Des Virus partout help!
Bonjour,
j'ai des virus qui traine, avec des pseudos antivirus qui se sont installes tous seuls, ma connection a internet est limite et des pages apparaissent tous le tps, j ai bien essaye avec agv ms il n a pas resolu tous les pb.
voici le hitrackthis de mon ordi
Merci pour votre aide!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:03 AM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\spools.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: <html>
O1 - Hosts: <frameset rows="60%,40%">
O1 - Hosts: <frame src="http://www.crous-poitiers.fr/portail.html" name="up" marginwidth="0" marginheight="0" scrolling="auto" border="0" frameborder="0">
O1 - Hosts: <frame src="frame_login.cgi" name="down" noresize marginwidth="0" marginheight="0" scrolling="auto" border="0" frameborder="0">
O1 - Hosts: </frameset>
O1 - Hosts: </html>
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll
O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O21 - SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC} - C:\WINDOWS\vltdfabw.dll
O21 - SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22} - C:\WINDOWS\vregfwlx.dll
O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
--
End of file - 5816 bytes
j'ai des virus qui traine, avec des pseudos antivirus qui se sont installes tous seuls, ma connection a internet est limite et des pages apparaissent tous le tps, j ai bien essaye avec agv ms il n a pas resolu tous les pb.
voici le hitrackthis de mon ordi
Merci pour votre aide!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:03 AM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\spools.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: <html>
O1 - Hosts: <frameset rows="60%,40%">
O1 - Hosts: <frame src="http://www.crous-poitiers.fr/portail.html" name="up" marginwidth="0" marginheight="0" scrolling="auto" border="0" frameborder="0">
O1 - Hosts: <frame src="frame_login.cgi" name="down" noresize marginwidth="0" marginheight="0" scrolling="auto" border="0" frameborder="0">
O1 - Hosts: </frameset>
O1 - Hosts: </html>
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll
O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\lqqylmhp.dll",b
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [herjek] C:\WINDOWS\herjek.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [InstallProgram] C:\WINDOWS\TEMP\setup_526_1_.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8B164B6-5163-4097-BF7E-CA71B39D87EB}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{B64D7F17-9FB9-4695-8A6C-729BEA115344}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2779F00-B031-49BD-9BB0-21565CFF5650}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\..\{124642DA-A703-4BB6-BF6E-ECD92D71C032}: NameServer = 85.255.113.75,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.75 85.255.112.40
O21 - SSODL: vltdfabw - {22FAFC9F-AD7F-41A5-B316-427F3A3EE8BC} - C:\WINDOWS\vltdfabw.dll
O21 - SSODL: vregfwlx - {F5A9041B-5E1A-44A9-8471-527D81466F22} - C:\WINDOWS\vregfwlx.dll
O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\wwww\ie_updates3r.exe (file missing)
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe
--
End of file - 5816 bytes
Configuration: Windows XP Internet Explorer 6.0
34 réponses
Résumé de la discussion
Plusieurs virus et des pseudos antivirus s'installent automatiquement sous Windows XP, la connexion est ralentie et des pages s'affichent en continu, malgré un scan avec AVG Anti-Spyware. Plusieurs conseils clés recommandent d'installer un antivirus fiable et d'utiliser FixWareout pour éliminer les éléments persistants, puis de redémarrer et d'analyser un nouveau rapport HijackThis. Des étapes détaillées impliquent de télécharger FixWareout depuis une source fiable, lancer le fix en mode approprié puis redémarrer, afin d'obtenir un rapport mis à jour et de réexécuter HijackThis pour vérification. En complément, il peut être utile de restaurer les paramètres d'hôtes et de supprimer les entrées suspectes, tout en surveillant les services Windows et les programmes au démarrage pour éviter les réinfections.
-
OuiI en réinstallant windows oui
y a une autre solution moins honéreuse
il faudrais que tu regarde sous le pc si c est un portable ou sur la tour si c est un pc bureau si tu as la licence et si tu il y a marqué le version windows -
on le répete pourtant assez:
sauvegarde systeme d'exploitation si livré préinstallé et pas de cd
sauvegarde des documents et fichiers personnels -
as tu le cd windows ??
-
attend cyril a mis le doight sur quelque chose qui m a échapé ....
-
maintenat que le pc es clean tu peux faire une restauration a une date antérieures a ces soucis
-
Salut,
j'ai effectue ce que tu m as dit mais j ai toujours pas toutes les options du menu demarrer ex. programmes, panneau de configuration.
j ai le fond d ecran tout blanc et qd je click droit y a rien qui se deroule...... -
OK
bon courage pour le taf !
