Search-daily Résolu

Question

Bonjour,
Je suis sous une poste infecté par search-daily, voiçi le rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:10:37, on 01/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\SECURITE\a-squared Free\a2service.exe
C:\WINDOWS\system32\dllhost.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMA32.EXE
C:\WINDOWS\system32\svchost.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMB32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FCH32.EXE
C:\WINDOWS\system32\rundll32.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSM32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FAMEH32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsqh.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSGUI\fsguidll.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsaua.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FWES\Program\fsdfwd.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\wscntfy.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsus.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG04.EXE
D:\OUTILS\acdsee2.41\ACDSee32\ACDSee32.exe
D:\SECURITE\HijackThis\HijackThis.exe

c:\windows\system32\ajjaajj.dll
c:\windows\system32\qjywfcku.dll

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {61039EB5-B0CE-4D79-8E21-7112CCCD943C} - c:\windows\system32\ajjaajj.dll
O2 - BHO: (no name) - {FBB43BE8-D3D1-454B-AAB5-6E09318C80C1} - c:\windows\system32\qjywfcku.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [F-Secure Manager] "D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F31D94B8-2404-45D6-B5EF-20CF20F8EB92}: NameServer = 212.151.137.170 212.151.136.246
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\SECURITE\a-squared Free\a2service.exe
O23 - Service: Diskeeper - Unknown owner - F:\OUTILS\Diskeeper.Pro Premier.10\DkService.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

jorginho67 · Answer

oki, je serais là dans l'après midi !

@+

orb42 · Answer

bonjour, 

VOILA les logs:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:08, on 03/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\SECURITE\a-squared Free\a2service.exe
D:\SECURITE\AVG Anti-Spyware 7.5.1.43\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\dllhost.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMA32.EXE
C:\WINDOWS\system32\svchost.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMB32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FCH32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FAMEH32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsqh.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsaua.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FWES\Program\fsdfwd.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\wscntfy.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsus.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\rundll32.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSM32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {61039EB5-B0CE-4D79-8E21-7112CCCD943C} -
c:\windows\system32\ajjaajj.dll
O2 - BHO: (no name) - {FBB43BE8-D3D1-454B-AAB5-6E09318C80C1} -
c:\windows\system32\qjywfcku.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [F-Secure Manager] "D:\SECURITE\F-SECURE IS 2008\F-Secure
Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware
Terminator\SpywareTerminatorShield.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F31D94B8-2404-45D6-B5EF-20CF20F8EB92}:
NameServer = 212.151.137.170 212.151.136.246
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH -
D:\SECURITE\a-squared Free\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\SECURITE\AVG
Anti-Spyware 7.5.1.43\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Unknown owner - F:\OUTILS\Diskeeper.Pro
Premier.10\DkService.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure
Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation -
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure
Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation -
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMA32.EXE

--
End of file - 4576 bytes











VundoFix V6.3.23

Checking Java version...

Scan started at 20:53:36 03/01/2008

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.3.23

Checking Java version...

Scan started at 21:08:32 03/01/2008

Listing files found while scanning....


Beginning removal...

 Attempting to delete c:\windows\system32\ajjaajj.dll
c:\windows\system32\ajjaajj.dll Could not be deleted.

 Attempting to delete c:\windows\system32\qjywfcku.dll
c:\windows\system32\qjywfcku.dll Could not be deleted.

Performing Repairs to the registry.
Done!

jorginho67 · Answer

c:\windows\system32\ajjaajj.dll Could not be deleted.

c:\windows\system32\qjywfcku.dll Could not be deleted. 

vundofix n'en vien pas à bout...
Télécharge VirtumundoBegone sur ton bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBegone.exe et suis les instructions.
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis.
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu

orb42 · Answer

alors voiçi le log virtumundo:


[01/03/2008, 23:19:35] - VirtumundoBeGone v1.5 ( "D:\DOCS\LOGICIELS
TELECHARGES\INTERNET\ANTISPYWARE\VirtumundoBeGone.exe" )
[01/03/2008, 23:19:49] - Detected System Information:
[01/03/2008, 23:19:49] -  Windows Version: 5.1.2600, Service Pack 2
[01/03/2008, 23:19:49] -  Current Username: *** (Admin)
[01/03/2008, 23:19:49] -  Windows is in NORMAL mode.
[01/03/2008, 23:19:49] - Searching for Browser Helper Objects:
[01/03/2008, 23:19:49] -  BHO 1: {61039EB5-B0CE-4D79-8E21-7112CCCD943C} ()
[01/03/2008, 23:19:49] - WARNING: BHO has no default name. Checking for Winlogon
reference.
[01/03/2008, 23:19:49] -  Checking for HKLM\...\Winlogon\Notify\ajjaajj
[01/03/2008, 23:19:49] -  Key not found: HKLM\...\Winlogon\Notify\ajjaajj,
continuing.
[01/03/2008, 23:19:49] -  BHO 2: {FBB43BE8-D3D1-454B-AAB5-6E09318C80C1} ()
[01/03/2008, 23:19:49] - WARNING: BHO has no default name. Checking for Winlogon
reference.
[01/03/2008, 23:19:49] -  Checking for HKLM\...\Winlogon\Notify\qjywfcku
[01/03/2008, 23:19:49] -  Key not found: HKLM\...\Winlogon\Notify\qjywfcku,
continuing.
[01/03/2008, 23:19:49] - Finished Searching Browser Helper Objects
[01/03/2008, 23:19:49] - Finishing up...
[01/03/2008, 23:19:49] - Nothing found! Exiting...




et hijack:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:21:56, on 03/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\SECURITE\a-squared Free\a2service.exe
D:\SECURITE\AVG Anti-Spyware 7.5.1.43\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\dllhost.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMA32.EXE
C:\WINDOWS\system32\svchost.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMB32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FCH32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FAMEH32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsqh.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsaua.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FWES\Program\fsdfwd.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\wscntfy.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsus.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\rundll32.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSM32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {61039EB5-B0CE-4D79-8E21-7112CCCD943C} -
c:\windows\system32\ajjaajj.dll
O2 - BHO: (no name) - {FBB43BE8-D3D1-454B-AAB5-6E09318C80C1} -
c:\windows\system32\qjywfcku.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [F-Secure Manager] "D:\SECURITE\F-SECURE IS 2008\F-Secure
Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware
Terminator\SpywareTerminatorShield.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F31D94B8-2404-45D6-B5EF-20CF20F8EB92}:
NameServer = 212.151.136.246 212.151.137.170
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH -
D:\SECURITE\a-squared Free\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\SECURITE\AVG
Anti-Spyware 7.5.1.43\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Unknown owner - F:\OUTILS\Diskeeper.Pro
Premier.10\DkService.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure
Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation -
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure
Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation -
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMA32.EXE

jorginho67 · Answer

juste une question, quel est ton FAI ? télé2 ?

c:\windows\system32\ajjaajj.dll 
c:\windows\system32\qjywfcku.dll    

ces deux DLL me turlupinenet, faut que je voie ça en détail, je te tiens au courant.
@+

orb42 · Answer

en fait je fais le relais-assistance par telephone avec la personne qui a son poste infecté, c'est plus facile car cette personne ne si connait pas beaucoup en securité. Ca prends aussi plus de temps par contre. Et elle est chez tele2 oui.

jorginho67 · Answer

ok !
c'est juste que j'ai un souci avec le fameux redirectionnement d' IP , la recherche me donne bien Télé 2 mais l'adresse en Suede, je regarde si c'est normal ( puisque depuis quelque temps, le marché internet s'est ouvert aux autres pays......) donc, je regarde si c'est normal...
je regarde tout ça, quand j'aurais une manip " concrete " je te tiens au courant, comme ça, ça t'évitera de passer tout ton temps au téléphone..

je regarde ça assez rapidement.

@ +

orb42 · Answer

up!

Lyonnais92 · Answer

Bonsoir à tous les 2,

Vundo devient collant lol.

On va essayer comme ça :

télécharge combofix (par sUBs)ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe


et enregistre le sur le bureau.

2 double-clique sur combofix.exe et suis les instructions

3 à la fin, il va produire un rapport C:\ComboFix.txt

4 copie/colle ce rapport dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

jorginho67 · Answer

Merci Lyonnais, Vundo devient collant lol.   en effet, on le voit de plus en plus !

orb42 · Answer

Bonjour! voilà le rapport:

ComboFix 07-12-31.4 - *** 2008-01-06 12:37:33.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.304 [GMT 1:00]
Running from: D:\DOCS\LOGICIELS TELECHARGES\INTERNET\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-12-06 to 2008-01-06
))))))))))))))))))))))))))))))))))))
.

