AUTOEXEC.BAT
[05/08/2004 05:00][-rahs----] C:\NTDETECT.COM
[30/05/2008 18:50][-rahs----] C:\boot.ini
[04/08/2004 00:55][--a------] E:\setupSNK.exe

--------------- ! Fin du rapport ! ----------------

Voilà le rapport :
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1439
Windows 5.1.2600 Service Pack 3

30/11/2008 21:26:42
mbam-log-2008-11-30 (21-26-42).txt

Type de recherche: Examen rapide
Eléments examinés: 55607
Temps écoulé: 4 minute(s), 49 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 10
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\homeview (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger.H) -> Data: kdwgh.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0354fec7-59c5-4450-a23a-613110bf3189}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0354fec7-59c5-4450-a23a-613110bf3189}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{823e0a04-cf1a-49ba-a4fe-1bd7771e6edb}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{0354fec7-59c5-4450-a23a-613110bf3189}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{0354fec7-59c5-4450-a23a-613110bf3189}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{823e0a04-cf1a-49ba-a4fe-1bd7771e6edb}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{0354fec7-59c5-4450-a23a-613110bf3189}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{0354fec7-59c5-4450-a23a-613110bf3189}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{823e0a04-cf1a-49ba-a4fe-1bd7771e6edb}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.155;85.255.112.135 -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Mozilla Firefox\components\iamfamous.dll (Trojan.Agent) -> Quarantined and deleted successfully.

bonjour;
permettez moi de vous annoncer que mon pc est aussi attaqué par le même virus, et j ai bien suivie , en lisant vos messages, les instruction citées, mais malheureusement le probleme n'est pas résolu !
quand je télécharge SMITFRAUDFIX, il ne s'execute plus !!
aidez moi s'il vous plait
le rapport que j ai eu est le suivant :
----------------------------------------
Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2610
Windows 5.1.2600 Service Pack 2

12/08/2009 16:05:48
mbam-log-2009-08-12 (16-05-48).txt

Type de recherche: Examen complet (D:\|)
Eléments examinés: 130024
Temps écoulé: 21 minute(s), 40 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind (Hijack.Find) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun (Hijack.Run) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\CTFMON.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

-----------------------------------
merci d'avance pour votre aide

salut et merci pr votre réponse
le problême que j ai maintenant c'est que j arrive pas à obtenir la fenêtre de ( ctr + alt + sup) je ne reçoi q une fenetre noir avec un tiret qui se déffile . j ai télécharger RAV et il arrive à supprimer pas mal de virus .
j'ajoute ausssi que mon poste est infecté le 10/08/2009
pour ce que vous avez demandez voilà ce que j ai trouvé :

Logfile of random's system information tool 1.06 (written by random/random)
Run by YYYYYY at 2009-08-12 18:41:21
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 32 GB (42%) free of 75 GB
Total RAM: 1022 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:41:43, on 12/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Fichiers communs\Microsoft Shared\MSSearch\Bin\mssearch.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\RG7509.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\AUTOCONVE.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Micro Application\MediaDICO\MediaDICO.exe
C:\WINDOWS\ANLEAP.EXE
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\AUTOCONVE.EXE
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\youssef\Bureau\sp36657.exe
C:\Program Files\trend micro\yyyyyyy.exe
=====Scheduled tasks folder======

C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33}]
VMN Toolbar - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL [2007-08-21 1895896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-06-23 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll [2009-06-23 669168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-05-04 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - VMN Toolbar - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL [2007-08-21 1895896]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-06-23 259696]
File associations======