-
Salut,
je suis au bureau mais je fais tout ça ce soir!
A bientôt -
telecharge et instal ANTIVIR :
https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/13198.html
et met le a jours
ta version de internet explorer n est pas a jours telecharge et instal cette version :
--https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html
et redémarre le pc :
ensuite :
telecharge zeb retore :
http://telechargement.zebulon.fr/zeb-restore.html
dezippe le
fais un clic sur zeb retore (la roue dentelé)
coches les cases une a une notamment celle du bureau
et clic sur restaurer
recommnence pour le reste (ce qui ne vas pas )
ensuite redémarre le pc (en mode normal
refais nous un rapport hijackthis en mode normal si possible
A découvrir : Estopa, Rosario Flores, La oreja de van gogh.. Bonne écoute -
voila les rapports AVG et hijackthis, j ai un souci en mode normal c est que dans le menu demarrer y a plein de fonctionnalites qui ont disparu dont le menu program... je l ai quand meme fait en mode sans echec....
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:18:58 AM, on 6/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
-
Contributeur sécuritére
peut tu ensuite remettre un hijackthis en mode normal
a++ -
Télecharge et instal AVG anti spyware:
http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware
instal le et met le a jours
ensuite lance le scan et supprime
puis poste le rapport sur le forum stp
ensuite :
telecharge Ccleaner :
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
instal le sans la barre yahoo
fais lancer le nettoyage
repete l opération jusqu a ce qu il trouve rien
ensuite fais registre
fais chercher les erreures
ensuite fais corriger les erreures
repete l opération jusqu a ce qu il trouve rien
ensuite :
Telecharge reg cleaner pour nettoyer le registre:
http://manuelsdaide.com/RegCleaner/RegCleaner.htm
________________
ouvre le et clic sur TOOL
Choisi registry cleanup
clic sur automatic registry cleaner
laisse scanner et supprime tout -
réouvre hijackthis
fais scan only
coche ces lignes :
O2 - BHO: (no name) - {2F06C515-7084-4700-B436-AFBF63A3C519} - C:\WINDOWS\system32\shellstyl.dll
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'Default user')
tu les coches et tu clic sur fix checked
ensuite :
télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.
C:\WINDOWS\system32\shellstyl.dll
C:\WINDOWS\system32\kdrhk.exe
C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll
C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
-
voici le rapport
File/Folder C:\WINDOWS\system32\shellstyl.dll not found.
File/Folder C:\WINDOWS\system32\kdrhk.exe not found.
File/Folder C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll not found.
File/Folder C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll not found.
File/Folder not found.
OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06022008_051834
-
-
Copie le texte ci-dessous :
File::
C:\WINDOWS\emop.exe
C:\WINDOWS\system32\iodrfeup.tmp
C:\WINDOWS\system32\sex3.ico.tmp
C:\WINDOWS\system32\winsrc.dll.tmp
C:\WINDOWS\system32\sex2.ico.tmp
C:\WINDOWS\system32\sex1.ico.tmp
C:\WINDOWS\system32\sex3.ico
C:\bxqhsfpe.exe
C:\WINDOWS\system32\umovsb.tmp
C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll
Folder::
C:\fixwareout
C:\upload_moi_PC.tar.gz
C:\FOUND.001
C:\FOUND.000
Driver::
ksnhtr
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
[-HKEY_CLASSES_ROOT\clsid\{6813e51a-d108-4693-972a-0490411c4878}]
[-HKEY_CLASSES_ROOT\atfxqogp.1]
[-HKEY_CLASSES_ROOT\TypeLib\{DC225FE6-B048-46B4-8AEE-D720C14B6F66}]
[-HKEY_CLASSES_ROOT\atfxqogp]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus-3444"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus"=-
Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.
