Infection

Résolu

concierge1 -

Bonjour,

voici ma config navigation

mon ordi est infecte, et je ne peux plus installer d anti virus ou d anti trojan, une fois l instalation faite, windows ne reconnait plus le programme.

si je lance un scan avec un des antivirus, celui se coupe et disparait du process, j ai vraiment tout essaye : divers anti virus gratuits : avg, avast, trojan killer, spybot etc...j ai desactive par ms config le fichier arking.exe, mais rien a faire je n arrive pas l enlever ni meme installer un anti virus meme pas un scan en ligne.

Pouvez m aider??

merci a vous tous

Afficher la suite

48 réponses

Résumé de la discussion

Un PC Windows XP équipé de Firefox 5.0 est gravement infecté et refuse d'installer ou de lancer des antivirus, les programmes se terminant ou disparaissant dès l'exécution. Plusieurs solutions proposées consistent à exécuter un outil de réparation comme OTL, configurer des options de rapport et partager les logs pour analyse, afin d'identifier les malwares qui bloquent les programmes. D'autres suggestions mentionnent des analyses en ligne et le nettoyage des composants système, tandis que la trace de fichiers suspects et de processus cachés est signalée dans des rapports système. En cas de défaillance persistante, des rapports OTL et les fichiers générés pourraient être transmis pour une analyse externe et l'identification d'un malware complexe.

Réponse 1 / 48
Destrio Contributeur
Tu devrais faire ceci :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Et la procédure avec OTL que tu n'avais pas pu faire. Juste pour vérifier qu'il ne reste rien d'autre.

0

Réagir
1. concierge1
  
  [color=#E56717]========== Files Created - No Company Name ==========[/color]
  
