Probemes trojan ou autre flashy"

re,

je vais partir dans 2 jours de la personne chez qui il y a le pc en question, aussi, peux tu me donner l'essentiel a faire et peut etre un antivirus a installer histoire que cela soit potable?
Sinon, ca marche qd meme pas trop mal....
a +

Re,

bon, g fait la premiere chose avec cmd.
Pour lasuite, je ne trouve pas le 1er lien
Voici les resultats pour ceux suivant :
Sinon, que penses tu pour ma cle usb et la transformation de dossiers en exe, les donnees sont elle perdues?
2eme pb, ma carte Xd, je n'arrive plus a la lire avec mon lecteur de carte, quand je veux l'ouvrir, cale m'affiche une fenetre pour l'ouvrir avec internet explorer ou autre programme, je l'ai scannee avec AVG et avast et des ficheris ont ete mis en quarantaine, depuis cela fait cela...qu'en penses tu egalement?
merci et a plus tard

Scanner results
Scan taken on 10 Jan 2008 07:27:59 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/Emogen-P
VirusBuster Found nothing
VBA32 Found Malware.VB.67 (paranoid heuristics) (probable variant)

-------------------

Scanner results
Scan taken on 10 Jan 2008 07:38:26 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found Trojan.Downloader.Agent.YVW
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

------------------------------

pour ce lien, voici la reponse du scan : The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

-----------------------------

celui la, je ne le trouve pas non plus...

Salut

Fais Démarrer > exécuter et tape cmd
puis valide avec ok

dans la fenêtre qui va s'ouvrir, copie et colle ceci:

del /a C:\WINDOWS\Tasks\アプリケーションの& #36215;動チューンアップ.job

et valide en appuyant sur entrée

Avant de supprimer d autres entrees. Analyses les.

Vas sur le site https://virusscan.jotti.org/
- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier :
C:\WINDOWS\Installer\{90330411-6000-11D3-8CFE-0150048383C9}\cagico n.exe
- Clic sur submit toujours en haut à droite
- Le scan va se lancer, ça va prendre un petit instant
- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799

Pareil avec:

C:\WINDOWS\SYSTEM32\978FD.exe
C:\WINDOWS\SYSTEM32\llk1199018514.h << je sais pas si tu pourras celui la.
C:\WINDOWS\system32\DRIVERS\36n9pih2.sys
C:\WINDOWS\system32\279F07D0.EXE

A+

slt,

on continue....
voici les 2 rapports :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:02, on 2007/12/24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\Drivers\bwcsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\DOCUME~1\ゲスト１\LOCALS~1\Temp\HiJackThis.zip の一時ディレクトリ 1\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {8F776B2A-72DF-40C1-BD69-EDB642A706D7} - C:\WINDOWS\SYSTEM32\bho.dll (file missing)
O2 - BHO: Windows Live サインイン ヘルパー - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Tekram USB Web Camera TM-506
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKLM\..\Policies\Explorer\Run: [heu] rundll32 "C:\WINDOWS\Downlo~1\heu.dll",Run
O4 - HKLM\..\Policies\Explorer\Run: [seb] rundll32 "C:\WINDOWS\Downlo~1\seb.dll",start
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Bookshelfで検索(&L) - res://C:\PROGRAM FILES\MICROSOFT REFERENCE\MICROSOFT BOOKSHELF 3.0\BSDEF.DLL/#1001
O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: このコンテンツを引用 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Windows Live Writer でこのコンテンツに関する記事を書く(&B) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ﾒｻﾆｴﾒﾖﾉ酩・ - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing)
O9 - Extra button: リサーチ - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: ﾒﾗﾈ､ｹｺﾎ・ - {FFB2385E-E812-4091-8C12-2370DC67F769} - http://www.eachnet.com/specials/digi.html?adid=dzcm_dza_000_soft0_digi (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5C945890-327C-11D5-995C-0090272E513E} (UpdateNecXPCtl Class) - file://E:\GuideXP\obj\UpNxp.ocx
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D0FD5E32-CABD-4A6E-BD0F-94ACE89CCE03} (HGPluginJP23 Class) - http://down.hangame.co.jp/jp/dist/hgstart/HGPluginJP23.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: 584823C8 - Unknown owner - C:\WINDOWS\system32\279F07D0.EXE (file missing)
O23 - Service: 6F906650 - Unknown owner - C:\WINDOWS\system32\2E1A7558.EXE (file missing)
O23 - Service: 978FD - Unknown owner - C:\WINDOWS\system32\978FD.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BUFFALO Wireless Configuration Service (bwcsrv) - Unknown owner - C:\WINDOWS\System32\Drivers\bwcsrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod サービス (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O23 - Service: Yahoo Service (YahooSvr) - Unknown owner - C:\WINDOWS\system32\13242\svchost.exe (file missing)
O24 - Desktop Component 0: (no name) - https://www.microsoft.com/ja-jp
O24 - Desktop Component 2: アイモーニング - C:\Program Files\DigitalAdventure\imorning\start.htm
O24 - Desktop Component 3: BIGLOBE ACTIVE DESKTOP - C:\WINDOWS\WEB\Wallpaper\biglobe_adt.htm

Piou grosse infection.

On va nettoyer manuellement va !

Remet un Hijackthis et un combofix et on supprimera manuellement.