2008-01-06 12:36 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-03 22:28 . 2008-01-03 22:28 <REP> d-------- C:\Program Files\Trend Micro
2008-01-03 20:53 . 2008-01-03 21:20 <REP> d-------- C:\VundoFix Backups
2008-01-01 17:41 . 2008-01-01 17:41 <REP> d-------- C:\Documents and
Settings\gerard\Application Data\Grisoft
2008-01-01 17:41 . 2008-01-01 17:41 <REP> d-------- C:\Documents and
Settings\All Users\Application Data\Grisoft
2008-01-01 17:41 . 2007-05-30
13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-01 13:07 . 2008-01-01 13:26 <REP> d-------- C:\Program Files\Navilog1
2008-01-01 12:18 . 2008-01-01 12:18 0 --a------ C:\WINDOWS\system32\8104297.jun
2007-12-09 16:14 . 2008-01-01 12:10 1,660 --a------ C:\WINDOWS\system32\tmp.reg

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M
))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 11:40 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-12-06 19:17 19,456 ----a-w C:\WINDOWS\system32\drivers\udeohwfs.dat
2007-11-29 16:02 --------- d-----w C:\Documents and Settings\gerard\Application
Data\F-Secure
2007-11-29 15:53 --------- d-----w C:\Documents and Settings\All
Users\Application Data\F-Secure
2007-11-29 15:50 --------- d-----w C:\Documents and Settings\All
Users\Application Data\fssg
2007-11-20 09:39 84,480 ----a-w C:\WINDOWS\system32\ajjaajj.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg
)))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{61039EB5-B0CE-4D79-8E21-7112CCCD943C}]
2007-11-20 10:39 84480 --a------ c:\windows\system32\ajjaajj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{FBB43BE8-D3D1-454B-AAB5-6E09318C80C1}]
2007-09-05 09:51 95744 --a------ c:\windows\system32\qjywfcku.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"="stmctrl.dll" [2003-09-19 12:24 151552
C:\WINDOWS\system32\stmctrl.dll]
"F-Secure Manager"="D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\Common\FSM32.exe" [2007-05-25 14:12 183208]
"F-Secure TNB"="D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FSGUI\TNBUtil.exe" [2007-05-25 14:11 740208]
"SpywareTerminator"="C:\Program Files\Spyware
Terminator\SpywareTerminatorShield.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoRecentDocsMenu"= 1 (0x1)
"NoSetActiveDesktop"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoStartMenuNetworkPlaces"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoUserNameInStartMenu"= 1 (0x1)
"NoRecentDocsHistory"= 1 (0x1)
"MaxRecentDocs"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoNetworkConnections"= 1 (0x1)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoRecentDocsMenu"= 1 (0x1)
"NoSetActiveDesktop"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoStartMenuNetworkPlaces"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoUserNameInStartMenu"= 1 (0x1)
"NoRecentDocsHistory"= 1 (0x1)
"MaxRecentDocs"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoNetworkConnections"= 1 (0x1)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Picture Package Menu.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Picture Package Menu.lnk
backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Picture Package VCD Maker.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Picture Package VCD Maker.lnk
backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Update_0707_KB77012.exe]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Update_0707_KB77012.exe
backup=C:\WINDOWS\pss\Update_0707_KB77012.exeCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LogitechGalleryRepair]
2002-06-20 12:26 155648 --a------ C:\Program
Files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LogitechImageStudioTray]
2002-06-20 12:25 45056 --a------ C:\Program
Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WebCamRT.exe"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DiskeeperSystray"="F:\OUTILS\Diskeeper.Pro Premier.10\DkIcon.exe"
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
"HPHmon03"=C:\WINDOWS\system32\hphmon03.exe
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
"<NO NAME>"=
"LVCOMS"=C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys
[2007-05-25 14:09]
R0 wlsqxlzh;Microsoft RPC API Helper;C:\WINDOWS\system32\drivers\udeohwfs.dat []
R1 F-Secure HIPS;F-Secure HIPS;D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\HIPS\fshs.sys [2007-05-25 14:12]
R3 Dot4Usb HPH09;Dot4Usb HPH09;C:\WINDOWS\system32\drivers\hphius09.sys
[2003-01-30 18:55]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\SECURITE\F-SECURE IS 2008\F-Secure
Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 14:08]
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-09-19
12:24]
R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys
[2003-09-19 12:24]
S3 AVR309Prj;AVR309:USB to UART device
driver;C:\WINDOWS\system32\Drivers\AVR309.sys [2007-02-08 15:16]
S3 PhilCam8116;Logitech QuickCam Pro
3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2002-06-10 14:16]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys
[2002-10-15 21:41]
S3 USBSHGX;SHARP GSM GPRS USB Driver
2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys [2004-09-06 23:32]
S4 F-Secure Filter;F-Secure File System Filter;D:\SECURITE\F-SECURE IS
2008\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 14:09]
S4 F-Secure Recognizer;F-Secure File System Recognizer;D:\SECURITE\F-SECURE IS
2008\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 14:09]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost -
NetSvcs
cibzmvtm

