PC infecté: virtumonde, rootkit etc... Résolu

Question

Bonjour,
j'ai récupéré un pc infecté. Je sollicite votre aide pour le soigner

j'ai très peu d'expérience en info mais je vous ai posté le log de hijackthis

pouvez vous me dire quelles sont les prochines étapes

merci





log 




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:50:23, on 30/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetWaiting
etWaiting.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\Répertoire temporaire 1 pour HiJackThis.zip\HijackThis.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row-rel&channel=fr&ibd=4070123
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row-rel&channel=fr&ibd=4070123
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {2AE4005E-689F-4FB9-8C3D-D2B8B58AC072} - C:\WINDOWS\system32
nnonml.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6D718998-4BAF-405C-A450-4BC6EB6D2C82} - C:\WINDOWS\system32\vtsqq.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {86FF02E0-EB53-4DA7-90BD-DA0FD39E54DA} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9CF1FF21-9927-4170-B19C-64DFC68D909C} - (no file)
O2 - BHO: (no name) - {a4f25d6c-6930-45e9-894f-0fb3b4b06c26} - C:\WINDOWS\system32\jdfrdqoq.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {C84BC267-145C-42BC-AEB4-86640A7D819A} - (no file)
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting
etWaiting.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?836641679c094e5f9143343be21f7840
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?836641679c094e5f9143343be21f7840
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: nnnonml - C:\WINDOWS\SYSTEM32
nnonml.dll
O20 - Winlogon Notify: pmnklig - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

Utilisateur anonyme · Answer

salut,


tu as 1 procédure  ici

http://mickael.barroux.free.fr/securite/vundo.php

botcaryo · Answer

merci je vais suivre cette étape


. mais je crois qu'il y a d'autres virus et je ne sais pas comment traduire le rapport de hijack
donc si quelqu'un pouvait me dire ce que ce rapport dit et ensuite m'indiquer les étapes a suivre

Utilisateur anonyme · Answer

commence toujours  a  faire  la procédure   indiqué

ensuite fais  un copier/ coller     post  le rapport

botcaryo · Answer

rapport sdfix:


SDFix: Version 1.120

Run by Gr‚gory Even on 30/12/2007 at 15:19

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services: 

Name:
smtpdrv

Path:
System32\DRIVERS\smtpdrv.sys 

smtpdrv - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files: 

Trojan Files Found:

C:\ADBERD~1.EXE - Deleted
C:\PSA30S~1.EXE - Deleted
C:\Documents and Settings\Gr‚gory Even\Favoris\Online Security Guide.lnk - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image015.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image019.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image023.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image080.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image108.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image110.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image112.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image114.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image115.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image117.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image119.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image152.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image68.zip  - Deleted
C:\DOCUME~1\GRGORY~1\LOCALS~1\Temp\image72.zip  - Deleted
C:\WINDOWS\system32\3_exception.nls  - Deleted
C:\WINDOWS\system32\drivers\smtpdrv.sys  - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found. 

C:\WINDOWS\system32
No streams found. 

C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32
toskrnl.exe
No streams found.
 


                                 Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 15:32:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000117
"TracesSuccessful"=dword:00000002

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\mshta.exe"="C:\WINDOWS\system32\mshta.exe:*:Disabled:Microsoft (R) HTML Application host"
"C:\WINDOWS\system32\winIogon.exe"="C:\WINDOWS\system32\winIogon.exe:*:Enabled:Windows Logon Application"
"C:\WINDOWS\system32\rbywxj.exe"="C:\WINDOWS\system32\rbywxj.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\qjxlbt.exe"="C:\WINDOWS\system32\qjxlbt.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\oinxw.exe"="C:\WINDOWS\system32\oinxw.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\gxsrujf.exe"="C:\WINDOWS\system32\gxsrujf.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\aqvv.exe"="C:\WINDOWS\system32\aqvv.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\macygv.exe"="C:\WINDOWS\system32\macygv.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\ljclnp.exe"="C:\WINDOWS\system32\ljclnp.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\pnlm.exe"="C:\WINDOWS\system32\pnlm.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\wnjnox.exe"="C:\WINDOWS\system32\wnjnox.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\hzunomp.exe"="C:\WINDOWS\system32\hzunomp.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\qfngywqy.exe"="C:\WINDOWS\system32\qfngywqy.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\cbac.exe"="C:\WINDOWS\system32\cbac.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\xburui.exe"="C:\WINDOWS\system32\xburui.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\ihmu.exe"="C:\WINDOWS\system32\ihmu.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\irrtn.exe"="C:\WINDOWS\system32\irrtn.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\qatbb.exe"="C:\WINDOWS\system32\qatbb.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\rjsx.exe"="C:\WINDOWS\system32\rjsx.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\xsvso.exe"="C:\WINDOWS\system32\xsvso.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\ufycugl.exe"="C:\WINDOWS\system32\ufycugl.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\apzpxze.exe"="C:\WINDOWS\system32\apzpxze.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\nkrao.exe"="C:\WINDOWS\system32\nkrao.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\xhgar.exe"="C:\WINDOWS\system32\xhgar.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\dakpdph.exe"="C:\WINDOWS\system32\dakpdph.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\othd.exe"="C:\WINDOWS\system32\othd.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\nfsmucx.exe"="C:\WINDOWS\system32\nfsmucx.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\dehf.exe"="C:\WINDOWS\system32\dehf.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\cisp.exe"="C:\WINDOWS\system32\cisp.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\dhjvmm.exe"="C:\WINDOWS\system32\dhjvmm.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\qpxtkyl.exe"="C:\WINDOWS\system32\qpxtkyl.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\fwbrwyj.exe"="C:\WINDOWS\system32\fwbrwyj.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\kgpc.exe"="C:\WINDOWS\system32\kgpc.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\wjjavwci.exe"="C:\WINDOWS\system32\wjjavwci.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\WINDOWS\system32\orzj.exe"="C:\WINDOWS\system32\orzj.exe:*:Enabled:@xpsp2res.dll,-22005"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Mon 19 Feb 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 24 Oct 2007        57,344 ...H. --- "C:\Documents and Settings\Gr‚gory Even\Mes documents\Ecoute Clients\~WRL2717.tmp"
Thu 13 Sep 2007       433,664 ...H. --- "C:\Documents and Settings\Gr‚gory Even\Mes documents\SCAPNOR LECLERC\~WRL0001.tmp"
Fri 29 Jun 2007        19,968 ...H. --- "C:\Documents and Settings\Gr‚gory Even\Application Data\Microsoft\Word\~WRL0003.tmp"
Fri 29 Jun 2007        23,552 ...H. --- "C:\Documents and Settings\Gr‚gory Even\Application Data\Microsoft\Word\~WRL2063.tmp"
Fri 29 Jun 2007        23,040 ...H. --- "C:\Documents and Settings\Gr‚gory Even\Application Data\Microsoft\Word\~WRL3037.tmp"
Mon 24 Sep 2007        51,200 ...H. --- "C:\Documents and Settings\Gr‚gory Even\Mes documents\Animations\animation 2007\~WRL0001.tmp"
Fri  2 Feb 2007        50,176 ...H. --- "C:\Documents and Settings\Gr‚gory Even\Mes documents\SCAPNOR LECLERC\SCAPNOR\PROMO 2007\~WRL2170.tmp"
Tue 23 Jan 2007             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"
Tue 23 Jan 2007             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp"
Tue 23 Jan 2007             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch3\lock.tmp"
Tue 23 Jan 2007             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch4\lock.tmp"
Tue 23 Jan 2007             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch5\lock.tmp"
Tue 23 Jan 2007             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch6\lock.tmp"

Finished!