  [2011/07/13 00:20:56 | 001,383,430 | ---- | C] () -- C:\Documents and Settings\yo\Desktop\tdsskiller.zip
  [2011/07/12 22:52:51 | 1063,702,528 | -HS- | C] () -- C:\hiberfil.sys
  [2011/07/12 17:59:19 | 000,000,315 | ---- | C] () -- C:\Boot.bak
  [2011/07/12 17:59:14 | 000,260,272 | RHS- | C] () -- C:\cmldr
  [2011/07/12 17:54:20 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
  [2011/07/12 17:54:20 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
  [2011/07/12 17:54:20 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
  [2011/07/12 17:54:20 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
  [2011/07/12 17:54:20 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
  [2011/07/12 11:19:17 | 000,000,002 | RHS- | C] () -- C:\WINDOWS\winstart.bat
  [2011/07/11 19:21:01 | 000,000,164 | ---- | C] () -- C:\WINDOWS\install.dat
  [2011/07/11 19:02:01 | 000,503,642 | ---- | C] () -- C:\WINDOWS\System32\drivers\Cat.DB
  [2011/07/07 21:38:49 | 000,000,691 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CamStudio.lnk
  [2011/07/07 15:42:37 | 000,388,596 | ---- | C] () -- C:\Documents and Settings\ya\Desktop\placedesmarches.CSV
  [2011/07/07 15:35:49 | 000,000,024 | ---- | C] () -- C:\WINDOWS\System32\XLSCX.INI
  [2011/07/07 15:35:21 | 000,000,828 | ---- | C] () -- C:\Documents and Settings\ya\Desktop\Convert XLS.lnk
  [2011/07/07 15:35:20 | 000,000,530 | ---- | C] () -- C:\WINDOWS\System32\tx13_ic.ini
  [2011/07/07 15:35:19 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\CSVSpecialProcessing.dll
  [2011/07/07 15:35:19 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\SARzilla.dll
  [2011/07/07 15:35:19 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\DVM.dll
  [2011/07/07 15:35:19 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\RegisterExe.exe
  [2011/07/07 15:35:18 | 000,000,298 | ---- | C] () -- C:\WINDOWS\System32\msxml4.inf
  [2011/07/07 14:19:20 | 000,714,870 | ---- | C] () -- C:\Documents and Settings\ya\Desktop\mailister.csv
  [2011/07/07 14:15:02 | 000,723,374 | ---- | C] () -- C:\Documents and Settings\a\Desktop\email 2011.csv
  [2011/07/07 13:54:21 | 000,357,436 | ---- | C] () -- C:\Documents and Settings\la\Desktop\email2011bis.csv
  [2011/07/07 13:52:49 | 000,357,436 | ---- | C] () -- C:\Documents and Settings\ya\Desktop\email2011.csv
  [2011/07/07 11:35:35 | 000,001,779 | ---- | C] () -- C:\Documents and Settings\y\Desktop\SendBlaster.lnk
  [2011/07/04 23:09:02 | 000,004,940 | ---- | C] () -- C:\Documents and Settings\y\My Documents\olga.jpg
  [2011/07/02 13:13:41 | 000,271,072 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
  [2011/06/13 20:28:25 | 002,680,859 | ---- | C] () -- C:\WINDOWS\System32\ms98.cab
  [2011/06/13 20:28:25 | 000,030,166 | ---- | C] () -- C:\WINDOWS\System32\phidmou.inf
  [2011/06/13 20:28:25 | 000,009,808 | ---- | C] () -- C:\WINDOWS\System32\ms99.cat
  [2011/06/13 20:28:25 | 000,008,181 | ---- | C] () -- C:\WINDOWS\System32\Setup2k.ini
  [2011/06/13 20:28:25 | 000,000,184 | ---- | C] () -- C:\WINDOWS\System32\presetup.ini
  [2011/06/13 20:28:23 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\XMOUSE.CPL
  [2011/06/13 20:28:23 | 000,003,099 | ---- | C] () -- C:\WINDOWS\System32\HPMICE.PCX
  [2011/02/14 17:02:05 | 000,815,104 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
  [2011/02/14 17:02:05 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
  [2011/01/26 23:07:45 | 000,000,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTHDAEQ0.dat
  [2011/01/26 23:07:45 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\drivers\rtkhdaud.dat
  [2010/12/11 00:50:11 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
  [2010/12/04 08:29:56 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
  [2010/09/27 00:27:57 | 000,000,256 | ---- | C] () -- C:\WINDOWS\System32\pool.bin
  [2010/08/29 15:55:41 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\a\Local Settings\Application Data\housecall.guid.cache
  [2010/08/18 19:17:39 | 000,162,304 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
  [2010/08/18 19:17:39 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNRAR3.dll
  [2010/08/18 19:17:39 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
  [2010/08/18 19:17:39 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
  [2010/04/27 12:48:05 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
  [2010/02/16 21:16:13 | 000,015,872 | ---- | C] () -- C:\Documents and Settings\la\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  [2010/02/06 16:03:01 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
  [2010/02/05 21:09:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
  [2010/02/01 03:49:18 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
  [2009/12/12 07:08:49 | 000,077,824 | ---- | C] () -- C:\WINDOWS\setpwr32.exe
  [2009/12/12 07:08:40 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
  [2009/12/12 07:03:09 | 000,001,203 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
  [2009/12/12 06:04:28 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
  [2009/12/12 05:40:41 | 000,577,536 | ---- | C] () -- C:\WINDOWS\System32\EMSC.DLL
  [2009/12/12 05:39:31 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll
  [2009/12/12 05:39:30 | 002,039,808 | ---- | C] () -- C:\WINDOWS\System32\BCMWLTRY.EXE
  [2009/12/12 05:39:29 | 000,753,664 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
  [2008/05/27 05:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
  [2008/05/27 05:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
  [2008/04/26 03:47:34 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
  [2008/04/26 03:44:05 | 000,023,444 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
  [2008/04/26 03:42:57 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
  [2008/04/25 22:33:23 | 000,034,699 | ---- | C] () -- C:\WINDOWS\System32\hlp.dat
  [2008/04/25 22:33:18 | 000,438,458 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
  [2008/04/25 22:33:18 | 000,068,898 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
  [2008/04/25 22:33:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
  [2008/04/25 15:39:19 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
  [2008/04/25 15:38:33 | 000,274,968 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
  [2008/04/14 09:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
  [2008/04/14 09:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
  [2008/04/14 09:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
  [2008/04/14 09:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
  [2008/04/14 09:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
  [2008/04/14 09:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
  [2008/04/14 09:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
  [2007/09/27 18:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
  [2007/09/27 18:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
  [2007/09/27 18:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
  [2005/04/15 13:52:33 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
  [2005/04/15 13:52:33 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
  [2004/11/18 09:16:42 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\nktwab.dll
  [1996/04/03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys
  