A+

re,

bon, antivir ne s'ouvrait plus aussi je l'ai desinstalle. dois je reinstalle de nouveau mais c lui qui beugue avec guardgui.exe.
un autre peu etre?
que penses tu pour ma cle usb et les fichiers .exe?
a +

Ok, demarre en mode sans echec et scanne ton pc avec antivir et met tout en quarantaine :-)

A+

re,

le pc marche mais au ralenti avec la fenetre guardgui.exe...que puis je faire?

salut,

un nouveau probleme sur le pc. au demarrage, une fenetre avec guardgui.exe bloque tout sur le bureau et quand on veut la fermer elle reapparait aussitot. la , j'ecris d'un autre pc. que peut on faire, j'ai l'impression que c l'antivirus antivir qui couille....la fenetre du bios apparait, c des kon arrive sur le bureau, plus rien ne bouge..

slt,

voici le rapport de combofix :
le pc fonctionne mieux, c sur mais l'antivirus detecte toujours les memes fichiers au memes moments 8demarrage du pc, ouverture d'internet explorer...) Doisje garder cet antivirus ou en changer?
Sinon, pour ma cle usb, y a t il une solution (cf message precedent)
merci et a +

ComboFix 07-12-21.4 - ゲスト１ 2007-12-22 11:58:54.6 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Home Edition 5.1.2600.2.932.1.1041.18.115 [GMT 9:00]
Running from: C:\Documents and Settings\ゲスト１\デスクトップ\ComboFix.exe
Command switches used :: C:\Documents and Settings\ゲスト１\デスクトップ\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\SYSTEM32\29733.exe
C:\WINDOWS\SYSTEM32\66061.exe
C:\WINDOWS\SYSTEM32\7661.dll
C:\WINDOWS\system32\drivers\sicgoe14.sys)

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_MS_2FAX
-------\LEGACY_SICGOE14
-------\ms_2fax
-------\sicgoe14

((((((((((((((((((((((((( Files Created from 2007-11-22 to 2007-12-22 )))))))))))))))))))))))))))))))
.

2007-12-30 21:41 . 2007-12-30 21:41 3,502 --a------ C:\WINDOWS\SYSTEM32\llk1199018514.h
2007-12-30 21:30 . 2007-12-30 21:30 3,502 --a------ C:\WINDOWS\SYSTEM32\llk1199017819.h
2007-12-28 12:32 . 2007-12-28 12:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-28 12:31 . 2007-12-28 12:31 <DIR> d-------- C:\Program Files\Trojan Remover
2007-12-25 12:52 . 2005-07-14 04:31 38,912 --a------ C:\WINDOWS\SYSTEM32\sha3l3xu.dll
2007-12-25 12:51 . 2007-12-25 12:51 <DIR> d-------- C:\WINDOWS\UX-MF25_50_60
2007-12-25 12:51 . 2007-12-25 12:51 <DIR> d-------- C:\Program Files\Sharp
2007-12-22 12:09 . 44,032 C:\Program Files\avp.exe
2007-12-22 11:38 . 2007-12-22 11:38 47,605 --ahs---- C:\WINDOWS\SYSTEM32\WUpdate$!.TMP
2007-12-22 11:38 . 2007-12-22 11:38 17,280 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\opengl.sys
2007-11-27 14:49 . 2007-11-27 14:49 <DIR> d-------- C:\Program Files\iPod

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 03:07 94,208 ---h--w C:\WINDOWS\SYSTEM32\29733.exe
2007-12-22 03:07 30,311 --sha-w C:\WINDOWS\SYSTEM32\smartdrv.exe
2007-12-22 03:06 4,456,448 ---ha-w C:\Documents and Settings\ゲスト１\ntuser.dat
2007-12-22 03:06 4,456,448 ---ha-w C:\Documents and Settings\ゲスト１\ntuser.dat
2007-12-21 12:31 0 ----a-w C:\WINDOWS\FONTS\cuy.dl
2007-11-21 07:12 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2007-11-21 06:49 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-21 06:49 --------- d-----w C:\Program Files\Windows Live Favorites
2007-11-21 06:28 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-11-21 06:28 --------- d-----w C:\Program Files\Windows Live
2007-11-21 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-14 07:26 450,560 ------w C:\WINDOWS\SYSTEM32\dllcache\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 08:13 --------- d-----w C:\Documents and Settings\ゲスト１\Application Data\U3
2007-10-30 10:15 3,079,680 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-10-29 22:42 1,275,904 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:42 1,275,904 ------w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-25 16:54 8,360,448 ------w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2007-10-25 00:28 222,720 ----a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-25 00:28 222,720 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-23 08:49 583,680 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-18 02:31 51,224 ----a-w C:\WINDOWS\SYSTEM32\sirenacm.dll
2007-10-11 06:12 96,256 ------w C:\WINDOWS\SYSTEM32\dllcache\inseng.dll
2007-10-11 06:12 649,728 ------w C:\WINDOWS\SYSTEM32\dllcache\wininet.dll
2007-10-11 06:12 611,328 ------w C:\WINDOWS\SYSTEM32\dllcache\urlmon.dll
2007-10-11 06:12 55,808 ------w C:\WINDOWS\SYSTEM32\dllcache\extmgr.dll
2007-10-11 06:12 532,480 ------w C:\WINDOWS\SYSTEM32\dllcache\mstime.dll
2007-10-11 06:12 473,600 ------w C:\WINDOWS\SYSTEM32\dllcache\shlwapi.dll
2007-10-11 06:12 449,024 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtmled.dll
2007-10-11 06:12 39,424 ------w C:\WINDOWS\SYSTEM32\dllcache\pngfilt.dll
2007-10-11 06:12 357,888 ------w C:\WINDOWS\SYSTEM32\dllcache\dxtmsft.dll
2007-10-11 06:12 250,880 ------w C:\WINDOWS\SYSTEM32\dllcache\iepeers.dll
2007-10-11 06:12 205,312 ------w C:\WINDOWS\SYSTEM32\dllcache\dxtrans.dll
2007-10-11 06:12 16,384 ------w C:\WINDOWS\SYSTEM32\dllcache\jsproxy.dll
2007-10-11 06:12 151,040 ------w C:\WINDOWS\SYSTEM32\dllcache\cdfview.dll
2007-10-11 06:12 146,432 ------w C:\WINDOWS\SYSTEM32\dllcache\msrating.dll
2007-10-11 06:12 1,494,528 ------w C:\WINDOWS\SYSTEM32\dllcache\shdocvw.dll
2007-10-11 06:12 1,051,136 ------w C:\WINDOWS\SYSTEM32\dllcache\danim.dll
2007-10-11 06:12 1,023,488 ------w C:\WINDOWS\SYSTEM32\dllcache\browseui.dll
2007-10-10 11:16 18,432 ----a-w C:\WINDOWS\SYSTEM32\dllcache\iedw.exe
2007-09-17 06:56 62,024 ----a-w C:\Documents and Settings\NEC-PCuser\Application Data\GDIPFONTCACHEV1.DAT
2002-05-28 07:24 7,717 ----a-w C:\Program Files\DeIsL1.isu
2001-03-07 01:44 271 --sh--w C:\Program Files\desktop.ini
2001-03-07 01:44 23,659 ---ha-w C:\Program Files\folder.htt
2002-12-16 11:29 8 --sh--w C:\WINDOWS\DRM\pdrm.dat
.