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-01-06 12:40:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-06 12:41:39

Lyonnais92 · Answer

Bonjour,

tu es sur une versuon obsolète de Combofix.

Supprime tout ce qui concerne combofix de ton ordi et télécharge le d'ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

exécute le et poste le rapport.

orb42 · Answer

ComboFix 08-01-04.1 - *** 2008-01-06 15:35:18.6 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.286 [GMT 1:00]
Running from: C:\Documents and Settings\***\Bureau\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers créés 2007-12-06 to 2008-01-06
))))))))))))))))))))))))))))))))))))
.

2008-01-06 12:36 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-03 22:28 . 2008-01-03 22:28 <REP> d-------- C:\Program Files\Trend Micro
2008-01-03 20:53 . 2008-01-03 21:20 <REP> d-------- C:\VundoFix Backups
2008-01-01 17:41 . 2008-01-01 17:41 <REP> d-------- C:\Documents and
Settings\gerard\Application Data\Grisoft
2008-01-01 17:41 . 2008-01-01 17:41 <REP> d-------- C:\Documents and
Settings\All Users\Application Data\Grisoft
2008-01-01 17:41 . 2007-05-30
13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-01 13:07 . 2008-01-01 13:26 <REP> d-------- C:\Program Files\Navilog1
2008-01-01 12:18 . 2008-01-01 12:18 0 --a------ C:\WINDOWS\system32\8104297.jun
2007-12-09 16:14 . 2008-01-01 12:10 1,660 --a------ C:\WINDOWS\system32\tmp.reg