  [color=#E56717]========== LOP Check ==========[/color]
  
  [2011/07/12 19:49:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
  [2011/07/11 23:54:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
  [2011/07/12 01:35:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
  [2011/07/13 11:42:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Easybits GO
  [2011/07/05 13:11:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eTarget
  [2011/07/12 01:35:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
  [2010/05/16 16:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OviInstallerCache
  [2009/12/12 05:45:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCDr
  [2010/09/28 22:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
  [2011/06/30 23:12:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Rosetta Stone
  [2011/07/05 13:11:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SL2o
  [2009/12/12 05:45:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
  [2011/07/11 23:27:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
  [2011/07/02 12:33:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
  [2009/12/12 05:40:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Vista32
  [2009/12/12 05:40:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Vista64
  [2009/12/12 05:40:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Win732
  [2009/12/12 05:40:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Win764
  [2010/12/19 22:46:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
  [2009/12/12 05:42:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\XP32
  [2011/07/02 12:22:19 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
  [2011/07/04 10:42:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\a\Application Data\BitTorrent
  [2011/04/18 23:11:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\y\Application Data\Eltima Software
  [2010/08/15 00:33:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\y\Application Data\FCD356BBA4E3305E0F44F6BAB40AE595
  [2011/06/02 12:39:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\y\Application Data\FrostWire
  [2011/07/13 11:42:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ya\Application Data\go
  [2010/05/30 12:17:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\yo\Application Data\Hide IP NG
  [2010/07/24 19:32:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\yla\Application Data\Ohvei
  [2010/07/30 18:03:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ya\Application Data\Oxybe
  [2010/09/11 19:46:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ya\Application Data\PhotoFiltre
  [2011/03/30 11:55:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ya\Application Data\Research In Motion
  [2011/03/21 23:24:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\a\Application Data\Sarbacane Software
  [2011/07/07 14:33:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ya\Application Data\SendBlaster2
  [2011/07/02 12:23:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ya\Application Data\TuneUp Software
  [2009/12/12 05:37:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\\Application Data\Windows Desktop Search
  [2010/02/05 20:27:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Application Data\Windows Search
  
  [color=#E56717]========== Purity Check ==========[/color]
  
  [color=#E56717]========== Alternate Data Streams ==========[/color]
  
  @Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
  @Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
  
  < End of report >
  
  0
  
  Réagir
2. Destrio Contributeur
  
  Il manque le début.
  
  0
  
  Réagir
3. concierge1
  
  oui j ai du couper ca passe pas ici le report en entier
  
  0
  
  Réagir
4. concierge1
  
  j ai malware bytes qui m a enleve les derniers ad wares et malwares...
  
  0
  
  Réagir
5. Destrio Contributeur
  
  Tu peux les héberger ici puis me donner le lien :
  http://pjjoint.malekal.com/
  
  0
  
  Réagir
Réponse 2 / 48
concierge1
merci destrio,

problemes resolus...apres une journee complete de bagarre...vais pouvoir me remettre au taf!!!

mille mercis pb resolus

0

Réagir
Réponse 3 / 48
Destrio Contributeur
C'est grâce au rapport de ComboFix que j'ai vu qu'il fallait utiliser TDSSKiller.

0

Réagir
Réponse 4 / 48
concierge1
demain je termine tout ca et je balance le report mille merci pour ton aide tout au long de la journee!!!!

topic a conserver!!

0

Réagir
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 48
concierge1
yes! ca remarche!!!!!!!!