botcaryo · Answer

rapport combofix: ComboFix 07-12-21.4 - Grégory Even 2007-12-30 16:09:28.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.490 [GMT 1:00] Running from: C:\Documents and Settings\Grégory Even\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data.\salesmonitor C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk C:\Documents and Settings\Grégory Even\ResErrors.log C:\WINDOWS\cookies.ini C:\WINDOWS\system32\5_exception.nls . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\LEGACY_FMTR -------\LEGACY_RUNTIME -------\LEGACY_SMTPDRV -------\smtpdrv ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))))))) . 2007-12-30 15:38 . 2007-12-30 16:00 d-------- C:\VundoFix Backups 2007-12-30 15:17 . 2007-12-30 15:18 d-------- C:\WINDOWS\ERUNT 2007-12-30 14:48 . 2007-12-30 15:07 d-------- C:\HiJackThis 2007-12-30 13:22 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-12-30 13:22 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-12-30 13:22 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-12-30 13:22 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-30 13:22 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-30 13:22 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-30 13:22 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-30 13:22 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-30 12:45 . 2007-12-30 13:03 d-------- C:\Program Files\Alwil Software 2007-12-28 18:05 . 2007-12-30 12:44 774 ---hs---- C:\WINDOWS\system32 trvsbak.ini 2007-12-27 17:58 . 2007-12-28 18:03 414 ---hs---- C:\WINDOWS\system32\xcqvlllx.ini 2007-12-27 14:52 . 2007-12-27 14:52 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-21 20:08 . 2007-12-26 17:55 534 ---hs---- C:\WINDOWS\system32\paarpxpi.ini 2007-12-20 19:55 . 2007-12-21 20:03 354 ---hs---- C:\WINDOWS\system32\qemgsxrg.ini 2007-12-19 19:32 . 2007-12-19 19:32 294 ---hs---- C:\WINDOWS\system32\xqwspcop.ini 2007-12-19 17:35 . 2007-12-30 16:12 21,760 --a------ C:\WINDOWS\Tah53.sys 2007-12-18 19:35 . 2007-12-19 09:01 414 ---hs---- C:\WINDOWS\system32\yabuesus.ini 2007-12-15 19:35 . 2007-12-16 16:37 654 ---hs---- C:\WINDOWS\system32 dojojsw.ini 2007-12-15 15:52 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-12-15 08:43 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-12-15 08:43 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-12-15 08:43 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2007-12-15 08:40 . 2007-12-14 17:12 57,662 --a------ C:\WINDOWS\system32\fx.exe 2007-12-15 08:40 . 2004-03-05 07:01 31,232 --a------ C:\WINDOWS\system32\pv.exe 2007-12-14 21:09 . 2007-12-14 21:09 d-------- C:\Program Files\Windows Live Favorites 2007-12-14 19:34 . 2007-12-15 19:34 414 ---hs---- C:\WINDOWS\system32\vpwyioef.ini 2007-12-14 18:01 . 2007-12-14 18:52 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2007-12-14 18:00 . 2007-12-14 18:55 d-------- C:\Program Files\Windows Live 2007-12-14 17:59 . 2007-12-14 18:49 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-14 07:32 . 2007-12-19 08:53 21,760 --a------ C:\WINDOWS\system32\drivers\Tah53.sys 2007-12-13 19:28 . 2007-12-14 18:17 414 ---hs---- C:\WINDOWS\system32\vyjoqiun.ini 2007-12-13 07:41 . 2007-12-13 07:44 354 ---hs---- C:\WINDOWS\system32\ojsnxrgy.ini 2007-12-12 21:34 . 2007-12-12 21:34 127 --a------ C:\WINDOWS\system32\MRT.INI 2007-12-12 21:19 . 2007-12-14 18:08 544 --a------ C:\WINDOWS\_delis32.ini 2007-12-12 07:33 . 2007-12-12 19:03 594 ---hs---- C:\WINDOWS\system32 qwlnuvh.ini 2007-12-11 07:44 . 2007-12-11 07:44 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2007-12-11 07:33 . 2007-12-11 19:17 474 ---hs---- C:\WINDOWS\system32\sgmytfvd.ini 2007-12-10 17:24 . 2007-12-10 17:24 d-------- C:\Program Files\Yahoo! 2007-12-10 17:24 . 2007-12-10 17:29 d-------- C:\Program Files\CCleaner 2007-12-10 17:08 . 2007-12-10 17:08 354 ---hs---- C:\WINDOWS\system32\ukilynlv.ini 2007-12-06 18:57 . 2007-12-10 17:08 294 ---hs---- C:\WINDOWS\system32\katxfciv.ini 2007-12-05 21:39 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-05 18:58 . 2007-12-05 19:34 798,047 ---hs---- C:\WINDOWS\system32\fsaxjoxn.ini 2007-12-05 06:55 . 2007-12-05 06:55 669,532 ---hs---- C:\WINDOWS\system32\lmtkqyap.ini 2007-12-04 18:39 . 2007-12-05 19:34 369 --a------ C:\WINDOWS\wininit.ini 2007-12-04 18:11 . 2007-12-28 08:32 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-03 23:00 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-12-03 22:58 . 2007-12-05 06:49 805,861 ---hs---- C:\WINDOWS\system32\atwboiha.ini 2007-12-02 10:35 . 2007-12-02 10:35 244 --ah----- C:\sqmnoopt09.sqm 2007-12-02 10:35 . 2007-12-02 10:35 232 --ah----- C:\sqmdata09.sqm 2007-12-02 09:47 . 2007-12-30 15:53 204,732 --ahs---- C:\WINDOWS\system32\qqstv.ini2 2007-12-02 09:47 . 2007-12-30 15:55 204,732 --ahs---- C:\WINDOWS\system32\qqstv.ini 2007-11-15 18:12 . 2007-11-15 18:12 244 --ah----- C:\sqmnoopt08.sqm 2007-11-15 18:12 . 2007-11-15 18:12 232 --ah----- C:\sqmdata08.sqm 2007-11-14 18:30 . 2007-11-14 18:30 244 --ah----- C:\sqmnoopt07.sqm 2007-11-14 18:30 . 2007-11-14 18:30 244 --ah----- C:\sqmnoopt05.sqm 2007-11-14 18:30 . 2007-11-14 18:30 232 --ah----- C:\sqmdata07.sqm 2007-11-14 18:30 . 2007-11-14 18:30 232 --ah----- C:\sqmdata05.sqm 2007-11-14 18:30 . 2007-11-14 18:30 148 --ah----- C:\sqmdata06.sqm 2007-11-14 18:30 . 2007-11-14 18:30 136 --ah----- C:\sqmnoopt06.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-30 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2007-12-30 11:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-27 11:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-27 11:29 --------- d-----w C:\Program Files\TomTom HOME 2007-12-14 20:10 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-12-14 17:11 --------- d-----w C:\Program Files\Fichiers communs\Logitech 2007-12-12 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom 2007-12-12 20:18 --------- d-----w C:\Program Files\Logitech 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C365396-CB85-4E18-A7E3-D609D3A27F55}] C:\WINDOWS\system32\vtsqq.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86FF02E0-EB53-4DA7-90BD-DA0FD39E54DA}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CF1FF21-9927-4170-B19C-64DFC68D909C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4f25d6c-6930-45e9-894f-0fb3b4b06c26}] C:\WINDOWS\system32\jdfrdqoq.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84BC267-145C-42BC-AEB4-86640A7D819A}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00] "ModemOnHold"="C:\Program Files\NetWaiting etWaiting.exe" [2003-09-10 03:24] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 15:42] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 00:13] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-12-13 03:44] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-12-13 03:41] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-12-13 03:45] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 02:23] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 17:30 C:\WINDOWS\stsystra.exe] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 21:29] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-10-31 22:48] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-06-29 13:13] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2004-01-05 10:44] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28] "DXDllRegExe"="dxdllreg.exe" [] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-06 11:39] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-05 13:00] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\pmnklig] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\703f84d0] rundll32.exe C:\WINDOWS\system32\kabsvrtr.dll,b R0 Tah53;Tah53;C:\WINDOWS\system32\Drivers\Tah53.sys [2007-12-19 08:53] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2b4c7fd1-a8dd-11dc-86b0-00197d4885ca}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50612461-6cbb-11dc-8654-00197d4885ca}] \Shell\AutoRun\command - F:\InstallTomTomHOME.exe . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-30 15:01:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job" . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-30 16:14:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\8_exception.nls 0 bytes scan completed successfully hidden files: 1 ************************************************************************** . Completion time: 2007-12-30 16:16:27 - machine was rebooted . 2007-12-15 16:21:07 --- E O F ---

Utilisateur anonyme · Answer

Télécharge   

http://www.clubic.com/telecharger-fiche25107-vundofix.html

Double-cliquez sur VundoFix.exe afin de le lancer, puis cliquez sur le bouton "Scan for Vundo".

Lorsque le scan est terminé, cliquez sur le bouton "Remove Vundo".

Une invite vous demandera si vous voulez supprimer les fichiers, cliquez sur YES.

Après avoir cliqué sur Yes, le Bureau disparaîtra un moment lors de la suppression des fichiers (ne vous inquiétez pas c'est normal !).

Vous verrez ensuite une invite qui vous annoncera que votre PC va s'éteindre (shutdown en anglais) : cliquez sur OK.

Une fois votre PC éteint, redémarrez-le.

post le   rapport

botcaryo · Answer

rapport hijackthis  

alors il est encore infecté????



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:33:47, on 30/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Apoint\HidFind.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetWaiting
etWaiting.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\HiJackThis\sanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row-rel&channel=fr&ibd=4070123
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {2C365396-CB85-4E18-A7E3-D609D3A27F55} - C:\WINDOWS\system32\vtsqq.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {86FF02E0-EB53-4DA7-90BD-DA0FD39E54DA} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9CF1FF21-9927-4170-B19C-64DFC68D909C} - (no file)
O2 - BHO: (no name) - {a4f25d6c-6930-45e9-894f-0fb3b4b06c26} - C:\WINDOWS\system32\jdfrdqoq.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {C84BC267-145C-42BC-AEB4-86640A7D819A} - (no file)
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting
etWaiting.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?836641679c094e5f9143343be21f7840
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?836641679c094e5f9143343be21f7840
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: pmnklig - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

botcaryo · Answer

j'ai deja fais cela mais je n'ai eu de rapport ensuite avec vundo
est ce normal?


que dit le rapport de hijackthis svp?

botcaryo · Answer

j'ai trouvé un rapport de vundo :


VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 15:38:52 30/12/2007

Listing files found while scanning....