((((((((((((((((((((((((((((( snapshot@2005-12-21_11.45.24.86 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-12-24 08:35:20 16,384 ----a-w C:\WINDOWS\1542.exe
- 2007-12-29 00:12:34 53,248 ----a-r C:\WINDOWS\7d01.exe
+ 2008-01-04 00:33:04 53,248 ----a-r C:\WINDOWS\7d01.exe
+ 2006-07-11 00:41:36 345,656 ----a-w C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
+ 2005-12-21 11:44:22 93,392 ----a-w C:\WINDOWS\SYSTEM32\[u]0[/u]31.exe
+ 2005-12-22 05:45:24 92,672 ----a-w C:\WINDOWS\SYSTEM32\978FD.exe
+ 2005-12-24 08:35:18 16,384 ----a-w C:\WINDOWS\SYSTEM32\admin6_ver1231.exe
- 2005-12-31 02:09:14 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
+ 2007-01-04 01:37:50 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
- 2005-12-31 02:09:14 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-01-04 01:37:50 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-12-22 05:51:34 20,541 ----a-w C:\WINDOWS\SYSTEM32\detoured.dll
+ 2007-08-09 04:04:12 40,768 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys
+ 2007-07-18 05:22:20 21,312 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntmgr.sys
+ 2005-12-21 14:49:42 61,632 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avipbb.sys
+ 2007-04-16 15:53:08 11,776 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\sicgoe14.sys
+ 2007-03-01 01:34:38 28,352 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\ssmdrv.sys
+ 2005-12-24 08:08:40 21,120 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\winsys.sys
+ 2005-05-16 10:34:48 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2006-03-20 04:17:20 798,720 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8F776B2A-72DF-40C1-BD69-EDB642A706D7}]
C:\WINDOWS\SYSTEM32\bho.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 16:55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG9.0"="C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.exe" [2005-03-17 14:40]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Mini\3.2\Apps\apdproxy.exe" [2007-04-27 15:44]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2005-12-24 17:43]
"BigDogPath"="C:\WINDOWS\VM_STI.exe" [2003-01-21 16:19]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-21 18:57]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2005-12-21 23:49]
"BootClean"="smartdrv.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"McAfeeVirusScanService"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="ctfmon.exe" [2004-08-04 16:55 C:\WINDOWS\SYSTEM32\ctfmon.exe]

C:\Documents and Settings\All Users\スタート メニュー\プログラム\スタートアップ\
QuickShelf.lnk - C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\qshelf.exe [2000-12-20 19:06:14]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Source= C:\Program Files\DigitalAdventure\imorning\start.htm
FriendlyName= アイモーニング

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
Source= C:\WINDOWS\WEB\Wallpaper\biglobe_adt.htm
FriendlyName= BIGLOBE ACTIVE DESKTOP

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"Hidserv"=Hidserv.exe run
"NMFTASK"=NMFTASK.EXE /RESET
"NECTVRC"=C:\PROGRA~1\nectvrc\tvrc.exe
"Alogserv"=C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
"NECMFK"=C:\PROGRA~1\necmfk\necmfk.exe
"LoadQM"=loadqm.exe