0

Réagir
Réponse 6 / 48
Destrio Contributeur
--> Fais un scan avec TDSSKiller et poste le rapport :
https://forum.malekal.com/viewtopic.php?t=28637&start=

0

Réagir
Réponse 7 / 48
concierge1
JE Viens de le faire j ai la liste de mes dossiers...

que serait la suite

0

Réagir
Réponse 8 / 48
Destrio Contributeur
Dans le gestionnaire des tâches > Fichier > Nouvelle tâche > Tape explorer et valide.

0

Réagir
Réponse 9 / 48
concierge1
non je n ai pas reussi la restauration, j ai un windows sans icones qui s affiche... un fond d ecran uniquement...

je bataille pour retrouver le wifi...je suis connecte mais je n obtiens pas d adresse IP

0

Réagir
Réponse 10 / 48
Destrio Contributeur
Menu Démarrer > Tous les programmes > Accessoires > Outils système > Restauration du système

0

Réagir
Réponse 11 / 48
concierge1
le truc maintenant c est de trouver le pt de restau...

0

Réagir
Réponse 12 / 48
concierge1
ok je vais essayer avec combofix de faire un retour sur le point de restau

je suis sur un deuxieme pc

0

Réagir
Réponse 13 / 48
Destrio Contributeur
Au pire, si c'est dû à ComboFix, il crée un point de restauration donc tu peux en principe restaurer le PC avant l'utilisation de ComboFix.

Tu es connecté en ethernet du coup ?

0

Réagir
Réponse 14 / 48
concierge1
.
c:\documents and settings\y a\Application Data\Heed
c:\documents and settings\ys ea\Application Data\Heed\hiyzw.fei
c:\documents and settings\ys la\Application Data\Heed\hiyzw.tmp
c:\documents and settings\y a\Desktop\Internet Explorer.lnk
C:\install.exe
c:\windows\$NtUninstallKB16803$\2227124963\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\windows\$NtUninstallKB16803$\2227124963\click.tlb
c:\windows\$NtUninstallKB16803$\2227124963\L\eaoyrryi
c:\windows\$NtUninstallKB16803$\2227124963\loader.tlb
c:\windows\$NtUninstallKB16803$\2227124963\U\@00000001
c:\windows\$NtUninstallKB16803$\2227124963\U\@000000c0
c:\windows\$NtUninstallKB16803$\2227124963\U\@000000cb
c:\windows\$NtUninstallKB16803$\2227124963\U\@000000cf
c:\windows\$NtUninstallKB16803$\2227124963\U\@80000000
c:\windows\$NtUninstallKB16803$\2227124963\U\@800000c0
c:\windows\$NtUninstallKB16803$\2227124963\U\@800000cb
c:\windows\$NtUninstallKB16803$\2227124963\U\@800000cf
c:\windows\SW_Win3112X32.DLL
c:\windows\system32\drivers\1257156655.sys
c:\windows\$NtUninstallKB16803$ . . . . Failed to delete
c:\windows\$NtUninstallKB16803$\3368064693 . . . . Failed to delete
.
Infected copy of c:\windows\system32\wuauclt.exe was found and disinfected
Restored copy from - c:\windows\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^ya^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\yla\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2008-06-19 15:20 57344 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2009-01-06 23:53 2289664 ----a-w- c:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapsLKNotify]
2009-02-23 15:03 320808 ----a-w- c:\program files\CapsLKNotify\CapsLKNotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 07:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
2009-06-03 20:46 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 -c--a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-11-28 20:51 136176 ----atw- c:\documents and settings\y
ela\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 22:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-02-15 21:34 166424 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-02-15 21:34 141848 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 09:17 5252408 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]
2004-07-14 13:36 57344 ----a-w- c:\windows\system32\ICO.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 20:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OA012Mon]
2009-09-01 16:02 24576 ----a-w- c:\windows\OA012Mon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-02-15 21:34 137752 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-03-15 21:32 17529856 ------w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 09:02 26100520 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-03-15 22:49 1434920 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSED]
2009-05-27 21:24 247080 ----a-w- c:\program files\WSED\WSED.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"api32"=c:\docume~1\YO~1\LOCALS~1\Temp\apiqq.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Google Update"="c:\documents and settings\ya\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"King_ar"=c:\windows\system32\arking.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyServer = http=localhost:8118
uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 62.81.29.254 62.42.230.24
FF - ProfilePath - c:\documents and settings\ya\Application Data\Mozilla\Firefox\Profiles\k42wlqko.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://google.fr/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
.