C:\WINDOWS\system32\aneley.exe
C:\WINDOWS\system32\aoaufegx.dll
C:\WINDOWS\system32\aqjsbjsd.dll
C:\WINDOWS\system32\awtqnkh.dll
C:\WINDOWS\system32\awtrqnm.dll
C:\WINDOWS\system32\awttrqn.dll
C:\WINDOWS\system32\bxdcaiur.dll
C:\WINDOWS\system32\byxustu.dll
C:\WINDOWS\system32\byxvttq.dll
C:\WINDOWS\system32\byxvwwt.dll
C:\WINDOWS\system32\byxwwvv.dll
C:\WINDOWS\system32\byxywxw.dll
C:\WINDOWS\system32\cbxuuts.dll
C:\WINDOWS\system32\cbxvuts.dll
C:\WINDOWS\system32\cbxvvvw.dll
C:\WINDOWS\system32\cbxwvwv.dll
C:\WINDOWS\system32\cbxwxyy.dll
C:\WINDOWS\system32\cbxxuvt.dll
C:\WINDOWS\system32\cbxyayv.dll
C:\WINDOWS\system32\ddcdefe.dll
C:\WINDOWS\system32\ddcyxuu.dll
C:\WINDOWS\system32\ddcyxyv.dll
C:\WINDOWS\system32\dqhj.exe
C:\WINDOWS\system32\dsjbsjqa.ini
C:\WINDOWS\system32\efcbcby.dll
C:\WINDOWS\system32\efcccbc.dll
C:\WINDOWS\system32\efcdeff.dll
C:\WINDOWS\system32\eqvgqygo.exe
C:\WINDOWS\system32\fccawtu.dll
C:\WINDOWS\system32\fccdebx.dll
C:\WINDOWS\system32\fccyayy.dll
C:\WINDOWS\system32\foiledcg.exe
C:\WINDOWS\system32\fpyobsrx.dll
C:\WINDOWS\system32\gebaxuu.dll
C:\WINDOWS\system32\gebcywu.dll
C:\WINDOWS\system32\gebxxwx.dll
C:\WINDOWS\system32\gebyaxu.dll
C:\WINDOWS\system32\gfheorjh.ini
C:\WINDOWS\system32\gmsylmtv.dll
C:\WINDOWS\system32\hjroehfg.dll
C:\WINDOWS\system32\hkrnhayq.dll
C:\WINDOWS\system32\hlwgiphr.dll
C:\WINDOWS\system32\hvhjlrid.dll
C:\WINDOWS\system32\hvunlwqt.dll
C:\WINDOWS\system32\iifdeeb.dll
C:\WINDOWS\system32\jagq.exe
C:\WINDOWS\system32\jdfrdqoq.dll
C:\WINDOWS\system32\jkkhecc.dll
C:\WINDOWS\system32\jkkkkjj.dll
C:\WINDOWS\system32\jkklllj.dll
C:\WINDOWS\system32\khfcawt.dll
C:\WINDOWS\system32\khfcdba.dll
C:\WINDOWS\system32\khfecay.dll
C:\WINDOWS\system32\khfgeee.dll
C:\WINDOWS\system32\ljjhfca.dll
C:\WINDOWS\system32\ljjhfec.dll
C:\WINDOWS\system32\ljjigfg.dll
C:\WINDOWS\system32\ljjigge.dll
C:\WINDOWS\system32\mljhiig.dll
C:\WINDOWS\system32\mljjgda.dll
C:\WINDOWS\system32\mvsxunjb.dll
C:\WINDOWS\system32
nnonml.dll
C:\WINDOWS\system32
uiqojyv.dll
C:\WINDOWS\system32
xojxasf.dll
C:\WINDOWS\system32\ocjbeant.dll
C:\WINDOWS\system32\opnkihg.dll
C:\WINDOWS\system32\opnkjgd.dll
C:\WINDOWS\system32\opnmllm.dll
C:\WINDOWS\system32\opnnkjj.dll
C:\WINDOWS\system32\pcmnrwo.exe
C:\WINDOWS\system32\pkrdaih.exe
C:\WINDOWS\system32\pmnkkih.dll
C:\WINDOWS\system32\pmnmkki.dll
C:\WINDOWS\system32\pmnnnlj.dll
C:\WINDOWS\system32\pmnonkj.dll
C:\WINDOWS\system32\pocpswqx.dll
C:\WINDOWS\system32\qomjgfg.dll
C:\WINDOWS\system32\qomkhhe.dll
C:\WINDOWS\system32\qomkihg.dll
C:\WINDOWS\system32\qommjig.dll
C:\WINDOWS\system32\qommmkj.dll
C:\WINDOWS\system32\qurgrtjj.dll
C:\WINDOWS\system32\qywgldfb.dll
C:\WINDOWS\system32\qyycnqak.dll
C:\WINDOWS\system32hfojwmr.dll
C:\WINDOWS\system32qrqqnl.dll
C:\WINDOWS\system32qrqrrp.dll
C:\WINDOWS\system32qrrrst.dll
C:\WINDOWS\system32qrrsts.dll
C:\WINDOWS\system32\ssqomjj.dll
C:\WINDOWS\system32\ssqqrom.dll
C:\WINDOWS\system32\ssqrrol.dll
C:\WINDOWS\system32\ssqrrqr.dll
C:\WINDOWS\system32\suseubay.dll
C:\WINDOWS\system32\svwmiuol.dll
C:\WINDOWS\system32	uvtqrp.dll
C:\WINDOWS\system32	uvtutq.dll
C:\WINDOWS\system32	uvwuuu.dll
C:\WINDOWS\system32\ukylrcuk.dll
C:\WINDOWS\system32\urqoomn.dll
C:\WINDOWS\system32\urqpmjh.dll
C:\WINDOWS\system32\urqrpnk.dll
C:\WINDOWS\system32\uzedtfcd.exe
C:\WINDOWS\system32\vbrifjgf.dll
C:\WINDOWS\system32\vouwwgdg.dll
C:\WINDOWS\system32\vpqacjvm.dll
C:\WINDOWS\system32\vpxooxx.exe
C:\WINDOWS\system32\vtmlysmg.ini
C:\WINDOWS\system32\vtsqq.dll
C:\WINDOWS\system32\vturpqo.dll
C:\WINDOWS\system32\vtuusro.dll
C:\WINDOWS\system32\wqrgdotg.dll
C:\WINDOWS\system32\wsjojodn.dll
C:\WINDOWS\system32\wvuturp.dll
C:\WINDOWS\system32\xebqeobe.dll
C:\WINDOWS\system32\xgefuaoa.ini
C:\WINDOWS\system32\xxywuuu.dll
C:\WINDOWS\system32\xxywuvt.dll
C:\WINDOWS\system32\xxyxusp.dll
C:\WINDOWS\system32\yayaxxy.dll
C:\WINDOWS\system32\yayvutr.dll
C:\WINDOWS\system32\ydhdfdwh.dll
C:\WINDOWS\system32\yfuhmqit.dll
C:\WINDOWS\system32\ygrxnsjo.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\aneley.exe
C:\WINDOWS\system32\aneley.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\aoaufegx.dll
C:\WINDOWS\system32\aoaufegx.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\aqjsbjsd.dll
C:\WINDOWS\system32\aqjsbjsd.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\awtqnkh.dll
C:\WINDOWS\system32\awtqnkh.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\awtrqnm.dll
C:\WINDOWS\system32\awtrqnm.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\awttrqn.dll
C:\WINDOWS\system32\awttrqn.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\bxdcaiur.dll
C:\WINDOWS\system32\bxdcaiur.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\byxustu.dll
C:\WINDOWS\system32\byxustu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\byxvttq.dll
C:\WINDOWS\system32\byxvttq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\byxvwwt.dll
C:\WINDOWS\system32\byxvwwt.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\byxwwvv.dll
C:\WINDOWS\system32\byxwwvv.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\byxywxw.dll
C:\WINDOWS\system32\byxywxw.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cbxuuts.dll
C:\WINDOWS\system32\cbxuuts.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cbxvuts.dll
C:\WINDOWS\system32\cbxvuts.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cbxvvvw.dll
C:\WINDOWS\system32\cbxvvvw.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cbxwvwv.dll
C:\WINDOWS\system32\cbxwvwv.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cbxwxyy.dll
C:\WINDOWS\system32\cbxwxyy.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cbxxuvt.dll
C:\WINDOWS\system32\cbxxuvt.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\cbxyayv.dll
C:\WINDOWS\system32\cbxyayv.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ddcdefe.dll
C:\WINDOWS\system32\ddcdefe.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ddcyxuu.dll
C:\WINDOWS\system32\ddcyxuu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ddcyxyv.dll
C:\WINDOWS\system32\ddcyxyv.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\dqhj.exe
C:\WINDOWS\system32\dqhj.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\dsjbsjqa.ini
C:\WINDOWS\system32\dsjbsjqa.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\efcbcby.dll
C:\WINDOWS\system32\efcbcby.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\efcccbc.dll
C:\WINDOWS\system32\efcccbc.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\efcdeff.dll
C:\WINDOWS\system32\efcdeff.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\eqvgqygo.exe
C:\WINDOWS\system32\eqvgqygo.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\fccawtu.dll
C:\WINDOWS\system32\fccawtu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\fccdebx.dll
C:\WINDOWS\system32\fccdebx.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\fccyayy.dll
C:\WINDOWS\system32\fccyayy.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\foiledcg.exe
C:\WINDOWS\system32\foiledcg.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\fpyobsrx.dll
C:\WINDOWS\system32\fpyobsrx.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gebaxuu.dll
C:\WINDOWS\system32\gebaxuu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gebcywu.dll
C:\WINDOWS\system32\gebcywu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gebxxwx.dll
C:\WINDOWS\system32\gebxxwx.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gebyaxu.dll
C:\WINDOWS\system32\gebyaxu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gfheorjh.ini
C:\WINDOWS\system32\gfheorjh.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\gmsylmtv.dll
C:\WINDOWS\system32\gmsylmtv.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hjroehfg.dll
C:\WINDOWS\system32\hjroehfg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hkrnhayq.dll
C:\WINDOWS\system32\hkrnhayq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hlwgiphr.dll
C:\WINDOWS\system32\hlwgiphr.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hvhjlrid.dll
C:\WINDOWS\system32\hvhjlrid.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\hvunlwqt.dll
C:\WINDOWS\system32\hvunlwqt.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\iifdeeb.dll
C:\WINDOWS\system32\iifdeeb.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jagq.exe
C:\WINDOWS\system32\jagq.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jdfrdqoq.dll
C:\WINDOWS\system32\jdfrdqoq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jkkhecc.dll
C:\WINDOWS\system32\jkkhecc.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jkkkkjj.dll
C:\WINDOWS\system32\jkkkkjj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\jkklllj.dll
C:\WINDOWS\system32\jkklllj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\khfcawt.dll
C:\WINDOWS\system32\khfcawt.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\khfcdba.dll
C:\WINDOWS\system32\khfcdba.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\khfecay.dll
C:\WINDOWS\system32\khfecay.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\khfgeee.dll
C:\WINDOWS\system32\khfgeee.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ljjhfca.dll
C:\WINDOWS\system32\ljjhfca.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ljjhfec.dll
C:\WINDOWS\system32\ljjhfec.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ljjigfg.dll
C:\WINDOWS\system32\ljjigfg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ljjigge.dll
C:\WINDOWS\system32\ljjigge.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\mljhiig.dll
C:\WINDOWS\system32\mljhiig.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\mljjgda.dll
C:\WINDOWS\system32\mljjgda.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\mvsxunjb.dll
C:\WINDOWS\system32\mvsxunjb.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32
nnonml.dll
C:\WINDOWS\system32
nnonml.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32
uiqojyv.dll
C:\WINDOWS\system32
uiqojyv.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32
xojxasf.dll
C:\WINDOWS\system32
xojxasf.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ocjbeant.dll
C:\WINDOWS\system32\ocjbeant.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\opnkihg.dll
C:\WINDOWS\system32\opnkihg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\opnkjgd.dll
C:\WINDOWS\system32\opnkjgd.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\opnmllm.dll
C:\WINDOWS\system32\opnmllm.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\opnnkjj.dll
C:\WINDOWS\system32\opnnkjj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pcmnrwo.exe
C:\WINDOWS\system32\pcmnrwo.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pkrdaih.exe
C:\WINDOWS\system32\pkrdaih.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pmnkkih.dll
C:\WINDOWS\system32\pmnkkih.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pmnmkki.dll
C:\WINDOWS\system32\pmnmkki.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pmnnnlj.dll
C:\WINDOWS\system32\pmnnnlj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pmnonkj.dll
C:\WINDOWS\system32\pmnonkj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pocpswqx.dll
C:\WINDOWS\system32\pocpswqx.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qomjgfg.dll
C:\WINDOWS\system32\qomjgfg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qomkhhe.dll
C:\WINDOWS\system32\qomkhhe.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qomkihg.dll
C:\WINDOWS\system32\qomkihg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qommjig.dll
C:\WINDOWS\system32\qommjig.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qommmkj.dll
C:\WINDOWS\system32\qommmkj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qurgrtjj.dll
C:\WINDOWS\system32\qurgrtjj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qywgldfb.dll
C:\WINDOWS\system32\qywgldfb.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qyycnqak.dll
C:\WINDOWS\system32\qyycnqak.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32hfojwmr.dll
C:\WINDOWS\system32hfojwmr.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32qrqqnl.dll
C:\WINDOWS\system32qrqqnl.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32qrqrrp.dll
C:\WINDOWS\system32qrqrrp.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32qrrrst.dll
C:\WINDOWS\system32qrrrst.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32qrrsts.dll
C:\WINDOWS\system32qrrsts.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ssqomjj.dll
C:\WINDOWS\system32\ssqomjj.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ssqqrom.dll
C:\WINDOWS\system32\ssqqrom.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ssqrrol.dll
C:\WINDOWS\system32\ssqrrol.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ssqrrqr.dll
C:\WINDOWS\system32\ssqrrqr.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\suseubay.dll
C:\WINDOWS\system32\suseubay.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\svwmiuol.dll
C:\WINDOWS\system32\svwmiuol.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	uvtqrp.dll
C:\WINDOWS\system32	uvtqrp.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	uvtutq.dll
C:\WINDOWS\system32	uvtutq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32	uvwuuu.dll
C:\WINDOWS\system32	uvwuuu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ukylrcuk.dll
C:\WINDOWS\system32\ukylrcuk.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\urqoomn.dll
C:\WINDOWS\system32\urqoomn.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\urqpmjh.dll
C:\WINDOWS\system32\urqpmjh.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\urqrpnk.dll
C:\WINDOWS\system32\urqrpnk.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\uzedtfcd.exe
C:\WINDOWS\system32\uzedtfcd.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vbrifjgf.dll
C:\WINDOWS\system32\vbrifjgf.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vouwwgdg.dll
C:\WINDOWS\system32\vouwwgdg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vpqacjvm.dll
C:\WINDOWS\system32\vpqacjvm.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vpxooxx.exe
C:\WINDOWS\system32\vpxooxx.exe Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vtmlysmg.ini
C:\WINDOWS\system32\vtmlysmg.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vtsqq.dll
C:\WINDOWS\system32\vtsqq.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vturpqo.dll
C:\WINDOWS\system32\vturpqo.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\vtuusro.dll
C:\WINDOWS\system32\vtuusro.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wqrgdotg.dll
C:\WINDOWS\system32\wqrgdotg.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wsjojodn.dll
C:\WINDOWS\system32\wsjojodn.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\wvuturp.dll
C:\WINDOWS\system32\wvuturp.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xebqeobe.dll
C:\WINDOWS\system32\xebqeobe.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xgefuaoa.ini
C:\WINDOWS\system32\xgefuaoa.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xxywuuu.dll
C:\WINDOWS\system32\xxywuuu.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xxywuvt.dll
C:\WINDOWS\system32\xxywuvt.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\xxyxusp.dll
C:\WINDOWS\system32\xxyxusp.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\yayaxxy.dll
C:\WINDOWS\system32\yayaxxy.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\yayvutr.dll
C:\WINDOWS\system32\yayvutr.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ydhdfdwh.dll
C:\WINDOWS\system32\ydhdfdwh.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\yfuhmqit.dll
C:\WINDOWS\system32\yfuhmqit.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\ygrxnsjo.dll
C:\WINDOWS\system32\ygrxnsjo.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32
nnonml.dll
C:\WINDOWS\system32
nnonml.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 16:18:41 30/12/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...