.reg - edit -
.reg - open - c:\Winnt\Regedit.exe %1
.scr - open - "C:\WINDOWS\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-08-12 18:41:21 ----D---- C:\rsit
2009-08-12 18:32:01 ----D---- C:\WINDOWS\Prefetch
2009-08-12 18:20:14 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-08-12 18:12:02 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-08-12 18:12:02 ----A---- C:\WINDOWS\system32\irclass.dll
2009-08-12 18:11:50 ----RA---- C:\WINDOWS\SETAE.tmp
2009-08-12 18:11:48 ----RA---- C:\WINDOWS\SETA2.tmp
2009-08-12 18:11:46 ----RA---- C:\WINDOWS\SET9F.tmp
2009-08-12 17:50:51 ----A---- C:\curr_ver.tmp
2009-08-12 17:45:40 ----RASHOT---- C:\CTFMON.EXE
2009-08-12 14:22:27 ----A---- C:\mbam-log-2009-08-12 (14-21-00).txt
2009-08-12 14:11:44 ----A---- C:\code.txt
2009-08-12 12:16:16 ----D---- C:\Documents and Settings\youssef\Application Data\Malwarebytes
2009-08-12 12:16:07 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-08-12 12:16:07 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-08-11 08:24:08 ----A---- C:\drives.txt
2009-08-11 08:22:14 ----A---- C:\DISABLE.BAT
2009-08-10 15:48:12 ----RA---- C:\WINDOWS\SETEA.tmp
2009-08-10 15:48:10 ----RA---- C:\WINDOWS\SETDE.tmp
2009-08-10 15:48:08 ----RA---- C:\WINDOWS\SETDB.tmp
2009-08-10 15:47:18 ----A---- C:\WINDOWS\setuplog.txt
2009-08-10 15:36:35 ----A---- C:\WINDOWS\UPGRADE.TXT
2009-08-10 15:36:32 ----D---- C:\WINDOWS\setup.pss
2009-08-10 14:46:49 ----RASHOT---- C:\WINDOWS\system32\AUTOCONVE.EXE
2009-08-10 14:46:49 ----RASHOT---- C:\WINDOWS\ANLEAP.EXE
2009-07-27 10:58:35 ----D---- C:\Documents and Settings\All Users\Application Data\NVIDIA
=List of files/folders modified in the last 1 months======

2009-08-12 18:41:43 ----D---- C:\Program Files\Trend Micro
2009-08-12 18:41:29 ----D---- C:\WINDOWS\system32
2009-08-12 18:41:29 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-12 18:40:22 ----D---- C:\Documents and Settings\youssef\Application Data\vmntoolbar
2009-08-12 18:38:27 ----D---- C:\WINDOWS\Temp
2009-08-12 18:37:50 ----HD---- C:\Config.Msi
2009-08-12 18:37:46 ----SHD---- C:\WINDOWS\Installer
2009-08-12 18:37:29 ----D---- C:\WINDOWS
2009-08-12 18:37:00 ----D---- C:\WINDOWS\Registration
2009-08-12 18:36:26 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-12 18:36:25 ----HD---- C:\WINDOWS\inf
2009-08-12 18:32:12 ----D---- C:\WINDOWS\system32\Restore
2009-08-12 18:31:27 ----D---- C:\WINDOWS\system32\config
2009-08-12 18:26:11 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-08-12 18:23:41 ----D---- C:\WINDOWS\security
2009-08-12 18:21:26 ----AC---- C:\WINDOWS\OEWABLog.txt
2009-08-12 18:21:15 ----AC---- C:\WINDOWS\ODBCINST.INI
2009-08-12 18:20:16 ----RD---- C:\WINDOWS\Web
2009-08-12 18:20:16 ----RD---- C:\Program Files
2009-08-12 18:20:08 ----RAHC---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-08-12 18:19:58 ----A---- C:\WINDOWS\win.ini
2009-08-12 18:19:53 ----D---- C:\WINDOWS\system32\oobe
2009-08-12 18:19:12 ----D---- C:\WINDOWS\system32\Com
2009-08-12 18:18:47 ----D---- C:\WINDOWS\system32\wbem
2009-08-12 18:17:58 ----SH---- C:\boot.ini
2009-08-12 18:13:33 ----D---- C:\WINDOWS\system32\CatRoot
2009-08-12 18:12:05 ----N---- C:\WINDOWS\system.ini
2009-08-12 18:11:55 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-08-12 18:07:27 ----D---- C:\WINDOWS\system
2009-08-12 18:07:26 ----D---- C:\WINDOWS\system32\Setup
2009-08-12 18:07:25 ----D---- C:\WINDOWS\Help
2009-08-12 18:07:16 ----D---- C:\WINDOWS\system32\usmt
2009-08-12 18:07:16 ----D---- C:\WINDOWS\system32\drivers
2009-08-12 18:07:07 ----D---- C:\WINDOWS\AppPatch
2009-08-12 18:07:06 ----D---- C:\WINDOWS\ehome
2009-08-12 18:07:05 ----D---- C:\WINDOWS\ime
2009-08-12 18:07:04 ----RSD---- C:\WINDOWS\Fonts
2009-08-12 18:07:03 ----D---- C:\WINDOWS\Media
2009-08-12 18:06:52 ----D---- C:\WINDOWS\PeerNet
2009-08-12 18:06:38 ----D---- C:\WINDOWS\system32\npp
2009-08-12 18:06:31 ----D---- C:\WINDOWS\msagent
2009-08-12 18:04:23 ----D---- C:\WINDOWS\system32\1036
2009-08-12 18:04:15 ----D---- C:\WINDOWS\twain_32
2009-08-12 18:04:00 ----D---- C:\WINDOWS\system32\icsxml
2009-08-12 18:03:29 ----D---- C:\WINDOWS\system32\ias
2009-08-12 18:03:21 ----D---- C:\WINDOWS\system32\1033
2009-08-12 18:02:01 ----D---- C:\WINDOWS\Driver Cache
2009-08-12 17:29:12 ----D---- C:\Downloads
2009-08-12 16:07:13 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-12 14:59:46 ----HD---- C:\Program Files\InstallShield Installation Information
2009-08-12 13:44:25 ----RSHD---- C:\CONFIG
2009-08-12 03:00:49 ----A---- C:\WINDOWS\imsins.BAK
2009-08-12 03:00:37 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-08-11 07:42:23 ----D---- C:\WINDOWS\SoftwareDistribution
2009-08-10 16:45:15 ----D---- C:\downoloads
2009-08-10 16:28:39 ----D---- C:\Program Files\GIF Movie Gear
2009-08-10 16:14:31 ----SHD---- C:\System Volume Information
2009-08-10 16:02:18 ----D---- C:\Program Files\Windows Media Player
2009-08-10 16:02:16 ----D---- C:\Program Files\Outlook Express
2009-08-10 16:02:16 ----D---- C:\Program Files\Fichiers communs\System
2009-08-10 16:02:12 ----D---- C:\Program Files\Internet Explorer
2009-08-10 15:54:01 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-08-10 15:38:53 ----D---- C:\WINDOWS\WinSxS
2009-07-23 15:10:51 ----A---- C:\WINDOWS\system32\HPPDEVX.DLL.l