.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(600)
c:\windows\system32\WININET.dll
.
- - - - - - - > 'lsass.exe'(660)
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(2256)
c:\windows\system32\WININET.dll
c:\windows\system32\hnetcfg.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-07-12 18:48:14 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-12 16:48
.
Pre-Run: 109,634,273,280 bytes free
Post-Run: 109,790,457,856 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\W="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 41B9C158C14D072643A9A494F63418CF

0

Réagir
1. concierge1
  
  j ai essaye de filtrer... comprends pas que je n ai plus de wifi
  
  0
  
  Réagir
Réponse 15 / 48
Anonymous404
Slt

pou voir à quoi correspond ce code d'erreur, va sur http://www.docmemo.com/windows/erreurscodes.php

0

Réagir
Réponse 16 / 48
concierge1
ComboFix 11-07-12.05 - yo 12/07/2011 18:14:15.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.711 [GMT 2:00]
Running from: c:\documents and settings\yla\My Documents\Téléchargements\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\y a\Application Data\Heed
c:\documents and settings\ys ea\Application Data\Heed\hiyzw.fei
c:\documents and settings\ys la\Application Data\Heed\hiyzw.tmp
c:\documents and settings\y a\Desktop\Internet Explorer.lnk
C:\install.exe
c:\windows\$NtUninstallKB16803$\2227124963\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\windows\$NtUninstallKB16803$\2227124963\click.tlb
c:\windows\$NtUninstallKB16803$\2227124963\L\eaoyrryi
c:\windows\$NtUninstallKB16803$\2227124963\loader.tlb
c:\windows\$NtUninstallKB16803$\2227124963\U\@00000001
c:\windows\$NtUninstallKB16803$\2227124963\U\@000000c0
c:\windows\$NtUninstallKB16803$\2227124963\U\@000000cb
c:\windows\$NtUninstallKB16803$\2227124963\U\@000000cf
c:\windows\$NtUninstallKB16803$\2227124963\U\@80000000
c:\windows\$NtUninstallKB16803$\2227124963\U\@800000c0
c:\windows\$NtUninstallKB16803$\2227124963\U\@800000cb
c:\windows\$NtUninstallKB16803$\2227124963\U\@800000cf
c:\windows\SW_Win3112X32.DLL
c:\windows\system32\drivers\1257156655.sys
c:\windows\$NtUninstallKB16803$ . . . . Failed to delete
c:\windows\$NtUninstallKB16803$\3368064693 . . . . Failed to delete
.
Infected copy of c:\windows\system32\wuauclt.exe was found and disinfected
Restored copy from - c:\windows\system32\dllcache\wuauclt.exe
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_1257156655
.
.
((((((((((((((((((((((((( Files Created from 2011-06-12 to 2011-07-12 )))))))))))))))))))))))))))))))
.
.
2011-07-12 14:59 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-12 14:59 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-12 14:59 . 2011-07-12 15:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-12 13:51 . 2011-07-12 15:18 -------- d-----w- C:\UsbFix
2011-07-12 09:25 . 2011-07-12 10:42 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-07-12 09:22 . 2011-07-12 09:22 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
2011-07-12 09:19 . 2011-07-12 09:19 2 --shatr- c:\windows\winstart.bat
2011-07-12 09:19 . 2011-07-12 09:19 -------- d-----w- c:\program files\Greatis
2011-07-12 08:58 . 2011-07-12 08:58 -------- d-----w- c:\documents and settings\ya\Local Settings\Application Data\PCHealth
2011-07-12 02:13 . 2011-07-12 02:13 -------- d-----w- c:\documents and settings\youa\Application Data\Malwarebytes
2011-07-12 01:59 . 2011-07-12 01:59 -------- d-----w- c:\windows\ServicePackFiles
2011-07-12 01:51 . 2011-07-12 01:51 -------- d-----w- C:\d3ab80f35deb7e5aea6c0ad1
2011-07-12 01:45 . 2011-07-12 01:48 -------- d-----w- C:\b304391087783dd17cae801c
2011-07-12 01:41 . 2011-07-12 01:41 -------- d-----w- C:\6eeb817ab9429940479e3bc980f0e0
2011-07-12 01:05 . 2011-07-12 01:05 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-07-11 23:35 . 2011-07-11 23:35 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-07-11 23:24 . 2011-07-11 23:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-07-11 23:15 . 2011-07-11 23:16 -------- d-----w- c:\documents and settings\Administrator
2011-07-11 22:14 . 2011-07-12 15:58 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-07-11 22:14 . 2011-07-11 22:14 -------- d-----w- c:\program files\AVAST Software