-
ComboFix 08-05-29.1 - Administrator 2008-06-02 3:32:55.3 - [color=red][b]FAT32[/b][/color]x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.37 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt..txt
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE ::
C:\bxqhsfpe.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll
C:\WINDOWS\emop.exe
C:\WINDOWS\system32\iodrfeup.tmp
C:\WINDOWS\system32\sex1.ico.tmp
C:\WINDOWS\system32\sex2.ico.tmp
C:\WINDOWS\system32\sex3.ico
C:\WINDOWS\system32\sex3.ico.tmp
C:\WINDOWS\system32\umovsb.tmp
C:\WINDOWS\system32\winsrc.dll.tmp
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\bxqhsfpe.exe
C:\fixwareout
C:\fixwareout\dnsbak.reg
C:\fixwareout\FindT\clsid.bak
C:\fixwareout\FindT\dumphive.exe
C:\fixwareout\FindT\FixWareOut.reg
C:\fixwareout\FindT\nircmd.exe
C:\fixwareout\FindT\patterns.txt
C:\fixwareout\FindT\rbot.bat
C:\fixwareout\FindT\RestartIt.exe
C:\fixwareout\FindT\runback.txt
C:\fixwareout\FindT\runs.vbs
C:\fixwareout\FindT\swreg.exe
C:\fixwareout\FindT\vfind.exe
C:\fixwareout\FindT\XP-2K2.cmd
C:\fixwareout\FixIt.BAT
C:\fixwareout\report.txt
C:\FOUND.000
C:\FOUND.000\FILE0000.CHK
C:\FOUND.000\FILE0001.CHK
C:\FOUND.000\FILE0002.CHK
C:\FOUND.000\FILE0003.CHK
C:\FOUND.000\FILE0005.CHK
C:\FOUND.000\FILE0006.CHK
C:\FOUND.000\FILE0007.CHK
C:\FOUND.000\FILE0008.CHK
C:\FOUND.000\FILE0011.CHK
C:\FOUND.000\FILE0012.CHK
C:\FOUND.000\FILE0013.CHK
C:\FOUND.000\FILE0017.CHK
C:\FOUND.000\FILE0018.CHK
C:\FOUND.000\FILE0019.CHK
C:\FOUND.000\FILE0020.CHK
C:\FOUND.000\FILE0021.CHK
C:\FOUND.000\FILE0022.CHK
C:\FOUND.000\FILE0023.CHK
C:\FOUND.000\FILE0024.CHK
C:\FOUND.000\FILE0025.CHK
C:\FOUND.000\FILE0026.CHK
C:\FOUND.000\FILE0027.CHK
C:\FOUND.000\FILE0028.CHK
C:\FOUND.000\FILE0029.CHK
C:\FOUND.000\FILE0030.CHK
C:\FOUND.000\FILE0031.CHK
C:\FOUND.000\FILE0032.CHK
C:\FOUND.000\FILE0034.CHK
C:\FOUND.000\FILE0035.CHK
C:\FOUND.000\FILE0036.CHK
C:\FOUND.000\FILE0037.CHK
C:\FOUND.000\FILE0039.CHK
C:\FOUND.000\FILE0040.CHK
C:\FOUND.000\FILE0041.CHK
C:\FOUND.000\FILE0042.CHK
C:\FOUND.000\FILE0043.CHK
C:\FOUND.000\FILE0045.CHK
C:\FOUND.000\FILE0048.CHK
C:\FOUND.001
C:\FOUND.001\FILE0000.CHK
C:\FOUND.001\FILE0001.CHK
C:\upload_moi_PC.tar.gz\
C:\WINDOWS\emop.exe
C:\WINDOWS\system32\iodrfeup.tmp
C:\WINDOWS\system32\sex1.ico.tmp
C:\WINDOWS\system32\sex2.ico.tmp
C:\WINDOWS\system32\sex3.ico
C:\WINDOWS\system32\sex3.ico.tmp
C:\WINDOWS\system32\umovsb.tmp
C:\WINDOWS\system32\winsrc.dll.tmp
.
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.
2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
.
((((((((((((((((((((((((((((( snapshot@2008-06-01_21.35.28.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-02 04:34:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 10:02:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F06C515-7084-4700-B436-AFBF63A3C519}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableCMD"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 03:34:45
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
.
Completion time: 2008-06-02 3:35:16
ComboFix-quarantined-files.txt 2008-06-02 10:35:14
ComboFix3.txt 2008-06-02 04:35:54
ComboFix2.txt 2008-06-02 10:00:56
Pre-Run: 5,652,209,664 bytes free
Post-Run: 5,645,737,984 bytes free
172
hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:12 AM, on 6/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {2F06C515-7084-4700-B436-AFBF63A3C519} - C:\WINDOWS\system32\shellstyl.dll
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
-
-
re
fais ce qui est expliqué par balltrap post 27 stp
-
ComboFix 08-05-29.1 - Administrator 2008-06-02 2:58:57.2 - [color=red][b]FAT32[/b][/color]x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.68 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\wwww\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk
.
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.
2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
.
((((((((((((((((((((((((((((( snapshot@2008-06-01_21.35.28.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-02 04:34:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 09:35:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F06C515-7084-4700-B436-AFBF63A3C519}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableCMD"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 03:00:25
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
.