R0 36n9pih2;36n9pih;C:\WINDOWS\system32\DRIVERS\36n9pih2.sys [2004-08-04 16:55]
R2 bwcdrv;BUFFALO Wireless Configuration;C:\WINDOWS\system32\DRIVERS\bwcdrv.sys [2003-12-21 17:21]
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2001-08-24 12:40]
R3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2005-11-01 17:13]
R3 Ptserli;PCTEL Serial Device Driver for INTEL;C:\WINDOWS\system32\DRIVERS\ptserli.sys [2001-08-17 13:28]
S2 584823C8;584823C8;C:\WINDOWS\system32\279F07D0.EXE -k []
S2 6F906650;6F906650;C:\WINDOWS\system32\2E1A7558.EXE -g []
S2 978FD;978FD;C:\WINDOWS\system32\978FD.exe [2005-12-22 14:45]
S2 rbwzjc14;rbwzjc14;C:\WINDOWS\system32\drivers\rbwzjc14.sys []
S2 sysloader;System Event loader;"C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe" []
S2 WinCOM;COM+ Windows System;C:\WINDOWS\system32\wincom.exe []
S2 YahooSvr;Yahoo Service;C:\WINDOWS\system32\13242\svchost.exe []
S2 Yiqilai;ﾒｻﾆｴﾒﾖﾖ摠ﾖ;"C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.exe" [2005-12-21 19:04]
S3 BT848;NEC TV Tuner Unit/ Bt878 WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.sys [2001-08-23 13:59]
S3 BTTUNER;NEC TV Tuner Unit/ Bt878 WDM Tv Tuner;C:\WINDOWS\system32\drivers\BTTUNER.sys [2001-08-23 13:59]
S3 BTXBAR;NEC TV Tuner Unit/ Bt878 WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.sys [2001-08-23 13:59]
S3 Ndisprot;Network Monitor Protocol Driver;C:\WINDOWS\system32\DRIVERS\winsys.sys [2005-12-24 17:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3532da70-b087-11dc-978f-001601234175}]
\Shell\AutoRun\command - F:\autorun.exe
\Shell\Open\command - F:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b1d4cec1-af7e-11dc-978d-001601234175}]
\Shell\AutoRun\command - G:\autorun.exe
\Shell\Open\command - G:\autorun.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-05 14:00:02 C:\WINDOWS\Tasks\アプリケーションの起動チューンアップ.job"
"2007-12-22 02:52:02 C:\WINDOWS\Tasks\有効期間の確認通知のアンインストール.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2007-12-22 02:37:04 C:\WINDOWS\Tasks\データ収集の PCHealth スケジューラ.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2007-12-29 14:35:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-12-22 02:41:02 C:\WINDOWS\Tasks\Windows Live Toolbar の更新プログラムを確認します.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 12:09:06
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\OpenGL]
"ImagePath"="system32\DRIVERS\opengl.sys"
.
Completion time: 2007-12-22 12:10:56 - machine was rebooted [ゲスト１]
C:\ComboFix2.txt ... 2005-12-21 11:47
.
2007-12-22 14:26:36 --- E O F ---

Re,

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
C:\WINDOWS\system32\7661.dll
C:\WINDOWS\SYSTEM32\bho.dll 
C:\WINDOWS\WSockDrv32.exe
C:\WINDOWS\LotusHlp.exe
C:\WINDOWS\PTSShell.exe
C:\WINDOWS\351677L.exe
C:\WINDOWS\NAVMon32.exE
C:\WINDOWS\WINSvr32.exE
C:\WINDOWS\RegSrv64D.exE
C:\WINDOWS\SHAProc.exe
C:\WINDOWS\mppds.exe
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\AVPSrv.exE
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\WinForm.exE
C:\WINDOWS\MsPrint32D.exe
C:\WINDOWS\msccrt.exe
C:\WINDOWS\351677M.exe 
C:\WINDOWS\Downlo~1\heu.dll
C:\WINDOWS\Downlo~1\seb.dll
C:\WINDOWS\system32\279F07D0.EXE 
C:\WINDOWS\system32\2E1A7558.EXE 
C:\WINDOWS\system32\978FD.exe
C:\WINDOWS\system32\13242\svchost.exe

Enregistre ce fichier sous le nom CFScript

[*]Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
[*]Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) ,tape 1 puis valide.
[*]Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
[*]Une fois le scan achevé, un rapport va s'afficher: poste son contenu, en précisant où en sont tes soucis

[*]Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

re,

voici le rapport d'hijackthis mais combofix deconne. Il fait le scan mais apres il n'aparait plus rien sur le bureau et combo se met a effacer eds fichiers alors je le coupe et suis oblige de redemarrer le pc...
pour ma cle, infectee par flashy et fichier photo transforme en .exe. Pour autant, quand on la scanne, on voittoutes les fichiers photos defiler. est-ce recuperable?
sinon, l'antirus detecte tout le temps des trucs et il fait sonner la tour, c un peu gavant. Le pc est-il toujours aussi infecte?