2011-07-11 21:48 . 2011-03-22 08:14 29832 ----a-w- c:\windows\system32\drivers\ssfs0bbc.sys
2011-07-11 21:48 . 2011-03-22 08:14 23176 ----a-w- c:\windows\system32\drivers\sshrmd.sys
2011-07-11 21:48 . 2011-03-22 08:14 176776 ----a-w- c:\windows\system32\drivers\ssidrv.sys
2011-07-11 21:35 . 2011-07-12 11:46 -------- d-----w- c:\program files\GridinSoft Trojan Killer
2011-07-11 17:34 . 2011-07-11 17:34 -------- d-----w- c:\program files\MSSOAP
2011-07-11 17:33 . 2011-07-11 17:33 -------- d-----w- c:\program files\Webroot
2011-07-11 17:00 . 2011-07-11 20:18 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2011-07-11 06:03 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2011-07-11 05:59 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2011-07-11 05:51 . 2011-04-29 16:19 456320 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-07-11 05:44 . 2010-12-09 13:42 2148864 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2011-07-11 05:44 . 2010-12-09 13:38 2192768 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2011-07-11 05:44 . 2010-12-09 13:07 2027008 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2011-07-11 05:44 . 2010-12-09 13:07 2069376 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2011-07-10 13:58 . 2011-07-10 14:01 -------- d-----w- c:\documents and settings\y ela\Local Settings\Application Data\Emex3
2011-07-07 19:38 . 2011-07-07 20:12 -------- d-----w- c:\program files\CamStudio
2011-07-07 11:04 . 2011-07-07 11:04 -------- d-----w- c:\documents and settings\yo ela\.spamassassin
2011-07-07 11:04 . 2011-07-07 11:04 -------- d-----w- c:\documents and settings\y ela\.razor
2011-07-07 09:38 . 2011-07-07 12:33 -------- d-----w- c:\documents and settings\u la\Application Data\SendBlaster2
2011-07-07 09:35 . 2011-07-07 09:35 65536 ----a-r- c:\documents and settings\yoa\Application Data\Microsoft\Installer\{CF950023-9C75-4843-8B68-FD8A5D641B4B}\NewShortcut2_1E583890E48F4F2CBADA36A82A9A538B.exe
2011-07-07 09:35 . 2011-07-07 09:35 65536 ----a-r- c:\documents and settings\yoa\Application Data\Microsoft\Installer\{CF950023-9C75-4843-8B68-FD8A5D641B4B}\NewShortcut1_1E583890E48F4F2CBADA36A82A9A538B.exe
2011-07-07 09:35 . 2011-07-07 09:35 -------- d-----w- c:\program files\SendBlaster
2011-07-05 11:11 . 2011-07-05 11:11 -------- d-----w- c:\documents and settings\All Users\Application Data\eTarget
2011-07-05 11:11 . 2011-07-05 11:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SL2o
2011-07-04 18:39 . 2011-07-04 18:39 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-07-04 18:39 . 2011-07-04 18:39 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-07-04 08:57 . 2011-07-04 08:57 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-07-03 21:42 . 2011-07-03 21:42 -------- d-----w- c:\documents and settings\JeJka\Application Data\go
2011-07-03 21:37 . 2011-07-03 21:37 -------- d-----w- c:\documents and settings\JeJka\Application Data\TuneUp Software
2011-07-03 10:37 . 2011-07-03 10:37 -------- d-----w- c:\documents and settings\LocalService\Application Data\TuneUp Software
2011-07-02 10:34 . 2011-06-08 11:42 29504 ----a-w- c:\windows\system32\uxtuneup.dll
2011-07-02 10:24 . 2011-06-08 11:48 31552 ----a-w- c:\windows\system32\TURegOpt.exe
2011-07-02 10:23 . 2011-07-02 10:23 -------- d-----w- c:\documents and settings\a\Application Data\TuneUp Software
2011-07-02 10:23 . 2011-07-12 10:51 -------- d-----w- c:\program files\TuneUp Utilities 2011
2011-07-02 10:22 . 2011-07-02 10:33 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2011-07-02 10:22 . 2011-07-02 10:22 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-06-22 21:21 . 2011-06-22 21:21 -------- d-----w- c:\program files\CPUID
2011-06-13 19:03 . 2011-06-13 19:04 -------- d-----w- c:\windows\_PrimaxInstallTempDir1
2011-06-13 18:19 . 2011-06-13 18:19 -------- d-----w- c:\program files\Synaptics
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-21 19:21 . 2011-05-23 17:33 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-24 17:14 . 2010-04-27 11:50 222080 -c----w- c:\windows\system32\MpSigStub.exe