aussi que: quand j'utilise (Ctrl+alt+sup) ou si j'execute regedit je reçoi le même message:

C:\docume~1\youssef\local~1\temp\ctfmon.exe n'est pas une application win32 valide

merci

Logfile of random's system information tool 1.06 (written by random/random)
Run by youssef at 2009-08-12 18:41:21
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 32 GB (42%) free of 75 GB
Total RAM: 1022 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:41:43, on 12/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Fichiers communs\Microsoft Shared\MSSearch\Bin\mssearch.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\RG7509.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\AUTOCONVE.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Micro Application\MediaDICO\MediaDICO.exe
C:\WINDOWS\ANLEAP.EXE
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\AUTOCONVE.EXE
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\youssef\Bureau\sp36657.exe
C:\Program Files\trend micro\youssef.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe CTFMON.EXE
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\COMPAQ\SetRefresh\\SetRefresh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AUTOCONVE] C:\WINDOWS\system32\AUTOCONVE.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MediaDico] C:\Program Files\Micro Application\MediaDICO\MediaDICO.exe Lancement
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [ANLEAP] C:\WINDOWS\ANLEAP.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [ANLEAP] C:\WINDOWS\ANLEAP.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ANLEAP] C:\WINDOWS\ANLEAP.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{E56C2820-3B42-45D6-A67B-3A77BBCFB049}: NameServer = 212.217.0.1,212.217.0.12
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: AUTODESK - Macrovision Corporation - C:\Program Files\Autodesk Network License Manager\lmgrd.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

j ai pas pu télécharger usbfix
j ai essayé d utiliser flash_disinfector mais ça n a pas marché

je l ai fait par malwarebytes

et voici le rapport
:alwarebytes' Anti-Malware 1.40
Version de la base de données: 2610
Windows 5.1.2600 Service Pack 2

13/08/2009 14:31:35
mbam-log-2009-08-13 (14-31-35).txt

Type de recherche: Examen rapide
Eléments examinés: 112731
Temps écoulé: 5 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msrmsgr (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind (Hijack.Find) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun (Hijack.Run) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\CTFMON.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svghost.exe (Trojan.Agent) -> Quarantined and deleted successfully.




pour les rapports des trois fichiers analusés :