a+

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:09, on 2007-12-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\Drivers\bwcsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\qshelf.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\66061.exe
C:\DOCUME~1\ゲスト１\LOCALS~1\Temp\HiJackThis.zip の一時ディレクトリ 2\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Invoke Class - {5FB8C5D4-929F-4870-89E2-7E3EE26EE701} - C:\WINDOWS\system32\7661.dll
O2 - BHO: (no name) - {8F776B2A-72DF-40C1-BD69-EDB642A706D7} - C:\WINDOWS\SYSTEM32\bho.dll (file missing)
O2 - BHO: Windows Live サインイン ヘルパー - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Mini\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Tekram USB Web Camera TM-506
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BootClean] smartdrv.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [heu] rundll32 "C:\WINDOWS\Downlo~1\heu.dll",Run
O4 - HKLM\..\Policies\Explorer\Run: [seb] rundll32 "C:\WINDOWS\Downlo~1\seb.dll",start
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Bookshelfで検索(&L) - res://C:\PROGRAM FILES\MICROSOFT REFERENCE\MICROSOFT BOOKSHELF 3.0\BSDEF.DLL/#1001
O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: このコンテンツを引用 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Windows Live Writer でこのコンテンツに関する記事を書く(&B) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ﾒｻﾆｴﾒﾖﾉ酩・ - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing)
O9 - Extra button: リサーチ - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: ﾒﾗﾈ､ｹｺﾎ・ - {FFB2385E-E812-4091-8C12-2370DC67F769} - http://www.eachnet.com/specials/digi.html?adid=dzcm_dza_000_soft0_digi (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5C945890-327C-11D5-995C-0090272E513E} (UpdateNecXPCtl Class) - file://E:\GuideXP\obj\UpNxp.ocx
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D0FD5E32-CABD-4A6E-BD0F-94ACE89CCE03} (HGPluginJP23 Class) - http://down.hangame.co.jp/jp/dist/hgstart/HGPluginJP23.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: 584823C8 - Unknown owner - C:\WINDOWS\system32\279F07D0.EXE (file missing)
O23 - Service: 6F906650 - Unknown owner - C:\WINDOWS\system32\2E1A7558.EXE (file missing)
O23 - Service: 978FD - Unknown owner - C:\WINDOWS\system32\978FD.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BUFFALO Wireless Configuration Service (bwcsrv) - Unknown owner - C:\WINDOWS\System32\Drivers\bwcsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod サービス (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)
O23 - Service: COM+ Windows System (WinCOM) - Unknown owner - C:\WINDOWS\system32\wincom.exe (file missing)
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O23 - Service: Yahoo Service (YahooSvr) - Unknown owner - C:\WINDOWS\system32\13242\svchost.exe (file missing)
O23 - Service: ﾒｻﾆｴﾒﾖﾖ摠ﾖ (Yiqilai) - Yiqilai - C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.exe
O24 - Desktop Component 0: (no name) - https://www.microsoft.com/ja-jp
O24 - Desktop Component 2: アイモーニング - C:\Program Files\DigitalAdventure\imorning\start.htm
O24 - Desktop Component 3: BIGLOBE ACTIVE DESKTOP - C:\WINDOWS\WEB\Wallpaper\biglobe_adt.htm

Ouch énorme bilan.

Tu redemarres et tu remet un nouveau Hijackthis et un nouveau Combofix.

Au fait ta clé USB était infecté?

A+

Re,

hijackthis, ok
antivirus installe et mis a jour
Scan ok mais je ne vais pas te mettre le rapport car il est un peu long!!! Aussi, juste les dernieres lignes pour infos..C'etait vraiment long et dur pour les oreilles car il fait sonner la tour a chaque detection....l'ordi etant dans la piece a vivre....
Quelles est la suite du programme?
A plus

End of the scan: 2007-01-04 12:51
Used time: 1:57:51 min

The scan has been done completely.

8024 Scanning directories
311263 Files were scanned
3605 viruses and/or unwanted programs were found
111 Files were classified as suspicious:
0 files were deleted
0 files were repaired
3716 files were moved to quarantine
0 files were renamed
5 Files cannot be scanned
307658 Files not concerned
2415 Archives were scanned
5 Warnings
27 Notes

C'est normal que ca beug, y a trop d infections, on va essayer de bricoler un truc rapide:

Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

O4 - HKLM\..\Run: [WSockDrv32] C:\WINDOWS\WSockDrv32.exe
O4 - HKLM\..\Run: [LotusHlp] C:\WINDOWS\LotusHlp.exe
O4 - HKLM\..\Run: [PTSShell] C:\WINDOWS\PTSShell.exe
O4 - HKLM\..\Run: [WinSysW] C:\WINDOWS\351677L.exe
O4 - HKLM\..\Run: [NAVMon32] C:\WINDOWS\NAVMon32.exE
O4 - HKLM\..\Run: [WINSvr32] C:\WINDOWS\WINSvr32.exE
O4 - HKLM\..\Run: [RegSrv64D] C:\WINDOWS\RegSrv64D.exE
O4 - HKLM\..\Run: [XiaoiDesktop] C:\Program Files\Incesoft\XiaoiAlerts\XiaoiUpdater.exe /hide
O4 - HKLM\..\Run: [SHAProc] C:\WINDOWS\SHAProc.exe
O4 - HKLM\..\Run: [mppds] C:\WINDOWS\mppds.exe
O4 - HKLM\..\Run: [upxdnd] C:\WINDOWS\upxdnd.exe
O4 - HKLM\..\Run: [AVPSrv] C:\WINDOWS\AVPSrv.exE
O4 - HKLM\..\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe
O4 - HKLM\..\Run: [WinForm] C:\WINDOWS\WinForm.exE
O4 - HKLM\..\Run: [MsPrint32D] C:\WINDOWS\MsPrint32D.exe
O4 - HKLM\..\Run: [msccrt] C:\WINDOWS\msccrt.exe
O4 - HKLM\..\Run: [WinSysM] C:\WINDOWS\351677M.exe
O4 - HKLM\..\Run: [NVDispDrv] C:\WINDOWS\NVDispDRV.EXE
O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\System\MOSearch\Bin\mosearch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [seb] rundll32 "C:\WINDOWS\Downlo~1\seb.dll",start
O4 - HKLM\..\Policies\Explorer\Run: [heu] rundll32 "C:\WINDOWS\Downlo~1\heu.dll",Run

Ferme Hijackthis.