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M
))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 11:40 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-12-06 19:17 19,456 ----a-w C:\WINDOWS\system32\drivers\udeohwfs.dat
2007-11-29 16:02 --------- d-----w C:\Documents and Settings\gerard\Application
Data\F-Secure
2007-11-29 15:53 --------- d-----w C:\Documents and Settings\All
Users\Application Data\F-Secure
2007-11-29 15:50 --------- d-----w C:\Documents and Settings\All
Users\Application Data\fssg
2007-11-20 09:39 84,480 ----a-w C:\WINDOWS\system32\ajjaajj.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg
)))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{61039EB5-B0CE-4D79-8E21-7112CCCD943C}]
2007-11-20 10:39 84480 --a------ c:\windows\system32\ajjaajj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{FBB43BE8-D3D1-454B-AAB5-6E09318C80C1}]
2007-09-05 09:51 95744 --a------ c:\windows\system32\qjywfcku.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"="stmctrl.dll" [2003-09-19 12:24 151552
C:\WINDOWS\system32\stmctrl.dll]
"F-Secure Manager"="D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\Common\FSM32.exe" [2007-05-25 14:12 183208]
"F-Secure TNB"="D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FSGUI\TNBUtil.exe" [2007-05-25 14:11 740208]
"SpywareTerminator"="C:\Program Files\Spyware
Terminator\SpywareTerminatorShield.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoSetActiveDesktop"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoStartMenuNetworkPlaces"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoUserNameInStartMenu"= 1 (0x1)
"MaxRecentDocs"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoNetworkConnections"= 1 (0x1)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoSetActiveDesktop"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoStartMenuNetworkPlaces"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoUserNameInStartMenu"= 1 (0x1)
"MaxRecentDocs"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoNetworkConnections"= 1 (0x1)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Picture Package Menu.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Picture Package Menu.lnk
backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Picture Package VCD Maker.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Picture Package VCD Maker.lnk
backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Update_0707_KB77012.exe]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Update_0707_KB77012.exe
backup=C:\WINDOWS\pss\Update_0707_KB77012.exeCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LogitechGalleryRepair]
2002-06-20 12:26 155648 --a------ C:\Program
Files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LogitechImageStudioTray]
2002-06-20 12:25 45056 --a------ C:\Program
Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WebCamRT.exe"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DiskeeperSystray"="F:\OUTILS\Diskeeper.Pro Premier.10\DkIcon.exe"
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
"HPHmon03"=C:\WINDOWS\system32\hphmon03.exe
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
"<NO NAME>"=
"LVCOMS"=C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys
[2007-05-25 14:09]
R0 wlsqxlzh;Microsoft RPC API Helper;C:\WINDOWS\system32\drivers\udeohwfs.dat []
R1 F-Secure HIPS;F-Secure HIPS;D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\HIPS\fshs.sys [2007-05-25 14:12]
R3 Dot4Usb HPH09;Dot4Usb HPH09;C:\WINDOWS\system32\drivers\hphius09.sys
[2003-01-30 18:55]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\SECURITE\F-SECURE IS 2008\F-Secure
Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 14:08]
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-09-19
12:24]
R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys
[2003-09-19 12:24]
S3 AVR309Prj;AVR309:USB to UART device
driver;C:\WINDOWS\system32\Drivers\AVR309.sys [2007-02-08 15:16]
S3 PhilCam8116;Logitech QuickCam Pro
3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2002-06-10 14:16]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys
[2002-10-15 21:41]
S3 USBSHGX;SHARP GSM GPRS USB Driver
2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys [2004-09-06 23:32]
S4 F-Secure Filter;F-Secure File System Filter;D:\SECURITE\F-SECURE IS
2008\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 14:09]
S4 F-Secure Recognizer;F-Secure File System Recognizer;D:\SECURITE\F-SECURE IS
2008\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 14:09]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost -
NetSvcs
cibzmvtm

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-01-06 15:38:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-06 15:39:22

Lyonnais92 · Answer

Bonsoir,

on essaye comme ça :

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Driver::
 wlsqxlzh

File::
 c:\windows\system32\ajjaajj.dll
c:\windows\system32\qjywfcku.dll
C:\WINDOWS\system32\drivers\udeohwfs.dat 
 
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{61039EB5-B0CE-4D79-8E21-7112CCCD943C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper
Objects\{FBB43BE8-D3D1-454B-AAB5-6E09318C80C1}]
 

Enregistre ce fichier sous le nom CFscript

 
* Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe : clique sur CFScript, garde le doigt enfoncé et fais glisser la souris pour que l'icone de CFScript recouvre celle de Conbofix. Relache la souris. Combofix va démarrrer


    * Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    * Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

    * Une fois le scan achevé, un rapport va s'afficher: poste son contenu, en précisant où en sont tes soucis


    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

orb42 · Answer

ComboFix 08-01-04.1 - *** 2008-01-07 19:57:14.7 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.297 [GMT 1:00]
Running from: C:\Documents and Settings\***\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\***\Bureau\CFscript.txt
* Created a new restore point

FILE
c:\windows\system32\ajjaajj.dll
C:\WINDOWS\system32\drivers\udeohwfs.dat
c:\windows\system32\qjywfcku.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions
))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ajjaajj.dll
C:\WINDOWS\system32\drivers\udeohwfs.dat
c:\windows\system32\qjywfcku.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services
)))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_WLSQXLZH
-------\wlsqxlzh

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-07 to 2008-01-07
))))))))))))))))))))))))))))))))))))
.

2008-01-07 17:38 . 2008-01-07 17:38 284 --a------ C:\Documents and
Settings\***\Application Data\ViewerApp.dat
2008-01-06 12:36 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-03 22:28 . 2008-01-03 22:28 <REP> d-------- C:\Program Files\Trend Micro
2008-01-03 20:53 . 2008-01-03 21:20 <REP> d-------- C:\VundoFix Backups
2008-01-01 17:41 . 2008-01-01 17:41 <REP> d-------- C:\Documents and
Settings\***\Application Data\Grisoft
2008-01-01 17:41 . 2008-01-01 17:41 <REP> d-------- C:\Documents and
Settings\All Users\Application Data\Grisoft
2008-01-01 17:41 . 2007-05-30
13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-01 13:07 . 2008-01-01 13:26 <REP> d-------- C:\Program Files\Navilog1
2008-01-01 12:18 . 2008-01-01 12:18 0 --a------ C:\WINDOWS\system32\8104297.jun
2007-12-09 16:14 . 2008-01-01 12:10 1,660 --a------ C:\WINDOWS\system32\tmp.reg