2011-05-02 15:31 . 2008-04-26 01:44 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2008-04-14 07:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2008-04-14 07:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 15:51 . 2008-04-14 07:00 832512 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51 . 2008-04-14 07:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51 . 2008-04-14 07:00 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51 . 2008-04-14 07:00 17408 ----a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01 . 2008-04-14 07:00 389120 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2008-04-14 07:00 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2011-07-04 18:39 . 2011-03-24 08:10 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^ya^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\yla\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2008-06-19 15:20 57344 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2009-01-06 23:53 2289664 ----a-w- c:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapsLKNotify]
2009-02-23 15:03 320808 ----a-w- c:\program files\CapsLKNotify\CapsLKNotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 07:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
2009-06-03 20:46 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 -c--a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-11-28 20:51 136176 ----atw- c:\documents and settings\y
ela\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 22:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-02-15 21:34 166424 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-02-15 21:34 141848 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 09:17 5252408 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]
2004-07-14 13:36 57344 ----a-w- c:\windows\system32\ICO.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 20:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OA012Mon]
2009-09-01 16:02 24576 ----a-w- c:\windows\OA012Mon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-02-15 21:34 137752 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-03-15 21:32 17529856 ------w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 09:02 26100520 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-03-15 22:49 1434920 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSED]
2009-05-27 21:24 247080 ----a-w- c:\program files\WSED\WSED.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"api32"=c:\docume~1\YO~1\LOCALS~1\Temp\apiqq.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"Google Update"="c:\documents and settings\ya\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"King_ar"=c:\windows\system32\arking.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Documents and Settings\\ya\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Documents and Settings\\y\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=
"c:\\Documents and Settings\\y ela\\My Documents\\Downloads\\sdsetup_aff.exe"=
"c:\\Program Files\\TuneUp Utilities 2011\\TURatingSynch.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\MFAData\\SelfUpd\\avgmfapx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\ys ela\\My Documents\\Téléchargements\\esetsmartinstaller_fra.exe"=
"c:\\Documents and Settings\\yla\\My Documents\\Téléchargements\\ccsetup308_slim.exe"=
"c:\\Program Files\\CCleaner\\CCleaner.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [11/07/2011 23:48 29832]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [08/06/2011 13:45 1524544]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [12/12/2009 05:45 143840]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/07/2011 16:59 22712]
R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [12/12/2009 07:08 134144]
R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [12/12/2009 07:08 133632]
R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [12/12/2009 07:08 272256]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [12/12/2009 07:08 162816]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [07/10/2010 13:34 10064]
S0 cerc6;cerc6; [x]
S0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [12/12/2009 05:40 14248]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/07/2011 16:59 366640]