Ca mettonnerait que l'antivirus s'installe, met essaie quand même:
https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/13198.html

Un tuto pour antivir.

Tu le met a jour et tu fais un scan complet de ton pc, a chaque alerte, met le en quarantaine.

Si cela ne fonctionne pas, on les vireras manuellement, je reviens en fin d'aprem.

A+

re,

kaspersky et avg ne marche pas. je te remets hijackthis apres bug. le pc redemarre mais des bugs nombreux, toujours comme avant. peux tu m'indiquer rapidement un antivirus car trop de bug

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:22, on 2005-12-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\Drivers\bwcsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\66061.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\13242\svchost.exe
C:\WINDOWS\system32\13242\ctfmon.exe
C:\Program Files\Adobe\Photoshop Album Mini\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Incesoft\XiaoiAlerts\XiaoiDesktop.exe
C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\qshelf.exe
C:\WINDOWS\system32\13242\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\PenPlusÊß°¿ÅÙ\PenHusen.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\13242\ctfmon.exe
C:\Documents and Settings\ƒQƒXƒg‚P\My Documents\setupƒ\ƒtƒg\Plauto.exe
C:\Program Files\Exif Launcher\QuickDCF.exe
C:\NECAMENU\NActMenu.exe
C:\WINDOWS\system32\13242\ctfmon.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\13242\ctfmon.exe
C:\WINDOWS\system32\13242\ctfmon.exe
C:\WINDOWS\system32\13242\ctfmon.exe
C:\DOCUME~1\ƒQƒXƒg‚P\LOCALS~1\Temp\HiJackThis.zip ‚̈ꎞƒfƒBƒŒƒNƒgƒŠ 3\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll
O2 - BHO: Invoke Class - {5FB8C5D4-929F-4870-89E2-7E3EE26EE701} - C:\WINDOWS\system32\7661.dll
O2 - BHO: (no name) - {8F776B2A-72DF-40C1-BD69-EDB642A706D7} - C:\WINDOWS\SYSTEM32\bho.dll
O2 - BHO: Windows Live ƒTƒCƒ“ƒCƒ“ ƒwƒ‹ƒp[ - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Mini\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Tekram USB Web Camera TM-506
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WSockDrv32] C:\WINDOWS\WSockDrv32.exe
O4 - HKLM\..\Run: [LotusHlp] C:\WINDOWS\LotusHlp.exe
O4 - HKLM\..\Run: [PTSShell] C:\WINDOWS\PTSShell.exe
O4 - HKLM\..\Run: [WinSysW] C:\WINDOWS\351677L.exe
O4 - HKLM\..\Run: [NAVMon32] C:\WINDOWS\NAVMon32.exE
O4 - HKLM\..\Run: [WINSvr32] C:\WINDOWS\WINSvr32.exE
O4 - HKLM\..\Run: [RegSrv64D] C:\WINDOWS\RegSrv64D.exE
O4 - HKLM\..\Run: [XiaoiDesktop] C:\Program Files\Incesoft\XiaoiAlerts\XiaoiUpdater.exe /hide
O4 - HKLM\..\Run: [SHAProc] C:\WINDOWS\SHAProc.exe
O4 - HKLM\..\Run: [mppds] C:\WINDOWS\mppds.exe
O4 - HKLM\..\Run: [upxdnd] C:\WINDOWS\upxdnd.exe
O4 - HKLM\..\Run: [AVPSrv] C:\WINDOWS\AVPSrv.exE
O4 - HKLM\..\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe
O4 - HKLM\..\Run: [WinForm] C:\WINDOWS\WinForm.exE
O4 - HKLM\..\Run: [MsPrint32D] C:\WINDOWS\MsPrint32D.exe
O4 - HKLM\..\Run: [msccrt] C:\WINDOWS\msccrt.exe
O4 - HKLM\..\Run: [WinSysM] C:\WINDOWS\351677M.exe
O4 - HKLM\..\Run: [NVDispDrv] C:\WINDOWS\NVDispDRV.EXE
O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\System\MOSearch\Bin\mosearch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [seb] rundll32 "C:\WINDOWS\Downlo~1\seb.dll",start
O4 - HKLM\..\Policies\Explorer\Run: [heu] rundll32 "C:\WINDOWS\Downlo~1\heu.dll",Run
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Bookshelf‚ÅŒŸõ(&L) - res://C:\PROGRAM FILES\MICROSOFT REFERENCE\MICROSOFT BOOKSHELF 3.0\BSDEF.DLL/#1001
O8 - Extra context menu item: Microsoft Excel ‚ɃGƒNƒXƒ|[ƒg(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: ‚±‚̃Rƒ“ƒeƒ“ƒc‚ðˆø—p - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Windows Live Writer ‚Å‚±‚̃Rƒ“ƒeƒ“ƒc‚ÉŠÖ‚·‚é‹LŽ–‚ð‘‚­(&B) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Ò»ÆðÀ´ÒôÀÖÉçÇE - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing)
O9 - Extra button: ƒŠƒT[ƒ` - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5C945890-327C-11D5-995C-0090272E513E} (UpdateNecXPCtl Class) - file://E:\GuideXP\obj\UpNxp.ocx
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D0FD5E32-CABD-4A6E-BD0F-94ACE89CCE03} (HGPluginJP23 Class) - http://down.hangame.co.jp/jp/dist/hgstart/HGPluginJP23.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: 584823C8 - Unknown owner - C:\WINDOWS\system32\279F07D0.EXE
O23 - Service: 978FD - Unknown owner - C:\WINDOWS\system32\978FD.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BUFFALO Wireless Configuration Service (bwcsrv) - Unknown owner - C:\WINDOWS\System32\Drivers\bwcsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod ƒT[ƒrƒX (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Yahoo Service (YahooSvr) - Unknown owner - C:\WINDOWS\system32\13242\svchost.exe
O23 - Service: Ò»ÆðÀ´ÒôÀÖÖúÊÖ (Yiqilai) - Yiqilai - C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.exe
O24 - Desktop Component 0: (no name) - https://www.microsoft.com/ja-jp
O24 - Desktop Component 2: ƒAƒCƒ‚[ƒjƒ“ƒO - C:\Program Files\DigitalAdventure\imorning\start.htm
O24 - Desktop Component 3: BIGLOBE ACTIVE DESKTOP - C:\WINDOWS\WEB\Wallpaper\biglobe_adt.htm