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M
))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 11:40 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-11-29 16:02 --------- d-----w C:\Documents and Settings\***\Application
Data\F-Secure
2007-11-29 15:53 --------- d-----w C:\Documents and Settings\All
Users\Application Data\F-Secure
2007-11-29 15:50 --------- d-----w C:\Documents and Settings\All
Users\Application Data\fssg
.

((((((((((((((((((((((((((((( snapshot@2008-01-06_12.40.45,02
)))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
- 2004-03-08 10:55:50 13,567 ------w C:\WINDOWS\system32\drivers\CDRBSDRV.SYS
+ 2004-03-08 11:55:50 13,567 ------w C:\WINDOWS\system32\drivers\CDRBSDRV.SYS
- 2001-11-05 07:23:14 6,097 ----a-w C:\WINDOWS\system32\drivers\sonyhcb.sys
+ 2001-11-05 08:23:14 6,097 ----a-w C:\WINDOWS\system32\drivers\sonyhcb.sys
- 2001-11-05 07:23:20 38,739 ----a-w C:\WINDOWS\system32\drivers\sonyhcc.sys
+ 2001-11-05 08:23:20 38,739 ----a-w C:\WINDOWS\system32\drivers\sonyhcc.sys
- 2001-07-03 18:39:00 3,654 ----a-w C:\WINDOWS\system32\drivers\Sonyhcp.dll
+ 2001-07-03 19:39:00 3,654 ----a-w C:\WINDOWS\system32\drivers\Sonyhcp.dll
- 2001-11-05 07:23:52 299,923 ----a-w C:\WINDOWS\system32\drivers\sonyhcs.sys
+ 2001-11-05 08:23:52 299,923 ----a-w C:\WINDOWS\system32\drivers\sonyhcs.sys
- 2002-10-15 20:41:06 102,220 ----a-w C:\WINDOWS\system32\drivers\sonypvs1.sys
+ 2002-10-15 21:41:06 102,220 ----a-w C:\WINDOWS\system32\drivers\sonypvs1.sys
- 2001-03-24 00:15:56 25,600 ------w C:\WINDOWS\system32\lfavi12n.dll
+ 2001-03-24 01:15:56 25,600 ------w C:\WINDOWS\system32\lfavi12n.dll
- 2001-03-24 00:22:10 314,880 ------w C:\WINDOWS\system32\LFCMP12n.DLL
+ 2001-03-24 01:22:10 314,880 ------w C:\WINDOWS\system32\LFCMP12n.DLL
- 2001-03-24 00:15:48 78,336 ------w C:\WINDOWS\system32\LFFAX12n.DLL
+ 2001-03-24 01:15:48 78,336 ------w C:\WINDOWS\system32\LFFAX12n.DLL
- 2001-03-24 00:17:32 43,008 ------w C:\WINDOWS\system32\lfgif12n.dll
+ 2001-03-24 01:17:32 43,008 ------w C:\WINDOWS\system32\lfgif12n.dll
- 2001-03-24 00:18:30 121,856 ------w C:\WINDOWS\system32\lfmpg12n.dll
+ 2001-03-24 01:18:30 121,856 ------w C:\WINDOWS\system32\lfmpg12n.dll
- 2001-03-24 00:19:22 155,648 ------w C:\WINDOWS\system32\LFTIF12n.DLL
+ 2001-03-24 01:19:22 155,648 ------w C:\WINDOWS\system32\LFTIF12n.DLL
- 2001-03-24 00:13:20 278,528 ------w C:\WINDOWS\system32\LTDIS12n.DLL
+ 2001-03-24 01:13:20 278,528 ------w C:\WINDOWS\system32\LTDIS12n.DLL
- 2001-03-20 19:54:40 227,840 ------w C:\WINDOWS\system32\LTEFX12n.DLL
+ 2001-03-20 20:54:40 227,840 ------w C:\WINDOWS\system32\LTEFX12n.DLL
- 2001-03-24 00:13:36 122,368 ------w C:\WINDOWS\system32\LTFIL12n.DLL
+ 2001-03-24 01:13:36 122,368 ------w C:\WINDOWS\system32\LTFIL12n.DLL
- 2001-03-24 00:14:12 166,400 ------w C:\WINDOWS\system32\LTIMG12n.DLL
+ 2001-03-24 01:14:12 166,400 ------w C:\WINDOWS\system32\LTIMG12n.DLL
- 2001-03-24 00:13:14 406,528 ------w C:\WINDOWS\system32\LTKRN12n.DLL
+ 2001-03-24 01:13:14 406,528 ------w C:\WINDOWS\system32\LTKRN12n.DLL
- 2001-03-20 19:55:00 41,472 ------w C:\WINDOWS\system32\LTTWN12n.DLL
+ 2001-03-20 20:55:00 41,472 ------w C:\WINDOWS\system32\LTTWN12n.DLL
- 2001-03-24 00:21:18 854,528 ------w C:\WINDOWS\system32\Ltwvc12n.dll
+ 2001-03-24 01:21:18 854,528 ------w C:\WINDOWS\system32\Ltwvc12n.dll
- 2001-07-03 18:33:00 53,248 ----a-w C:\WINDOWS\system32\SONYHCY.DLL
+ 2001-07-03 19:33:00 53,248 ----a-w C:\WINDOWS\system32\SONYHCY.DLL
- 1998-06-17 22:00:00 89,360 ----a-w C:\WINDOWS\system32\VB5DB.DLL
+ 1998-06-17 23:00:00 89,360 ----a-w C:\WINDOWS\system32\VB5DB.DLL
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg
)))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdslTaskBar"="stmctrl.dll" [2003-09-19 12:24 151552
C:\WINDOWS\system32\stmctrl.dll]
"F-Secure Manager"="D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\Common\FSM32.exe" [2007-05-25 14:12 183208]
"F-Secure TNB"="D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FSGUI\TNBUtil.exe" [2007-05-25 14:11 740208]
"SpywareTerminator"="C:\Program Files\Spyware
Terminator\SpywareTerminatorShield.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoSetActiveDesktop"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoStartMenuNetworkPlaces"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoUserNameInStartMenu"= 1 (0x1)
"MaxRecentDocs"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoNetworkConnections"= 1 (0x1)
"NoBandCustomize"= 0 (0x0)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoSetActiveDesktop"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoStartMenuNetworkPlaces"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoUserNameInStartMenu"= 1 (0x1)
"MaxRecentDocs"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 1 (0x1)
"NoNetworkConnections"= 1 (0x1)
"NoToolbarCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Picture Package Menu.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Picture Package Menu.lnk
backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Picture Package VCD Maker.lnk]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Picture Package VCD Maker.lnk
backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu
Démarrer^Programmes^Démarrage^Update_0707_KB77012.exe]
path=C:\Documents and Settings\All Users\Menu
Démarrer\Programmes\Démarrage\Update_0707_KB77012.exe
backup=C:\WINDOWS\pss\Update_0707_KB77012.exeCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LogitechGalleryRepair]
2002-06-20 12:26 155648 --a------ C:\Program
Files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LogitechImageStudioTray]
2002-06-20 12:25 45056 --a------ C:\Program
Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WebCamRT.exe"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DiskeeperSystray"="F:\OUTILS\Diskeeper.Pro Premier.10\DkIcon.exe"
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
"HPHmon03"=C:\WINDOWS\system32\hphmon03.exe
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
"<NO NAME>"=
"LVCOMS"=C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys
[2007-05-25 14:09]
R1 F-Secure HIPS;F-Secure HIPS;D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\HIPS\fshs.sys [2007-05-25 14:12]
R3 Dot4Usb HPH09;Dot4Usb HPH09;C:\WINDOWS\system32\drivers\hphius09.sys
[2003-01-30 18:55]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\SECURITE\F-SECURE IS 2008\F-Secure
Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 14:08]
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-09-19
12:24]
R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys
[2003-09-19 12:24]
S3 AVR309Prj;AVR309:USB to UART device
driver;C:\WINDOWS\system32\Drivers\AVR309.sys [2007-02-08 15:16]
S3 PhilCam8116;Logitech QuickCam Pro
3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2002-06-10 14:16]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys
[2002-10-15 22:41]
S3 USBSHGX;SHARP GSM GPRS USB Driver
2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys [2004-09-06 23:32]
S4 F-Secure Filter;F-Secure File System Filter;D:\SECURITE\F-SECURE IS
2008\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 14:09]
S4 F-Secure Recognizer;F-Secure File System Recognizer;D:\SECURITE\F-SECURE IS
2008\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 14:09]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost -
NetSvcs
cibzmvtm