alors doc quoi de neuf?

Utilisateur anonyme · Answer

il  te reste  a faire  cete procédure




Télécharge

http://info-magique.titi-serveur.net/index.php?showtopic=38

Double-cliquez ensuite sur VirtumundoBeGone.exe et suivez les instructions qui s'affichent à l'écran.

Une fois terminé, redémarrez votre PC.

PS : Ne vous inquiètez pas si vous voyez un écran bleu "Erreur fatale", c'est normal.

botcaryo · Answer

je l'ai fais aussi il me disait qu'il n'avait rien trouvé

dois je ensuite utiliser navilog1?

Utilisateur anonyme · Answer

tu n'es  plus infecté


mais tu  peux  toujours le faire 
http://il.mafioso.pagesperso-orange.fr/



pour  terminer , post    le rapport

botcaryo · Answer

je pense que je suis encore infecté notamment avec WORM.agent.bx etWorm.agent.l


je poste le rapport de navlog

Utilisateur anonyme · Answer

téléharge les

j'ai corrigé le lien

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/11643.html

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html


Désactive ta restauration du système :

- fais un clique droit sur "Poste de travail"
- clique sur "Propriétés"
- clique sur l'onglet "Restauration du système"
- coche la case "Désactiver la Restauration du système"
- valide par ok

Supprime tes fichiers temporaires :

- dans Internet Explorer, clique sur "Outils"
- choisir "Options Internet"
- clique sur "Supprimer les fichiers"
- clique sur "Effacer l'historique"




Réactive ta restauration du sytème si tout est ok.
regarde  toujours  dans tes  options  internet --->  contenu --->     certificats   puis  éditeur

                                       si tu   vois  des  sites  affichés  ------>    supprimes les  





si tu n'as pas  d'antivirus  
https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/25899.html

  antipspyware,  trés performant
https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/50275.html


refais  un scan  en lignes       par   internet explorer     et tu  va sur les  site  ----->  scan onlines  bit defender

botcaryo · Answer

voila le rapport de navilog


Search Navipromo version 3.3.8 commencé le 30/12/2007 à 17:42:28,62

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 11.12.2007 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***




*** Recherche dossiers dans "C:\Documents and Settings\Grégory Even\application data" *** 


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUD?~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans "C:\Documents and Settings\Grégory Even\local settings\application data" * 



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans C:\WINDOWS\system32 :

pv.exe trouvé !

* Dans "C:\Documents and Settings\Grégory Even\local settings\application data" : 


3)Recherche Certificats :

Certificat Egroup absent !

4)Recherche fichiers connus :

C:\WINDOWS\system32\qqstv.ini2 trouvé ! infection Vundo possible non traitée par cet outil !


*** Analyse terminée le 30/12/2007 à 17:45:11,23 ***

Utilisateur anonyme · Answer

je m 'en doutais  avec les certificats  et éditeurs

refais  un scan  avec   vundo

botcaryo · Answer

je ne comprends pas . il trouve un virus ok!! mais ca n'a rien a voir avec les editeurs ou les certificats, c'est un chapitre différent pas la localisation du virus

de plus vundo ne le scan pas!!!

Utilisateur anonyme · Answer

as tu   bien suivi les procédures ?

donne moi le   nom  du fichier  infecté

Utilisateur anonyme · Answer

bonsoir et desoles pour l'intrusion !! il reste du vundo poste un hijackthis  !!!

botcaryo · Answer

je ne connais pas le fichier infecté puisque je ne sais pas lire les rapport des différents logiciels...

sauf que sur le dernier rapport il y a cela écrit:  
C:\WINDOWS\system32\qqstv.ini2 trouvé ! infection Vundo possible non traitée par cet outil ! 


mais moi je ne sais pas que faire et comment résoudre ce probleme et certainement d'autres pbms qui apparaissent dans les rapports d'hijackthis ou sdfix ou combo par exemple étant donné que je ne comprends pas les lignes des rapports


merci pour votre aide

Utilisateur anonyme · Answer

ton infection est encore sur ton pc ne desactive pas ta restauration et poste un nouveau hijackthis !!

Utilisateur anonyme · Answer

bonsoir,
pas de mal , tu  dérange pas



oui  tu  as raison  , c'est indiquée dans le  rapport




http://www.pc-soluces.com/article.php?sid=36

suis la procédure indiqué



refais  un scan

http://www.secuser.com/outils/antivirus.htm

botcaryo · Answer

merci je poste un rapport de hijack

botcaryo · Answer

voici le rapport carrosier 

quel est le résultat?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:36:16, on 30/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Apoint\HidFind.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetWaiting
etWaiting.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\HiJackThis\sanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row-rel&channel=fr&ibd=4070123
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {2C365396-CB85-4E18-A7E3-D609D3A27F55} - C:\WINDOWS\system32\vtsqq.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {86FF02E0-EB53-4DA7-90BD-DA0FD39E54DA} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9CF1FF21-9927-4170-B19C-64DFC68D909C} - (no file)
O2 - BHO: (no name) - {a4f25d6c-6930-45e9-894f-0fb3b4b06c26} - C:\WINDOWS\system32\jdfrdqoq.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {C84BC267-145C-42BC-AEB4-86640A7D819A} - (no file)
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting
etWaiting.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?836641679c094e5f9143343be21f7840
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?836641679c094e5f9143343be21f7840
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: pmnklig - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

Utilisateur anonyme · Answer

remet un log combofix stp

botcaryo · Answer

c'est en route je le mets des qu'il est pret

FillPCA · Answer

Salut,

Pour suivre.