Bha apparemment windows ne se lance pas.
Ok pour l"ecran mais pour la tour, que fais t elle, elle s'eteint aussi?

rebonjour,

non, l'ecran s'allume et s'eteint aussitot....rien n'apparait...
Que se passe-t-il?

Bonjour,

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

A bientôt

Ci dessous moin COMBO fix
Merci
@+

ComboFix 07-12-31.4 - JK 2008-01-02 18:26:08.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.846 [GMT 1:00]
Running from: C:\Documents and Settings\JK\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\JK\ravmonlog
C:\WINDOWS\system32\Flashy.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2007-12-02 to 2008-01-02 ))))))))))))))))))))))))))))))))))))
.

2008-01-02 18:24 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-02 17:42 . 2008-01-02 17:42 <REP> d-------- C:\WINDOWS\LastGood
2008-01-02 16:49 . 2008-01-02 16:57 512 --a------ C:\WINDOWS\randseed.rnd
2008-01-02 12:49 . 2008-01-02 12:49 <REP> d-------- C:\Documents and Settings\Test\WINDOWS
2008-01-02 12:49 . 2008-01-02 12:49 <REP> d--h----- C:\Documents and Settings\Test\Voisinage réseau
2008-01-02 12:49 . 2008-01-02 12:49 <REP> d--h----- C:\Documents and Settings\Test\Voisinage d'impression
2008-01-02 12:49 . 2008-01-02 12:49 <REP> dr------- C:\Documents and Settings\Test\Menu Démarrer
2008-01-02 12:49 . 2008-01-02 12:49 <REP> d-------- C:\Documents and Settings\Test\Bureau
2008-01-02 12:08 . 2008-01-02 12:08 <REP> d-------- C:\Documents and Settings\All Users\Données d'applications
2008-01-02 12:07 . 2008-01-02 12:07 <REP> d-------- C:\Program Files\Fichiers communs\Network Associates
2008-01-02 12:07 . 2008-01-02 12:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Network Associates
2008-01-01 19:24 . 2008-01-02 12:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 19:19 . 2008-01-02 12:49 <REP> d-------- C:\Documents and Settings\Test\Application Data\Skype
2008-01-01 19:18 . 2008-01-02 12:49 <REP> d--h----- C:\Documents and Settings\Test\Modèles
2008-01-01 19:18 . 2008-01-02 12:49 <REP> d---s---- C:\Documents and Settings\Test\Mes documents
2008-01-01 19:18 . 2008-01-02 12:49 <REP> d---s---- C:\Documents and Settings\Test\Favoris
2008-01-01 19:18 . 2007-01-27 20:24 <REP> d-------- C:\Documents and Settings\Test\Application Data\Intel
2008-01-01 19:18 . 2008-01-01 19:18 <REP> d-------- C:\Documents and Settings\Test\Application Data\FarStone
2008-01-01 19:18 . 2008-01-01 19:18 <REP> d-------- C:\Documents and Settings\Test\Application Data\Crystal Art Software
2008-01-01 19:18 . 2008-01-01 19:18 <REP> d-------- C:\Documents and Settings\Test\Application Data\3M
2008-01-01 17:43 . 2008-01-01 17:43 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-01 17:12 . 2008-01-01 17:12 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-01-01 15:30 . 2008-01-01 15:30 <REP> d-------- C:\Documents and Settings\JK\Application Data\TuneUp Software
2007-12-31 07:07 . 2007-12-31 07:07 <REP> d-------- C:\WINDOWS\Downloaded Installations
2007-12-27 15:44 . 2008-01-02 16:30 1,409 --a------ C:\WINDOWS\system32\Postin__.FOT
2007-12-21 10:22 . 2007-12-21 10:22 118 --a------ C:\WINDOWS\system32\MRT.INI
2007-12-19 01:56 . 2007-12-19 01:56 <REP> d--hs---- C:\WINDOWS\ftpcache
2007-12-19 01:55 . 2008-01-01 16:02 <REP> d-------- C:\Documents and Settings\JK\Application Data\U3
2007-12-09 03:10 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2007-12-09 03:10 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\dllcache\sonypvu1.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 15:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-02 11:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-26 04:22 --------- d-----w C:\Documents and Settings\JK\Application Data\Skype
2007-12-01 02:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 23:23 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:36 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:36 1,293,824 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-10 23:49 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-10 23:49 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-10 23:49 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-10 23:49 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-10 23:49 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-10 23:49 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-10 23:49 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-10 23:49 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-10-10 23:49 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-10-10 23:49 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-10 23:49 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-10 23:49 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-10 23:49 232,960 ----a-w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-10-10 23:49 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-10-10 23:49 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-10 23:49 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-10 23:49 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-10-10 23:49 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-10 23:49 124,928 ----a-w C:\WINDOWS\system32\dllcache\advpack.dll
2007-10-10 23:49 105,984 ----a-w C:\WINDOWS\system32\dllcache\url.dll
2007-10-10 23:49 102,400 ----a-w C:\WINDOWS\system32\dllcache\occache.dll
2007-10-10 23:49 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-10 11:00 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-10-10 11:00 625,152 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-10 05:46 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2005-09-09 18:55 7,155,864 ----a-w C:\Program Files\NGhost10.msi
2005-09-09 18:55 4,588,454 ----a-w C:\Program Files\setup.exe
2005-09-09 18:55 37,766,164 ----a-w C:\Program Files\Data1.cab
2005-09-09 18:55 35 ----a-w C:\Program Files\SCSSDist.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-24 20:00 15360]
"SuperCopier2.exe"="C:\Logiciels\SuperCopier2\SuperCopier2.exe" [2006-07-07 17:45 1052672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-20 05:58 7581696]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-20 05:58 86016]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-08-02 00:38 802816]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-02 00:32 696320]
"ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 15:20 180224]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-06 17:13 86016]
"ACMON"="C:\Program Files\ASUS\Splendid\ACMON.exe" [2006-05-30 10:28 811008]
"DirectMessenger"="C:\Program Files\ASUS\ASUS Direct Console\LCMP.EXE" [2006-09-26 09:46 985088]
"VirtualDrive"="c:\Program Files\FarStone\VirtualDrive\VDTask.exe" [2005-07-06 13:35 143360]
"RAMDrive"="c:\Program Files\FarStone\VirtualDrive\VHD\RDTask.exe" [2004-09-14 16:24 36864]
"nod32kui"="C:\Logiciels\Nod32\nod32kui.exe" [2007-01-28 15:17 917504]
"Crystal Internet Meter"="C:\Logiciels\Crystal meter\cimeter.exe" [2002-09-04 04:30 2221568]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 14:52 849280]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-07-28 07:04 110592]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-13 23:00 16050176 C:\WINDOWS\RTHDCPL.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-20 23:26 761945]
"nwiz"="nwiz.exe" [2006-07-20 05:58 1519616 C:\WINDOWS\system32\nwiz.exe]
"ShStatEXE"="C:\Logiciels\MCaffee\SHSTAT.exe" [2003-09-29 07:10 81990]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2006-03-24 20:00 160768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-24 20:00 15360]