-----------------------le 1 er fichier -----------------------

Fichier 13011d41e4305c5ef9d10407fffa67002ac85ffc.EXE reçu le 2009.05.28 12:16:04 (UTC)
Situation actuelle: terminé

Résultat: 23/40 (57.50%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.28 Trojan.Win32.Autoit!IK
AhnLab-V3 5.0.0.2 2009.05.28 -
AntiVir 7.9.0.180 2009.05.28 TR/Crypt.CFI.Gen
Antiy-AVL 2.0.3.1 2009.05.27 Trojan/Win32.Autoit
Authentium 5.1.2.4 2009.05.28 -
Avast 4.8.1335.0 2009.05.27 Win32:Trojan-gen {Other}
AVG 8.5.0.339 2009.05.28 Generic_c.AODN
BitDefender 7.2 2009.05.28 Gen:Trojan.Heur.AutoIT.3107667676
CAT-QuickHeal 10.00 2009.05.28 -
ClamAV 0.94.1 2009.05.28 PUA.Script.Packed-3
Comodo 1203 2009.05.28 -
DrWeb 5.0.0.12182 2009.05.28 -
eSafe 7.0.17.0 2009.05.27 Win32.TRCrypt.Cfi
eTrust-Vet 31.6.6526 2009.05.28 -
F-Prot 4.4.4.56 2009.05.28 -
F-Secure 8.0.14470.0 2009.05.28 Trojan.Win32.Autoit.yk
Fortinet 3.117.0.0 2009.05.28 W32/YahLover!worm
GData 19 2009.05.28 Gen:Trojan.Heur.AutoIT.3107667676
Ikarus T3.1.1.57.0 2009.05.28 -
K7AntiVirus 7.10.746 2009.05.27 -
Kaspersky 7.0.0.125 2009.05.28 Trojan.Win32.Autoit.yk
McAfee 5628 2009.05.27 W32/YahLover.worm.gen
McAfee+Artemis 5628 2009.05.27 W32/YahLover.worm.gen
McAfee-GW-Edition 6.7.6 2009.05.28 Trojan.Crypt.CFI.Gen
Microsoft 1.4701 2009.05.28 -
NOD32 4111 2009.05.28 Win32/Packed.Autoit.Gen
Norman 2009.05.28 Smalltroj.OATN
nProtect 2009.1.8.0 2009.05.28 Trojan/W32.AutoIt_Packed.326116
Panda 10.0.0.14 2009.05.28 Trj/CI.A
PCTools 4.4.2.0 2009.05.21 -
Prevx 3.0 2009.05.28 High Risk Worm
Rising 21.31.21.00 2009.05.27 -
Sophos 4.42.0 2009.05.28 Mal/Sohana-A
Sunbelt 3.2.1858.2 2009.05.28 -
Symantec 1.4.4.12 2009.05.28 -
TheHacker 6.3.4.3.333 2009.05.28 -
TrendMicro 8.950.0.1092 2009.05.28 WORM_SOHANAD.OJ
VBA32 3.12.10.6 2009.05.27 Trojan.Autoit.FINT
ViRobot 2009.5.28.1758 2009.05.28 -
VirusBuster 4.6.5.0 2009.05.27 -
Information additionnelle
File size: 326116 bytes
MD5 : b8ee55ad678e4afa6b8354f8b8d805bc
SHA1 : 06f4cf4babec2f92f98361f640bb3b77d2282c60
SHA256: 668e798483752030fee36dd0f96c079e564dc40864b1045ed92d67982b4db00e
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xA6CB0
timedatestamp.....: 0x4850E379 (Thu Jun 12 10:51:05 2008)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x6E000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x6F000 0x38000 0x38000 7.93 9240775f6ba4986bd61599417be47358
.rsrc 0xA7000 0x15000 0x14800 5.02 2ab4d41144b7941a0c95f9213b1fd7b1

( 13 imports )

> advapi32.dll: RegCloseKey
> comctl32.dll: ImageList_Create
> comdlg32.dll: GetSaveFileNameW
> gdi32.dll: LineTo
> kernel32.dll: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> mpr.dll: WNetUseConnectionW
> ole32.dll: CoInitialize
> oleaut32.dll: -
> shell32.dll: DragFinish
> user32.dll: GetDC
> version.dll: VerQueryValueW
> winmm.dll: timeGetTime
> wsock32.dll: -

( 0 exports )