FillPCA

botcaryo · Answer

voici: ComboFix 07-12-21.4 - Grégory Even 2007-12-30 18:42:18.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.548 [GMT 1:00] Running from: C:\Documents and Settings\Grégory Even\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\8_exception.nls . ((((((((((((((((((((((((((((( Fichiers créés 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))))))) . 2007-12-30 17:44 . 4,461 C:\WINDOWS\system32\gnc.exe 2007-12-30 17:40 . 2007-12-30 17:45 d-------- C:\Program Files\Navilog1 2007-12-30 15:38 . 2007-12-30 16:00 d-------- C:\VundoFix Backups 2007-12-30 15:17 . 2007-12-30 15:18 d-------- C:\WINDOWS\ERUNT 2007-12-30 14:48 . 2007-12-30 18:35 d-------- C:\HiJackThis 2007-12-30 13:22 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-12-30 13:22 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-12-30 13:22 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-12-30 13:22 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-30 13:22 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-30 13:22 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-30 13:22 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-30 13:22 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-30 12:45 . 2007-12-30 13:03 d-------- C:\Program Files\Alwil Software 2007-12-28 18:05 . 2007-12-30 12:44 774 ---hs---- C:\WINDOWS\system32 trvsbak.ini 2007-12-27 17:58 . 2007-12-28 18:03 414 ---hs---- C:\WINDOWS\system32\xcqvlllx.ini 2007-12-27 14:52 . 2007-12-27 14:52 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-21 20:08 . 2007-12-26 17:55 534 ---hs---- C:\WINDOWS\system32\paarpxpi.ini 2007-12-20 19:55 . 2007-12-21 20:03 354 ---hs---- C:\WINDOWS\system32\qemgsxrg.ini 2007-12-19 19:32 . 2007-12-19 19:32 294 ---hs---- C:\WINDOWS\system32\xqwspcop.ini 2007-12-19 17:35 . 2007-12-30 16:12 21,760 --a------ C:\WINDOWS\Tah53.sys 2007-12-18 19:35 . 2007-12-19 09:01 414 ---hs---- C:\WINDOWS\system32\yabuesus.ini 2007-12-16 11:48 . 2007-12-16 11:50 d-------- C:\Documents and Settings\Grégory Even\Application Data\U3 2007-12-15 19:35 . 2007-12-16 16:37 654 ---hs---- C:\WINDOWS\system32 dojojsw.ini 2007-12-15 15:53 . 2007-12-15 15:53 d-------- C:\Documents and Settings\Grégory Even\Application Data\Grisoft 2007-12-15 15:52 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-12-15 08:43 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-12-15 08:43 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-12-15 08:43 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2007-12-15 08:40 . 2007-12-14 17:12 57,662 --a------ C:\WINDOWS\system32\fx.exe 2007-12-15 08:40 . 2004-03-05 07:01 31,232 --a------ C:\WINDOWS\system32\pv.exe 2007-12-14 21:09 . 2007-12-14 21:09 d-------- C:\Program Files\Windows Live Favorites 2007-12-14 19:34 . 2007-12-15 19:34 414 ---hs---- C:\WINDOWS\system32\vpwyioef.ini 2007-12-14 18:01 . 2007-12-14 18:52 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2007-12-14 18:00 . 2007-12-14 18:55 d-------- C:\Program Files\Windows Live 2007-12-14 17:59 . 2007-12-14 18:49 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-14 07:32 . 2007-12-19 08:53 21,760 --a------ C:\WINDOWS\system32\drivers\Tah53.sys 2007-12-13 19:28 . 2007-12-14 18:17 414 ---hs---- C:\WINDOWS\system32\vyjoqiun.ini 2007-12-13 07:41 . 2007-12-13 07:44 354 ---hs---- C:\WINDOWS\system32\ojsnxrgy.ini 2007-12-12 21:34 . 2007-12-12 21:34 127 --a------ C:\WINDOWS\system32\MRT.INI 2007-12-12 21:19 . 2007-12-14 18:08 544 --a------ C:\WINDOWS\_delis32.ini 2007-12-12 07:33 . 2007-12-12 19:03 594 ---hs---- C:\WINDOWS\system32 qwlnuvh.ini 2007-12-11 07:44 . 2007-12-11 07:44 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2007-12-11 07:33 . 2007-12-11 19:17 474 ---hs---- C:\WINDOWS\system32\sgmytfvd.ini 2007-12-10 17:24 . 2007-12-10 17:24 d-------- C:\Program Files\Yahoo! 2007-12-10 17:24 . 2007-12-10 17:29 d-------- C:\Program Files\CCleaner 2007-12-10 17:08 . 2007-12-10 17:08 354 ---hs---- C:\WINDOWS\system32\ukilynlv.ini 2007-12-06 18:57 . 2007-12-10 17:08 294 ---hs---- C:\WINDOWS\system32\katxfciv.ini 2007-12-05 21:39 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-05 18:58 . 2007-12-05 19:34 798,047 ---hs---- C:\WINDOWS\system32\fsaxjoxn.ini 2007-12-05 06:55 . 2007-12-05 06:55 669,532 ---hs---- C:\WINDOWS\system32\lmtkqyap.ini 2007-12-04 18:39 . 2007-12-05 19:34 369 --a------ C:\WINDOWS\wininit.ini 2007-12-04 18:11 . 2007-12-28 08:32 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-03 23:00 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-12-03 22:58 . 2007-12-05 06:49 805,861 ---hs---- C:\WINDOWS\system32\atwboiha.ini 2007-12-02 10:35 . 2007-12-02 10:35 244 --ah----- C:\sqmnoopt09.sqm 2007-12-02 10:35 . 2007-12-02 10:35 232 --ah----- C:\sqmdata09.sqm 2007-12-02 09:47 . 2007-12-30 15:53 204,732 --a------ C:\WINDOWS\system32\qqstv.ini2 2007-12-02 09:47 . 2007-12-30 15:55 204,732 --ahs---- C:\WINDOWS\system32\qqstv.ini 2007-11-15 18:12 . 2007-11-15 18:12 244 --ah----- C:\sqmnoopt08.sqm 2007-11-15 18:12 . 2007-11-15 18:12 232 --ah----- C:\sqmdata08.sqm 2007-11-14 18:30 . 2007-11-14 18:30 244 --ah----- C:\sqmnoopt07.sqm 2007-11-14 18:30 . 2007-11-14 18:30 244 --ah----- C:\sqmnoopt05.sqm 2007-11-14 18:30 . 2007-11-14 18:30 232 --ah----- C:\sqmdata07.sqm 2007-11-14 18:30 . 2007-11-14 18:30 232 --ah----- C:\sqmdata05.sqm 2007-11-14 18:30 . 2007-11-14 18:30 148 --ah----- C:\sqmdata06.sqm 2007-11-14 18:30 . 2007-11-14 18:30 136 --ah----- C:\sqmnoopt06.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-30 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2007-12-30 11:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-30 10:42 --------- d-----w C:\Documents and Settings\Grégory Even\Application Data\AVG7 2007-12-27 11:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-27 11:29 --------- d-----w C:\Program Files\TomTom HOME 2007-12-14 20:10 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-12-14 17:11 --------- d-----w C:\Program Files\Fichiers communs\Logitech 2007-12-12 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom 2007-12-12 20:18 --------- d-----w C:\Program Files\Logitech 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-10-30 23:23 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:43 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-25 08:28 222,720 ------w C:\WINDOWS\system32\dllcache\wmasf.dll 2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll 2007-10-10 23:49 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll 2007-10-10 23:49 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll 2007-10-10 23:49 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-10-10 23:49 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-10-10 23:49 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-10-10 23:49 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-10-10 23:49 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-10-10 23:49 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-10-10 23:49 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-10-10 23:49 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-10-10 23:49 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-10-10 23:49 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-10-10 23:49 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-10-10 23:49 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-10-10 23:49 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-10-10 23:49 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll 2007-10-10 23:49 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-10-10 23:49 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-10-10 23:49 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-10-10 23:49 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-10-10 23:49 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-10-10 23:49 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-10-10 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-10-10 11:00 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-10-10 05:46 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll . ((((((((((((((((((((((((((((( snapshot@2007-12-30_16.15.44.26 ))))))))))))))))))))))))))))))))))))))))) . - 2007-12-30 15:06:41 53,770 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-30 15:18:24 53,770 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-12-30 15:06:41 64,922 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2007-12-30 15:18:24 64,922 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2007-12-30 15:06:41 382,026 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-30 15:18:24 382,026 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-12-30 15:06:41 447,222 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2007-12-30 15:18:24 447,222 ----a-w C:\WINDOWS\system32\perfh00C.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C365396-CB85-4E18-A7E3-D609D3A27F55}] C:\WINDOWS\system32\vtsqq.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86FF02E0-EB53-4DA7-90BD-DA0FD39E54DA}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CF1FF21-9927-4170-B19C-64DFC68D909C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4f25d6c-6930-45e9-894f-0fb3b4b06c26}] C:\WINDOWS\system32\jdfrdqoq.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84BC267-145C-42BC-AEB4-86640A7D819A}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00] "ModemOnHold"="C:\Program Files\NetWaiting etWaiting.exe" [2003-09-10 03:24] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 15:42] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 00:13] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-12-13 03:44] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-12-13 03:41] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-12-13 03:45] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 02:23] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 17:30 C:\WINDOWS\stsystra.exe] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 21:29] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-10-31 22:48] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-06-29 13:13] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2004-01-05 10:44] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28] "DXDllRegExe"="dxdllreg.exe" [] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-06 11:39] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-05 13:00] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Cisco Systems VPN Client.lnk - C:\Program Files\Cisco Systems\VPN Client\vpngui.exe [2007-02-01 13:24:15] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-01-23 21:23:36] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\pmnklig] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\703f84d0] rundll32.exe C:\WINDOWS\system32\kabsvrtr.dll,b R0 Tah53;Tah53;C:\WINDOWS\system32\Drivers\Tah53.sys [2007-12-19 08:53] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2b4c7fd1-a8dd-11dc-86b0-00197d4885ca}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50612461-6cbb-11dc-8654-00197d4885ca}] \Shell\AutoRun\command - F:\InstallTomTomHOME.exe . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-12-30 17:01:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-30 18:45:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... ? [51036] ? [51568] ? [51916] ? [53192] scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-30 18:46:43 C:\ComboFix2.txt ... 2007-12-30 16:16 . 2007-12-15 16:21:07 --- E O F ---

Utilisateur anonyme · Answer

ComboFix avec CFScript :

* Sélectionne le texte suivant (en gras) dans son intégralité :

Registry:: 
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C365396-CB85-4E18-A7E3-D609D3A27F55}]
C:\WINDOWS\system32\vtsqq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86FF02E0-EB53-4DA7-90BD-DA0FD39E54DA}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CF1FF21-9927-4170-B19C-64DFC68D909C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4f25d6c-6930-45e9-894f-0fb3b4b06c26}]
C:\WINDOWS\system32\jdfrdqoq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84BC267-145C-42BC-AEB4-86640A7D819A}]

File:: 
C:\WINDOWS\system32trvsbak.ini 
C:\WINDOWS\system32\xcqvlllx.ini 
C:\WINDOWS\system32\paarpxpi.ini 
C:\WINDOWS\system32\qemgsxrg.ini 
C:\WINDOWS\system32\qemgsxrg.ini
C:\WINDOWS\system32\yabuesus.ini 
C:\WINDOWS\system32
dojojsw.ini 
C:\WINDOWS\system32\vpwyioef.ini 
C:\WINDOWS\system32\vyjoqiun.ini 
C:\WINDOWS\system32\ojsnxrgy.ini 
C:\WINDOWS\system32	qwlnuvh.ini 
C:\WINDOWS\system32\sgmytfvd.ini 
C:\WINDOWS\system32\ukilynlv.ini 
C:\WINDOWS\system32\katxfciv.ini 
C:\WINDOWS\system32\fsaxjoxn.ini 
C:\WINDOWS\system32\lmtkqyap.ini 
C:\WINDOWS\system32\atwboiha.ini 
C:\sqmnoopt09.sqm 
C:\sqmdata09.sqm 
C:\sqmnoopt08.sqm 
C:\sqmdata08.sqm 
C:\sqmnoopt07.sqm 
C:\sqmnoopt05.sqm 
C:\sqmdata07.sqm 
C:\sqmdata05.sqm 
C:\sqmdata06.sqm 
C:\sqmnoopt06.sqm 





* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
* Colle le texte copié dans ce bloc-notes (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt

Déconnecte toi du net et désactive ton antivirus pour que Combofix puisse s'exécuter normalement

* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe ( sur ton bureau)

* Une fenêtre bleue va apparaître: au message qui apparaît Type 1 to continue, or 2 to abort , tape 1 puis valide.

* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

* Une fois le scan achevé, un rapport va s'afficher : Poste son contenu et un nouveau rapport HijackThis

* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

botcaryo · Answer

désolé j'ai du m'absenter, je fais ca de suite

botcaryo · Answer

lorsque j'ai glissé déposé, il m'indique que certains fichiers  ne peuvent créés que je dois fermer toutes les applications et rebooter wondows et recommencer


je le fais ?

Utilisateur anonyme · Answer

attend j'ai commis une erreur  utilise celui ci de script     (by FILLPCA) merci a toi)


Driver::
Tah53

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\pmnklig]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C365396-CB85-4E18-A7E3-D609D3A27F55}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4f25d6c-6930-45e9-894f-0fb3b4b06c26}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CF1FF21-9927-4170-B19C-64DFC68D909C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84BC267-145C-42BC-AEB4-86640A7D819A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86FF02E0-EB53-4DA7-90BD-DA0FD39E54DA}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\703f84d0]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2b4c7 f d1-a8dd-11dc-86b0-00197d4885ca}]

File::
C:\WINDOWS\system32trvsbak.ini
C:\WINDOWS\system32\xcqvlllx.ini
C:\WINDOWS\system32\paarpxpi.ini
C:\WINDOWS\system32\qemgsxrg.ini
C:\WINDOWS\system32\xqwspcop.ini
C:\WINDOWS\system32
dojojsw.ini
C:\WINDOWS\system32\vpwyioef.ini
C:\WINDOWS\system32\vyjoqiun.ini
C:\WINDOWS\system32\ojsnxrgy.ini
C:\WINDOWS\system32\ukilynlv.ini
C:\WINDOWS\system32\katxfciv.ini
C:\WINDOWS\system32\fsaxjoxn.ini
C:\WINDOWS\system32\lmtkqyap.ini
C:\WINDOWS\system32\atwboiha.ini
C:\sqmnoopt09.sqm
C:\sqmdata09.sqm
C:\WINDOWS\system32\qqstv.ini2
C:\WINDOWS\system32\qqstv.ini
C:\sqmnoopt08.sqm
C:\sqmdata08.sqm
C:\sqmnoopt07.sqm
C:\sqmnoopt05.sqm
C:\sqmdata07.sqm
C:\sqmdata05.sqm
C:\sqmdata06.sqm
C:\sqmnoopt06.sqm
C:\WINDOWS\system32\kabsvrtr.dll
C:\WINDOWS\system32\Drivers\Tah53.sys
C:\WINDOWS\Tah53.sys
C:\WINDOWS\system32\fx.exe
C:\WINDOWS\system32\pv.exe
C:\WINDOWS\_delis32.ini

botcaryo · Answer

avec driver::
tah53?

Utilisateur anonyme · Answer

tout ce qu'il y a en gras !!

botcaryo · Answer

VOICI ComboFix 07-12-21.4 - Grégory Even 2007-12-30 19:52:33.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.588 [GMT 1:00] Running from: C:\Documents and Settings\Grégory Even\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Grégory Even\Bureau\CFScript.txt * Created a new restore point FILE C:\sqmdata05.sqm C:\sqmdata06.sqm C:\sqmdata07.sqm C:\sqmdata08.sqm C:\sqmdata09.sqm C:\sqmnoopt05.sqm C:\sqmnoopt06.sqm C:\sqmnoopt07.sqm C:\sqmnoopt08.sqm C:\sqmnoopt09.sqm C:\WINDOWS\_delis32.ini C:\WINDOWS\system32\atwboiha.ini C:\WINDOWS\system32\Drivers\Tah53.sys C:\WINDOWS\system32\fsaxjoxn.ini C:\WINDOWS\system32\fx.exe C:\WINDOWS\system32\kabsvrtr.dll C:\WINDOWS\system32\katxfciv.ini C:\WINDOWS\system32\lmtkqyap.ini C:\WINDOWS\system32 dojojsw.ini C:\WINDOWS\system32\ojsnxrgy.ini C:\WINDOWS\system32\paarpxpi.ini C:\WINDOWS\system32\pv.exe C:\WINDOWS\system32\qemgsxrg.ini C:\WINDOWS\system32\qqstv.ini C:\WINDOWS\system32\qqstv.ini2 C:\WINDOWS\system32 trvsbak.ini C:\WINDOWS\system32\ukilynlv.ini C:\WINDOWS\system32\vpwyioef.ini C:\WINDOWS\system32\vyjoqiun.ini C:\WINDOWS\system32\xcqvlllx.ini C:\WINDOWS\system32\xqwspcop.ini C:\WINDOWS\Tah53.sys . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\sqmdata05.sqm C:\sqmdata06.sqm C:\sqmdata07.sqm C:\sqmdata08.sqm C:\sqmdata09.sqm C:\sqmnoopt05.sqm C:\sqmnoopt06.sqm C:\sqmnoopt07.sqm C:\sqmnoopt08.sqm C:\sqmnoopt09.sqm C:\WINDOWS\_delis32.ini C:\WINDOWS\system32\3_exception.nls C:\WINDOWS\system32\atwboiha.ini C:\WINDOWS\system32\Drivers\Tah53.sys C:\WINDOWS\system32\fsaxjoxn.ini C:\WINDOWS\system32\fx.exe C:\WINDOWS\system32\katxfciv.ini C:\WINDOWS\system32\lmtkqyap.ini C:\WINDOWS\system32 dojojsw.ini C:\WINDOWS\system32\ojsnxrgy.ini C:\WINDOWS\system32\paarpxpi.ini C:\WINDOWS\system32\pv.exe C:\WINDOWS\system32\qemgsxrg.ini C:\WINDOWS\system32\qqstv.ini C:\WINDOWS\system32\qqstv.ini2 C:\WINDOWS\system32 trvsbak.ini C:\WINDOWS\system32\ukilynlv.ini C:\WINDOWS\system32\vpwyioef.ini C:\WINDOWS\system32\vyjoqiun.ini C:\WINDOWS\system32\xcqvlllx.ini C:\WINDOWS\system32\xqwspcop.ini C:\WINDOWS\Tah53.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_TAH53 -------\Tah53 ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-28 to 2007-12-30 )))))))))))))))))))))))))))))))))))) . 2007-12-30 17:40 . 2007-12-30 17:45 d-------- C:\Program Files\Navilog1 2007-12-30 16:16 . C:\Documents and Settings\GrÚgory Even\Local Settings 2007-12-30 16:16 . C:\Documents and Settings\GrÚgory Even\Local Settings 2007-12-30 15:38 . 2007-12-30 16:00 d-------- C:\VundoFix Backups 2007-12-30 15:17 . 2007-12-30 15:18 d-------- C:\WINDOWS\ERUNT 2007-12-30 14:48 . 2007-12-30 18:35 d-------- C:\HiJackThis 2007-12-30 13:22 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-12-30 13:22 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-12-30 13:22 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-12-30 13:22 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-30 13:22 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-30 13:22 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-30 13:22 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-30 13:22 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-30 12:45 . 2007-12-30 13:03 d-------- C:\Program Files\Alwil Software 2007-12-27 14:52 . 2007-12-27 14:52 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-18 19:35 . 2007-12-19 09:01 414 ---hs---- C:\WINDOWS\system32\yabuesus.ini 2007-12-15 15:52 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-12-15 08:43 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-12-15 08:43 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-12-15 08:43 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2007-12-14 21:09 . 2007-12-14 21:09 d-------- C:\Program Files\Windows Live Favorites 2007-12-14 18:01 . 2007-12-14 18:52 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2007-12-14 18:00 . 2007-12-14 18:55 d-------- C:\Program Files\Windows Live 2007-12-14 17:59 . 2007-12-14 18:49 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-12 21:34 . 2007-12-12 21:34 127 --a------ C:\WINDOWS\system32\MRT.INI 2007-12-12 07:33 . 2007-12-12 19:03 594 ---hs---- C:\WINDOWS\system32 qwlnuvh.ini 2007-12-11 07:44 . 2007-12-11 07:44 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2007-12-11 07:33 . 2007-12-11 19:17 474 ---hs---- C:\WINDOWS\system32\sgmytfvd.ini 2007-12-10 17:24 . 2007-12-10 17:24 d-------- C:\Program Files\Yahoo! 2007-12-10 17:24 . 2007-12-10 17:29 d-------- C:\Program Files\CCleaner 2007-12-05 21:39 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-04 18:39 . 2007-12-05 19:34 369 --a------ C:\WINDOWS\wininit.ini 2007-12-04 18:11 . 2007-12-28 08:32 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-03 23:00 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-30 11:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2007-12-30 11:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-27 11:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-27 11:29 --------- d-----w C:\Program Files\TomTom HOME 2007-12-14 20:10 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-12-14 17:11 --------- d-----w C:\Program Files\Fichiers communs\Logitech 2007-12-12 20:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\TomTom 2007-12-12 20:18 --------- d-----w C:\Program Files\Logitech 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys . ((((((((((((((((((((((((((((( snapshot@2007-12-30_16.15.44.26 ))))))))))))))))))))))))))))))))))))))))) . - 2007-12-30 15:06:41 53,770 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-30 18:52:30 53,770 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-12-30 15:06:41 64,922 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2007-12-30 18:52:30 64,922 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2007-12-30 15:06:41 382,026 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-30 18:52:30 382,026 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-12-30 15:06:41 447,222 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2007-12-30 18:52:30 447,222 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2007-12-30 18:56:42 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_138.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C365396-CB85-4E18-A7E3-D609D3A27F55}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{86FF02E0-EB53-4DA7-90BD-DA0FD39E54DA}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CF1FF21-9927-4170-B19C-64DFC68D909C}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a4f25d6c-6930-45e9-894f-0fb3b4b06c26}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84BC267-145C-42BC-AEB4-86640A7D819A}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00] "ModemOnHold"="C:\Program Files\NetWaiting etWaiting.exe" [2003-09-10 03:24] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 15:42] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 00:13] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-12-13 03:44] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-12-13 03:41] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-12-13 03:45] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 02:23] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 17:30 C:\WINDOWS\stsystra.exe] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 21:29] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-10-31 22:48] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-06-29 13:13] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2004-01-05 10:44] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28] "DXDllRegExe"="dxdllreg.exe" [] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-06 11:39] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-05 13:00] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\pmnklig] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="" S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2b4c7fd1-a8dd-11dc-86b0-00197d4885ca}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50612461-6cbb-11dc-8654-00197d4885ca}] \Shell\AutoRun\command - F:\InstallTomTomHOME.exe . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2007-12-30 18:01:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job" . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-30 19:57:12 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-30 19:59:07 - machine was rebooted C:\ComboFix2.txt ... 2007-12-30 18:46 C:\ComboFix3.txt ... 2007-12-30 16:16 . 2007-12-15 16:21:07 --- E O F ---

botcaryo · Answer

Que dois je faire pour la prochaine étape?