S2 WRConsumerService;Webroot Client Service;"c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe" --> c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/12/2009 07:08 1684736]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [12/07/2011 11:22 24416]
S4 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3873710248-4096894950-999342476-1006Core.job
- c:\documents and settings\y ela\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-28 20:51]
.
2011-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3873710248-4096894950-999342476-1006UA.job
- c:\documents and settings\yla\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-28 20:51]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyServer = http=localhost:8118
uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 62.81.29.254 62.42.230.24
FF - ProfilePath - c:\documents and settings\ya\Application Data\Mozilla\Firefox\Profiles\k42wlqko.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://google.fr/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-mcmscsvc
SafeBoot-MCODS
MSConfigStartUp-avast - c:\program files\AVAST Software\Avast\avastUI.exe
MSConfigStartUp-AVG9_TRAY - c:\progra~1\AVG\AVG9\avgtray.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
MSConfigStartUp-SpySweeper - c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe
MSConfigStartUp-sta - xfnop.dll
MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
MSConfigStartUp-TrojanScanner - c:\program files\Trojan Remover\Trjscan.exe
MSConfigStartUp-Windows Defender - c:\program files\Windows Defender\MSASCui.exe
AddRemove-Convert XLS_is1 - c:\program files\Softinterface
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-12 18:40
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: TOSHIBA_MK1655GSX rev.FG010D -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: >>UNKNOWN [0x804D7000]<< >>UNKNOWN [0xF754F000]<< >>UNKNOWN [0xF753F000]<< >>UNKNOWN [0xF73A1000]<< >>UNKNOWN [0x806E5000]<< >>UNKNOWN [0x87072EC5]<<
_asm { DEC EBP; POP EDX; NOP ; ADD [EBX], AL; ADD [EAX], AL; ADD [EAX+EAX], AL; ADD [EAX], AL; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x870FAAB8]
\Driver\Disk[0x87169968] -> IRP_MJ_CREATE -> 0xF7555BB0
3 [0xF754FFD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\00000071[0x8716A9E8]
\Driver\ACPI[0x8719CD30] -> IRP_MJ_CREATE -> 0xF73A7CB8
5 [0xF73A7620] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x87110940]
[0x87168288] -> IRP_MJ_CREATE -> 0x87072EC5
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskTOSHIBA_MK1655GSX_______________________FG010D__#5&33dc7a75&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x87072AEA
user & kernel MBR OK
sectors 312581806 (+255): user != kernel
Warning: possible TDL3 rootkit infection !
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(600)
c:\windows\system32\WININET.dll
.
- - - - - - - > 'lsass.exe'(660)
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(2256)
c:\windows\system32\WININET.dll
c:\windows\system32\hnetcfg.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-07-12 18:48:14 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-12 16:48
.
Pre-Run: 109,634,273,280 bytes free
Post-Run: 109,790,457,856 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\W="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 41B9C158C14D072643A9A494F63418CF

0

Réagir
Réponse 17 / 48
concierge1
bon j ai plus de wifi...j ai beau activer desactiver y a rien a faire j uploade le report

0

Réagir
Réponse 18 / 48
concierge1
le scan de avast a plante j ai le message suivant:

the app failed to initialize properly 0xc0000005 click ok to terminate process...

je m occupe du combofix

0

Réagir
Réponse 19 / 48
Destrio Contributeur
Ok.

0

Réagir
Réponse 20 / 48
concierge1
apres les manips j ai avast qui s est mis a jour tout seul ce qu il ne faisais pas avant...

j attends le resultat du scan pour passer sur l etape Combofix, j en profite pour te remercier car j ai vraiment avance grace a ton aide, ta presence et reactivite!

je te fais un retour asap

0

Réagir
- 1
- 2
- 3
Suivant

Infection

48 réponses

Discussions similaires

Newsletters