TrID : File type identification
UPX compressed Win32 Executable (43.8%)
Win32 EXE Yoda's Crypter (38.1%)
Win32 Executable Generic (12.2%)
Generic Win/DOS Executable (2.8%)
DOS Executable Generic (2.8%)
ssdeep: 6144:9knN4CVUIm6uk06ZLYgvBA+8xmrxgmA+3cclptVopAf/d:ynNhuBoY8SorxgmA+nlvVlf/d
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=13011D41E4305C5EF9D10407FFFA67002AC85FFC
PEiD : -
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX
RDS : NSRL Reference Data Set
-

---------------------le 2 eme fichier----------------------------------

Fichier ctfmon.exe reçu le 2009.08.05 16:18:45 (UTC)
Situation actuelle: terminé

Résultat: 0/41 (0.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.24 2009.08.05 -
AhnLab-V3 5.0.0.2 2009.08.05 -
AntiVir 7.9.0.240 2009.08.05 -
Antiy-AVL 2.0.3.7 2009.08.05 -
Authentium 5.1.2.4 2009.08.05 -
Avast 4.8.1335.0 2009.08.05 -
AVG 8.5.0.406 2009.08.05 -
BitDefender 7.2 2009.08.05 -
CAT-QuickHeal 10.00 2009.08.05 -
ClamAV 0.94.1 2009.08.05 -
Comodo 1875 2009.08.05 -
DrWeb 5.0.0.12182 2009.08.05 -
eSafe 7.0.17.0 2009.08.05 -
eTrust-Vet 31.6.6659 2009.08.05 -
F-Prot 4.4.4.56 2009.08.04 -
F-Secure 8.0.14470.0 2009.08.05 -
Fortinet 3.120.0.0 2009.08.05 -
GData 19 2009.08.05 -
Ikarus T3.1.1.64.0 2009.08.05 -
Jiangmin 11.0.800 2009.08.05 -
K7AntiVirus 7.10.811 2009.08.05 -
Kaspersky 7.0.0.125 2009.08.05 -
McAfee 5698 2009.08.04 -
McAfee+Artemis 5698 2009.08.04 -
McAfee-GW-Edition 6.8.5 2009.08.05 -
Microsoft 1.4903 2009.08.04 -
NOD32 4309 2009.08.05 -
Norman 6.01.09 2009.08.05 -
nProtect 2009.1.8.0 2009.08.05 -
Panda 10.0.0.14 2009.08.05 -
PCTools 4.4.2.0 2009.08.05 -
Prevx 3.0 2009.08.05 -
Rising 21.41.24.00 2009.08.05 -
Sophos 4.44.0 2009.08.05 -
Sunbelt 3.2.1858.2 2009.08.05 -
Symantec 1.4.4.12 2009.08.05 -
TheHacker 6.3.4.3.375 2009.08.01 -
TrendMicro 8.950.0.1094 2009.08.05 -
VBA32 3.12.10.9 2009.08.05 -
ViRobot 2009.8.5.1869 2009.08.05 -
VirusBuster 4.6.5.0 2009.08.05 -
Information additionnelle
File size: 15360 bytes
MD5 : 5584247b568c2e53934873f4b655fe6a
SHA1 : a77492cd2a3819b44fd3c074fa584d8f128d051a
SHA256: 3911da1e2c80b8eb688524f19d3d44a290c75fbd78f7a80481c48eda323f65cc
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2E35
timedatestamp.....: 0x41107BFA (Wed Aug 4 08:02:34 2004)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2AB8 0x2C00 6.76 f366a0dc6c20b31611055c0b71f6e4d9
.data 0x4000 0x210 0x200 1.07 bd8c5cd346a9f53dc0dbc69260ab2240
.rsrc 0x5000 0x880 0xA00 3.86 32c660509abcbefb521d4bd2b88fe0fc

( 6 imports )