Utilisateur anonyme · Answer

télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\WINDOWS\system32\yabuesus.ini 
C:\WINDOWS\system32	qwlnuvh.ini 
C:\WINDOWS\system32\sgmytfvd.ini 

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

botcaryo · Answer

C:\WINDOWS\system32\yabuesus.ini moved successfully.
C:\WINDOWS\system32	qwlnuvh.ini moved successfully.
C:\WINDOWS\system32\sgmytfvd.ini moved successfully.
 
Created on 12/30/2007 21:07:04


Voila

Utilisateur anonyme · Answer

post un nouveau rapport hijackthis  stp

botcaryo · Answer

voici:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:17:53, on 30/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetWaiting
etWaiting.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\HiJackThis\sanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row-rel&channel=fr&ibd=4070123
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting
etWaiting.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?836641679c094e5f9143343be21f7840
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?836641679c094e5f9143343be21f7840
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

botcaryo · Answer

Merci encore pour le temps consacré à mes soucis:  sonny1024, carrosier13 et fillCPA pour votre bienveillance

J'attends vos instruction quand vous serez dispo, n'hésitez pas je ne suis pas couché lol

FillPCA · Answer

Salut,

Le rapport est propre, sauf que tu as 2 antivirus actifs. Il faut en désinstaller un.
Carrosser et sonny vont achever le nettoyage.

FillPCA

botcaryo · Answer

salut fillCPA

quels sont les 2 AV?  vu que ce n'est pas mon pc je ne sais pas trop....

il y a Avast et?

et lequel conseilles tu de garder?

merci

FillPCA · Answer

Re,

Il y a une entrée d'AVG antivirus, mais pas les services. La désinstallation a sans doute été incomplète.

botcaryo · Answer

effectivement il y avait avg antivirus
je croyais l'avoir désinstallé....

bref je ne vois pas de trace de cet antivirus dans ajout/suppression des prog ni dans cette fonction de ccleaner

comment puis je terminer sa desinstallation?

FillPCA · Answer

Re,

Ouvre Hijackthis>"Do a scan only" et coche ceci :
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
Clique sur fix/réparer.

Supprime le dossier d'AVGantivirus. IL se trouve ici :
C:\PROGRA~1\Grisoft\AVGFRE~1

Ne confonds pas AVGantispyware. Je ne connais pas son nom exact.

FillPCA

botcaryo · Answer

ok merci je le fais de suite

botcaryo · Answer

j'ai fais via hijackthis

parce que pas moyen de trouver C:\PROGRA~1\Grisoft\AVGFRE~1 

ca a du le supprimer


bon encore merci Fill 


tu parlais de finir le nettoyage

peux tu m'en dire plus ou peut etre que j'en demande trop , il se fait tard...je voudrais pas abuser quand même

FillPCA · Answer

Re,

1/ Lance AVG Anti-Spyware
Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas.
Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.

2/     *  Fais un scan en ligne en cliquant ici : https://www.bitdefender.com/toolbox/
    * Tu dois réaliser le scan en utilisant Internet explorer. Une information apparait en haut, près de la barre d'état. Tu dois accepter et installer l'activeX proposé. La mise à jour de l'antivirus se lance.
    * Réalise un scan complet du système.
    * Sauvegarde le rapport en mode texte à l'issue du scan.

Edite ces 2 rapports et dis-nous comment le pc se porte.

FillPCA

botcaryo · Answer

oki doki


je poste cela des que possible

soit dans environ 35minutes

botcaryo · Answer

rapport avg:
*
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	23:21:53 30/12/2007

 + Résultat de l'analyse:	



C:\Documents and Settings\Grégory Even\Cookies\grégory_even@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Grégory Even\Cookies\grégory_even@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Grégory Even\Cookies\grégory_even@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.


Fin du rapport

botcaryo · Answer

voila la suite mais je crois que c'est pas bon


BitDefender Online Scanner - Real Time Virus Report
  
  
 
Generated at: Mon, Dec 31, 2007 - 00:02:16
 

--------------------------------------------------------------------------------

 
  
  
 
Scan Info
  
  
 
Scanned Files
 171699
 
Infected Files
 285
 
  
  
 
 
  
  
 
Virus Detected
  
  
 
Trojan.Vundo.DRP
 8
 
Trojan.Vundo.DSA
 4
 
Trojan.Vundo.DRT
 25
 
Trojan.Fotomoto.H
 3
 
Trojan.Vundo.DSF
 2
 
Adware.Virtumonde.GGZ
 2
 
Trojan.Vundo.DSI
 56
 
Trojan.Vundo.DTJ
 104
 
Trojan.Vundo.DSJ
 28
 
Trojan.Kobcka.BY
 20
 
Backdoor.SDBot.DFCW
 33
 
  
  
 
 
  
  
 
 

--------------------------------------------------------------------------------
  
  
 
This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world.

botcaryo · Answer

c bizarre c'est vundo qui m'a mis ces virus?

botcaryo · Answer

aprés un deuxieme scan:   c mieux!!!


BitDefender Online Scanner
  
  
 
Scan report generated at: Mon, Dec 31, 2007 - 00:54:39
 
 
  
  
 
Scan path: C:\;D:\;
  
  
 
 
  
  
 
Statistics
 
Time
 00:30:20
 
Files
 166501
 
Folders
 3719
 
Boot Sectors
 3
 
Archives
 3563
 
Packed Files
 12760
 
  
  
 
Results
 
Identified Viruses 
 0
 
Infected Files 
 0
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 0
 
  
  
 
Engines Info
 
Virus Definitions
 884790
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 14
 
Archive plugins
 38
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 1
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
No virus found.

FillPCA · Answer

Salut,

Comment le pc se porte-t-il ? Tu n'as pas le chemin des fichiers infectés du 1er rapport ?

FillPCA

botcaryo · Answer

le pc a l'air mieux


qu'est ce que le chemin des fichiers infectés?, leur localisation?

je te mets un truc en html , désolé c'est peut etre cela dont tu parles (1er rapport)

je te mets le début car il y en a un paquet!!!!!

botcaryo · Answer

C:\qoobox\Quarantine\catchme2007-12-30_195701.62.zip=>Tah53.sys

Infected with: Trojan.Kobcka.BY

C:\qoobox\Quarantine\catchme2007-12-30_195701.62.zip=>Tah53.sys

Disinfection failed

C:\qoobox\Quarantine\catchme2007-12-30_195701.62.zip=>Tah53.sys

Deleted

C:\qoobox\Quarantine\catchme2007-12-30_195701.62.zip

Updated

C:\qoobox\Quarantine\catchme2007-12-30_195701.62.zip=>Tah53.sys.1

Infected with: Trojan.Kobcka.BY

C:\qoobox\Quarantine\catchme2007-12-30_195701.62.zip=>Tah53.sys.1

Disinfection failed

C:\qoobox\Quarantine\catchme2007-12-30_195701.62.zip=>Tah53.sys.1

Deleted

C:\qoobox\Quarantine\catchme2007-12-30_195701.62.zip

Updated

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP201\A0026510.dll

Infected with: Trojan.Vundo.DRT

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP201\A0026510.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP201\A0026510.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028008.exe

Infected with: Trojan.Fotomoto.H

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028008.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028008.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028015.dll

Infected with: Trojan.Vundo.DRT

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028015.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028015.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028016.dll

Infected with: Trojan.Vundo.DRT

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028016.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP203\A0028016.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP204\A0028058.dll

Infected with: Trojan.Vundo.DRT

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP204\A0028058.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP204\A0028058.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP204\A0028082.dll

Infected with: Trojan.Vundo.DTJ

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP204\A0028082.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP204\A0028082.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP213\A0031479.exe

Infected with: Trojan.Fotomoto.H

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP213\A0031479.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP213\A0031479.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP213\A0031518.dll

Infected with: Trojan.Vundo.DRT

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP213\A0031518.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP213\A0031518.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP217\A0035775.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP217\A0035775.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP217\A0035775.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP217\A0035800.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP217\A0035800.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP217\A0035800.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035847.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035847.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035847.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035848.dll

Infected with: Trojan.Vundo.DRT

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035848.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035848.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035872.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035872.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035872.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035901.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035901.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035901.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035902.dll

Infected with: Trojan.Vundo.DRT

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035902.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP218\A0035902.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0036924.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0036924.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0036924.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0036991.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0036991.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0036991.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0037043.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0037043.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0037043.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0037084.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0037084.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0037084.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039113.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039113.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039113.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039134.exe

Infected with: Trojan.Fotomoto.H

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039134.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039134.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039138.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039138.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP220\A0039138.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0039176.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0039176.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0039176.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0039191.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0039191.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0039191.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042320.sys

Infected with: Trojan.Kobcka.BY

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042320.sys

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042320.sys

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042339.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042339.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042339.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042340.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042340.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042340.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042341.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042341.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042341.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042342.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042342.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042342.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042343.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042343.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042343.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042344.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042344.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042344.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042345.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042345.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042345.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042346.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042346.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042346.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042347.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042347.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042347.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042348.dll

Infected with: Trojan.Vundo.DTJ

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042348.dll

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042348.dll

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042349.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042349.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042349.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042350.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042350.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042350.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042351.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042351.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042351.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042352.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042352.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042352.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042353.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042353.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042353.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042354.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042354.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042354.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042355.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042355.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042355.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042356.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042356.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042356.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042357.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042357.exe