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-01-07 20:03:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-07 20:05:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-07 19:04:58
ComboFix2.txt 2008-01-06 14:39:23

Lyonnais92 · Answer

Bonsoir,

on l'a eu.

Remets un rapport hijackthis.
 
jorginho, tu peux terminer ? Merci.

jorginho67 · Answer

salut vous deux !

reste quand même dans le coin !  ;-)   Merci encore !

orb42 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:07:28, on 07/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\SECURITE\a-squared Free\a2service.exe
D:\SECURITE\AVG Anti-Spyware 7.5.1.43\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\dllhost.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMA32.EXE
C:\WINDOWS\system32\svchost.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMB32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FCH32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FAMEH32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsqh.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\WINDOWS\system32\rundll32.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSM32.EXE
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fssm32.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package
Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package
Applications\Residence.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSGUI\fsguidll.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsus.exe
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [F-Secure Manager] "D:\SECURITE\F-SECURE IS 2008\F-Secure
Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware
Terminator\SpywareTerminatorShield.exe"
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony
Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony
Corporation\Picture Package\Picture Package Applications\Residence.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH -
D:\SECURITE\a-squared Free\a2service.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\SECURITE\AVG
Anti-Spyware 7.5.1.43\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Unknown owner - F:\OUTILS\Diskeeper.Pro
Premier.10\DkService.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure
Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation -
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure
Corporation - D:\SECURITE\F-SECURE IS 2008\F-Secure Internet
Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation -
D:\SECURITE\F-SECURE IS 2008\F-Secure Internet Security\Common\FSMA32.EXE



Un grand merçi à tous les deux pour votre aide et votre patience!
 Maintenant c'est bon, je saurais supprimer Search-daily s'il se repointe!
@+

jorginho67 · Answer

en attendant que je regarde un peu de plus pres le log :

juste une précision :
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

Cette section correspond à une interdiction par l'administrateur de l'accès à la modification des options ou de la page d'accueil dans Internet Explorer en modifiant certains paramètres dans le Registre.
Ces options ne devraient apparaître que si votre administrateur les a délibérément paramétrées

Est ce le cas ?

La version IE n'est pas à jour
fais le en cliquant sur le lient suivant

https://support.microsoft.com/fr-fr/allproducts

La console Java n'est pas à jour:
Cliques sur ce lien :
https://www.java.com/fr/download/manual.jsp

Choisis la première ligne de téléchargement puis installe java.

En fin d'installation, revient sur la page pour vérifier ton installation.

Quand l'installation a réussi, ouvre le panneau de configuration >
Ajout/suppression de programmes et supprimes les anciennes versions (de java) afin d’éliminer les failles de sécurité présentes dans ces anciennes versions.
Fais cela pour chacune d'elle, une a une, fais redémarrer ton PC quand cela te le sera demandé . 

Tu gardes la Java\jre1.6.0_03 !


un conseil :

Essaye le navigateur Firefox plus sur/sécurisé qu IE 
Firefox n'utilise pas le dangereux protocole ActiveX
- Téléchargement: http://www.mozilla-europe.org/fr/products/firefox/
- Tutorial pour le sécuriser: https://forum.zebulon.fr/topic/69628-s%C3%A9curiser-un-peu-plus-firefox/


Vérifie tes mises a jours des différents softs régulièrement ici https://www.flexera.com/products/operations/software-vulnerability-management.html
Tuto https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/


@ SUIVRE.........

jorginho67 · Answer

RE !
dès que tu auras fait les MàJ, clic droit sur l'icone HJT, et renomme le en CCM.exe ( par exemple ) et reposte un log stp ! 
il y à une chos que j'aimerais vérifier !

j'aurais aussi quelques petits conseils à te donner à la fin !

@ suivre...........

Search-daily

38 réponses

Discussions similaires

Newsletters