> advapi32.dll: RegDeleteValueA, RegOpenKeyExA, RegCloseKey, RegSetValueExA, RegCreateKeyA, RegCreateKeyExA
> kernel32.dll: lstrcpynA, lstrlenA, GetSystemDirectoryA, GetSystemWindowsDirectoryA, GetVersionExA, GetACP, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LocalFree, CloseHandle, ResetEvent, OpenEventA, CreateProcessA, lstrcatA, GetSystemInfo, lstrcmpiA, FreeLibrary, LoadLibraryA, CreateEventA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleHandleA, GetStartupInfoA, LocalAlloc, GetProcAddress
> msctf.dll: TF_InitSystem, TF_GetGlobalCompartment, TF_InvalidAssemblyListCacheIfExist, TF_InvalidAssemblyListCache, TF_PostAllThreadMsg, TF_CreateCicLoadMutex, TF_UninitSystem
> msutb.dll: ClosePopupTipbar, GetPopupTipbar
> msvcrt.dll: _controlfp, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _cexit, _XcptFilter, _exit, _c_exit
> user32.dll: EnumWindows, GetClassNameA, FindWindowA, PostMessageA, SetTimer, KillTimer, MsgWaitForMultipleObjects, PeekMessageA, TranslateMessage, DispatchMessageA, GetMessageA, SetWindowPos, LoadCursorA, RegisterClassExA, DefWindowProcA, PostQuitMessage, CreateWindowExA, GetSystemMetrics

( 0 exports )

TrID : File type identification
60.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.6% (.EXE) Win32 Executable Generic (8527/13/3)
14.7% (.DLL) Win32 Dynamic Link Library (generic) (7583/30/2)
3.9% (.EXE) Generic Win/DOS Executable (2002/3)
3.8% (.EXE) DOS Executable Generic (2000/1)


----------------- le 3 éme fichier-------------------------------------

Fichier 13011d41e4305c5ef9d10407fffa67002ac85ffc.EXE reçu le 2009.05.28 12:16:04 (UTC)
Situation actuelle: terminé

Résultat: 23/40 (57.50%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.05.28 Trojan.Win32.Autoit!IK
AhnLab-V3 5.0.0.2 2009.05.28 -
AntiVir 7.9.0.180 2009.05.28 TR/Crypt.CFI.Gen
Antiy-AVL 2.0.3.1 2009.05.27 Trojan/Win32.Autoit
Authentium 5.1.2.4 2009.05.28 -
Avast 4.8.1335.0 2009.05.27 Win32:Trojan-gen {Other}
AVG 8.5.0.339 2009.05.28 Generic_c.AODN
BitDefender 7.2 2009.05.28 Gen:Trojan.Heur.AutoIT.3107667676
CAT-QuickHeal 10.00 2009.05.28 -
ClamAV 0.94.1 2009.05.28 PUA.Script.Packed-3
Comodo 1203 2009.05.28 -
DrWeb 5.0.0.12182 2009.05.28 -
eSafe 7.0.17.0 2009.05.27 Win32.TRCrypt.Cfi
eTrust-Vet 31.6.6526 2009.05.28 -
F-Prot 4.4.4.56 2009.05.28 -
F-Secure 8.0.14470.0 2009.05.28 Trojan.Win32.Autoit.yk
Fortinet 3.117.0.0 2009.05.28 W32/YahLover!worm
GData 19 2009.05.28 Gen:Trojan.Heur.AutoIT.3107667676
Ikarus T3.1.1.57.0 2009.05.28 -
K7AntiVirus 7.10.746 2009.05.27 -
Kaspersky 7.0.0.125 2009.05.28 Trojan.Win32.Autoit.yk
McAfee 5628 2009.05.27 W32/YahLover.worm.gen
McAfee+Artemis 5628 2009.05.27 W32/YahLover.worm.gen
McAfee-GW-Edition 6.7.6 2009.05.28 Trojan.Crypt.CFI.Gen
Microsoft 1.4701 2009.05.28 -
NOD32 4111 2009.05.28 Win32/Packed.Autoit.Gen
Norman 2009.05.28 Smalltroj.OATN
nProtect 2009.1.8.0 2009.05.28 Trojan/W32.AutoIt_Packed.326116
Panda 10.0.0.14 2009.05.28 Trj/CI.A
PCTools 4.4.2.0 2009.05.21 -
Prevx 3.0 2009.05.28 High Risk Worm
Rising 21.31.21.00 2009.05.27 -
Sophos 4.42.0 2009.05.28 Mal/Sohana-A
Sunbelt 3.2.1858.2 2009.05.28 -
Symantec 1.4.4.12 2009.05.28 -
TheHacker 6.3.4.3.333 2009.05.28 -
TrendMicro 8.950.0.1092 2009.05.28 WORM_SOHANAD.OJ
VBA32 3.12.10.6 2009.05.27 Trojan.Autoit.FINT
ViRobot 2009.5.28.1758 2009.05.28 -
VirusBuster 4.6.5.0 2009.05.27 -