Disinfection failed

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042357.exe

Deleted

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042358.exe

Infected with: Backdoor.SDBot.DFCW

C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP221\A0042358.exe

botcaryo · Answer

aprés c'est encore system et restore....et au aussi des lignes avec les bacup de vundofix

botcaryo · Answer

C:\VundoFix Backups\fccyayy.dll.bad

Infected with: Trojan.Vundo.DSI

C:\VundoFix Backups\fccyayy.dll.bad

Disinfection failed

C:\VundoFix Backups\fccyayy.dll.bad

Deleted

C:\VundoFix Backups\foiledcg.exe.bad

Infected with: Trojan.Vundo.DRP

C:\VundoFix Backups\foiledcg.exe.bad

Disinfection failed

C:\VundoFix Backups\foiledcg.exe.bad

Deleted

C:\VundoFix Backups\fpyobsrx.dll.bad

Infected with: Trojan.Vundo.DSJ

C:\VundoFix Backups\fpyobsrx.dll.bad

Disinfection failed

C:\VundoFix Backups\fpyobsrx.dll.bad

Deleted

C:\VundoFix Backups\gebcywu.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\gebcywu.dll.bad

Disinfection failed

C:\VundoFix Backups\gebcywu.dll.bad

Deleted

C:\VundoFix Backups\gebxxwx.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\gebxxwx.dll.bad

Disinfection failed

C:\VundoFix Backups\gebxxwx.dll.bad

Deleted

C:\VundoFix Backups\hkrnhayq.dll.bad

Infected with: Trojan.Vundo.DSA

C:\VundoFix Backups\hkrnhayq.dll.bad

Disinfection failed

C:\VundoFix Backups\hkrnhayq.dll.bad

Deleted

C:\VundoFix Backups\hlwgiphr.dll.bad

Infected with: Trojan.Vundo.DSJ

C:\VundoFix Backups\hlwgiphr.dll.bad

Disinfection failed

C:\VundoFix Backups\hlwgiphr.dll.bad

Deleted

C:\VundoFix Backups\hvhjlrid.dll.bad

Infected with: Trojan.Vundo.DSJ

C:\VundoFix Backups\hvhjlrid.dll.bad

Disinfection failed

C:\VundoFix Backups\hvhjlrid.dll.bad

Deleted

C:\VundoFix Backups\hvunlwqt.dll.bad

Infected with: Trojan.Vundo.DRT

C:\VundoFix Backups\hvunlwqt.dll.bad

Disinfection failed

C:\VundoFix Backups\hvunlwqt.dll.bad

Deleted

C:\VundoFix Backups\iifdeeb.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\iifdeeb.dll.bad

Disinfection failed

C:\VundoFix Backups\iifdeeb.dll.bad

Deleted

C:\VundoFix Backups\jagq.exe.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\jagq.exe.bad

Disinfection failed

C:\VundoFix Backups\jagq.exe.bad

Deleted

C:\VundoFix Backups\jdfrdqoq.dll.bad

Infected with: Trojan.Vundo.DSJ

C:\VundoFix Backups\jdfrdqoq.dll.bad

Disinfection failed

C:\VundoFix Backups\jdfrdqoq.dll.bad

Deleted

C:\VundoFix Backups\jkkhecc.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\jkkhecc.dll.bad

Disinfection failed

C:\VundoFix Backups\jkkhecc.dll.bad

Deleted

C:\VundoFix Backups\jkkkkjj.dll.bad

Infected with: Trojan.Vundo.DSI

C:\VundoFix Backups\jkkkkjj.dll.bad

Disinfection failed

C:\VundoFix Backups\jkkkkjj.dll.bad

Deleted

C:\VundoFix Backups\jkklllj.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\jkklllj.dll.bad

Disinfection failed

C:\VundoFix Backups\jkklllj.dll.bad

Deleted

C:\VundoFix Backups\khfcawt.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\khfcawt.dll.bad

Disinfection failed

C:\VundoFix Backups\khfcawt.dll.bad

Deleted

C:\VundoFix Backups\khfcdba.dll.bad

Infected with: Trojan.Vundo.DSI

C:\VundoFix Backups\khfcdba.dll.bad

Disinfection failed

C:\VundoFix Backups\khfcdba.dll.bad

Deleted

C:\VundoFix Backups\khfecay.dll.bad

Infected with: Trojan.Vundo.DSI

C:\VundoFix Backups\khfecay.dll.bad

Disinfection failed

C:\VundoFix Backups\khfecay.dll.bad

Deleted

C:\VundoFix Backups\khfgeee.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\khfgeee.dll.bad

Disinfection failed

C:\VundoFix Backups\khfgeee.dll.bad

Deleted

C:\VundoFix Backups\ljjhfca.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\ljjhfca.dll.bad

Disinfection failed

C:\VundoFix Backups\ljjhfca.dll.bad

Deleted

C:\VundoFix Backups\ljjhfec.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\ljjhfec.dll.bad

Disinfection failed

C:\VundoFix Backups\ljjhfec.dll.bad

Deleted

C:\VundoFix Backups\ljjigfg.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\ljjigfg.dll.bad

Disinfection failed

C:\VundoFix Backups\ljjigfg.dll.bad

Deleted

C:\VundoFix Backups\ljjigge.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\ljjigge.dll.bad

Disinfection failed

C:\VundoFix Backups\ljjigge.dll.bad

Deleted

C:\VundoFix Backups\mljhiig.dll.bad

Infected with: Trojan.Vundo.DTJ

C:\VundoFix Backups\mljhiig.dll.bad

Disinfection failed

C:\VundoFix Backups\mljhiig.dll.bad

Deleted

C:\VundoFix Backups\mljjgda.dll.bad

Infected with: Trojan.Vundo.DTJ un apercu

FillPCA · Answer

Re,

OK.

1/     *  Lance OTmoveIT.
    * Clique sur CleanUp! (le programme va télécharger un fichier texte qui servira a nettoyer les programmes que l'on a téléchargés).

NOTE : Normalement, ton firewall (parefeu) devrait te demander si OTmoveIT peut accéder à internet, Autorise le.

    * Une liste apparaît dans la partie gauche d'OTmoveIT.
    * Un message apparaît pour confirmer le nettoyage. Confirme.
    * Les fichiers infectés qui se trouvent dans les quarantaines seront supprimés aussi.

2/ Tu dois désactiver puis réactiver la restauration système. Pour cela, fais un clic droit sur « poste de travail ». Dans l’onglet « restauration du système », coche la case « désactiver la restauration système ». Clique sur appliquer.
Décoche cette case, clique sur appliquer>OK et redémarre le PC.

Comment le pc se porte-t-il ?

FillPCA

botcaryo · Answer

c'est fait le pc parait bien,

je crois que c'est là que je remercie sincèrement toutes les personnes qui ont copntribué a la renaissance du pc de mon ami!

je crois avoir compris un peu la logique de soin du pc

sauf que c'est au moment ou intervien move it
comment faites vous pour sélectionner ces lignes qu'il faut ensuite renommer en cfsript et glisser dans combofix?

FillPCA · Answer

Re,

Tu veux dire pour reconnaître les lignes néfastes ?

FillPCA

botcaryo · Answer

oui c'est cela même

Utilisateur anonyme · Answer

salut  fillpca ,carossier



j'ai suivi   votre  intervention ,   merci  de m'avoir  aidé   et pris  la reléve.



                                                
                botcaryo, content  pour  toi que tu  as  retrouvé   1 nouvelle jeunesse dans ton pc     



                                                                    bonne  transition pour  2008

Utilisateur anonyme · Answer

bonjour a tous, vous avez tous tres bien bien bosses !   je veu juste mettre en avant la fait qu'il ne faut jamais desactiver la restauration du systeme si on as un doute d'avoir vraiment termine, il vaus mieux un point de restauration infecte, que pas du tout ! c'est le seul petite erreurs qui a ete commis ! merci a FILLPCA  

d'ailleur botcaryo il faut que tu purge ta restauration systeme si fillpca ne te l'a pas deja fait faire

botcaryo · Answer

d'ailleur botcaryo il faut que tu purge ta restauration systeme si fillpca ne te l'a pas deja fait faire

Comment cela? purger ma restauration?

on a fait cela avec fillCPA:

2/ Tu dois désactiver puis réactiver la restauration système. Pour cela, fais un clic droit sur « poste de travail ». Dans l’onglet « restauration du système », coche la case « désactiver la restauration système ». Clique sur appliquer.
Décoche cette case, clique sur appliquer>OK et redémarre le PC.

Comment le pc se porte-t-il ?

FillPCA



estr ce cela dont tu parles?

Utilisateur anonyme · Answer

tout a fait c'est tout bon pour moi !  ;)

botcaryo · Answer

ok merci je tag le sujet comme résolu

Merci encore Sonny1024, Carrosier13 et FillCPA

FillPCA · Answer

Re,

C'est un peu compliqué à expliquer, mais l'infection Vundo qui te touchait (entre autres) se caractérise par des entrée en 02 et en 20 dans le registre et des fichier .dll, et .ini caractéristiques.

1/ Il est fortement recommandé d'avoir tous ses logiciels de sécurité à jour, afin d'éviter les failles par lesquelles s'engouffrent les infections.
2/ Tu peux supprimer tous les logiciels que nous avons utilisés (Type: SmitFraufix, Blacklight, SDFix, lopxpMH, ect.....) qui traitent des infections spécifiques et qui sont mis à jour régulièrement. Il est inutile de les garder sur ton PC.
Tu peux par contre, garder AVG Antispyware et CCleaner.
3/ Comment faire pour...(lettre A): https://forum.pcastuces.com/sujet.asp?f=25&s=3902 
Pour améliorer la sécurité de ton PC prend quelques instants pour lire:
Sécuriser son PC +WIFI (versions "hot" & "light"): https://forum.pcastuces.com/default.asp 
4/ Dénonce ton infection pour faire condamner les auteurs.

Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :
- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"

Tu as alors, sous forme de liste, un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).

*** Tes infections : Vundo, Fotomoto, Kobcka, Backdoor.SDBot ***
>> https://malwarecomplaints.info/
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections, conforme au règle du forum (âge, ville, département etc..)
Indique aussi le nom du Forum qui t'a aidé : CCM 
5/ Tu peux marquer ton sujet comme résolu en cliquant sur le bouton.
6/ Je te conseille enfin de défragmenter ton PC : http://www.coupdepoucepc.com/modules/news/article.php?storyid=218

Bon surf !

Content qu'on ai pu t'aider.

FillPCA

botcaryo · Answer

merci

PC infecté: virtumonde, rootkit etc...

70 réponses

Newsletters