C:\Documents and Settings\JK\Menu D‚marrer\Programmes\D‚marrage\
Stardock ObjectDock.lnk - C:\Logiciels\Vista Inspirat\ObjectDock\ObjectDock.exe [2005-02-21 14:56:00]
Y'z ToolBar.lnk - C:\Logiciels\Vista Inspirat\YzToolbar\YzToolBar.exe [2002-09-29 14:41:00]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-02-02 22:19:10]
MultiFrame.lnk - C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe [2007-01-27 20:26:02]
Post-it© Software Notes.lnk - C:\Logiciels\Post it\Psn2.exe [2002-04-26 16:19:44]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^ASUS ChkMail.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\ASUS ChkMail.lnk
backup=C:\WINDOWS\pss\ASUS ChkMail.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=C:\WINDOWS\pss\Outil de mise à jour Google.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABLKSR]
2006-01-02 19:14 61440 --a------ C:\WINDOWS\ABLKSR\ABLKSR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Net4Switch]
2006-04-13 11:54 1101824 --a------ C:\Program Files\ASUS\Net4Switch\Net4Switch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerForPhone]
2006-09-07 17:58 778240 --a------ C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
SkyTel.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2006-03-21 07:54 544768 --a------ C:\WINDOWS\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wireless Console 2]
2005-10-17 17:09 987136 --a------ C:\Program Files\Wireless Console 2\wcourier.exe

R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-11-08 19:31]
R3 FVDSCSI;FVDSCSI;C:\WINDOWS\system32\DRIVERS\fvdscsi.sys [2005-04-24 20:41]
R3 SynMini;USB2.0 1.3M WebCam;C:\WINDOWS\system32\Drivers\SynMini.sys [2006-07-02 19:33]
R3 SynScan;USB2.0 1.3M WebCam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2006-06-29 19:40]
S3 6284ae74-82b6-441a-ac7b-5848e96e61cb;6284ae74-82b6-441a-ac7b-5848e96e61cb;E:\Player\cds300.dll []
S3 ipswuio;ipswuio;C:\WINDOWS\system32\DRIVERS\ipswuio.sys [2006-01-24 10:45]
S3 lvupdtio;lvupdtio;C:\Program Files\ASUS\ASUS Live Update\SYS64\lvupdtio.sys [2005-05-20 15:48]
S3 SmartCd;SmartCd;C:\WINDOWS\system32\Drivers\SmartCd.sys [2003-07-30 02:19]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S4 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-06-22 13:58]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa4634cb-ab85-11dc-a417-f6a91ab0f219}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-01-01 14:31:02 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
- C:\Logiciels\Tuneup\SystemOptimizer.exe
"2007-05-10 13:10:54 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"
- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-02 18:30:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Logiciels\Nod32\pr_imon.dll
.
Completion time: 2008-01-02 18:31:38
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-02 17:31:26
.
2007-12-31 05:15:05 --- E O F ---