Completion time: 2008-06-02 3:00:54
ComboFix-quarantined-files.txt 2008-06-02 10:00:54
ComboFix2.txt 2008-06-02 04:35:54
Pre-Run: 5,652,193,280 bytes free
Post-Run: 5,648,465,920 bytes free
105
-
-
Contributeur sécuritésalut
atention se qui suit est exclusivement reserver a cette ordinateur il ne faut absolument pas l utyiliser pour un autre sous peine de planter le pc
normalement tu as deja telecharger combofix et il doit etre sur ton bureau
ouvre le bloc note et colle ce qui est en gras ci dessous
Files::
C:\WINDOWS\system32\kdrhk.exe
C:\WINDOWS\system32\shellstyl.dll
C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe
C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll
C:\WINDOWS\boqnrwdmqed.dll
C:\WINDOWS\system32\umovsb.tmp
C:\bxqhsfpe.exe
C:\WINDOWS\system32\sex3.ico
C:\WINDOWS\system32\sex2.ico.tmp
C:\WINDOWS\system32\sex1.ico.tmp
C:\WINDOWS\system32\winsrc.dll.tmp
C:\WINDOWS\system32\sex3.ico.tmp
C:\WINDOWS\system32\iodrfeup.tmp
C:\WINDOWS\emop.exe
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
[-HKEY_CLASSES_ROOT\CLSID\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
[-HKEY_CLASSES_ROOT\CLSID\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
[-HKEY_CLASSES_ROOT\CLSID\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
[-HKEY_CLASSES_ROOT\clsid\{6813e51a-d108-4693-972a-0490411c4878}]
[-HKEY_CLASSES_ROOT\atfxqogp.1]
[-HKEY_CLASSES_ROOT\TypeLib\{DC225FE6-B048-46B4-8AEE-D720C14B6F66}]
[-HKEY_CLASSES_ROOT\atfxqogp]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus-3444"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus"=-
enregistre le et donne lui comme nom CFScript.txt
[list]Fais un glisser/déposer de ce fichier [b]CFScript/b sur le fichier ComboFix.exe comme sur la capture
[img]http://img.photobucket.com/albums/v666/sUBs/CFScript.gif/img[list]
[*]Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) ,[b] tape 1/b puis valide.
[*]Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
[*]Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
[*]Si le fichier ne s'ouvre pas, il se trouve ici > C:\[b]ComboFix.txt/b/list-
ComboFix 08-05-29.1 - Administrator 2008-06-02 2:58:57.2 - [color=red][b]FAT32[/b][/color]x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.68 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\wwww\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk
.
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.
2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
.
((((((((((((((((((((((((((((( snapshot@2008-06-01_21.35.28.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-02 04:34:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 09:35:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F06C515-7084-4700-B436-AFBF63A3C519}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableCMD"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 03:00:25
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
.
Completion time: 2008-06-02 3:00:54
ComboFix-quarantined-files.txt 2008-06-02 10:00:54
ComboFix2.txt 2008-06-02 04:35:54
Pre-Run: 5,652,193,280 bytes free
Post-Run: 5,648,465,920 bytes free
105
-
-
Rends toi sur ce site :
https://www.virustotal.com/gui/
Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\kdrhk.exe
Clique sur Send File.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Sauvegarde le rapport avec le bloc-note.
Copie le dans ta réponse.
fais de meme pour ce fichier : C:\WINDOWS\system32\shellstyl.dll
-
voici le rapport pour shellstl.dll
par contre je trouve pas l autre fichier
File shellstyl.dll received on 06.01.2008 19:48:49 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 12/31 (38.71%)
Loading server information...
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
AhnLab-V3 2008.5.30.1 2008.05.30 -
AntiVir 7.8.0.26 2008.06.01 TR/ATRAPS.Gen
Authentium 5.1.0.4 2008.06.01 -
Avast 4.8.1195.0 2008.05.31 -
AVG 7.5.0.516 2008.05.31 Downloader.Delf.12.AN
BitDefender 7.2 2008.06.01 Trojan.Spy.BZub.NHY
CAT-QuickHeal 9.50 2008.05.31 -
ClamAV 0.92.1 2008.06.01 -
DrWeb 4.44.0.09170 2008.06.01 Trojan.DownLoader.56883
eSafe 7.0.15.0 2008.06.01 -
eTrust-Vet 31.4.5837 2008.05.30 Win32/Kvol!generic
Ewido 4.0 2008.06.01 -
F-Prot 4.4.4.56 2008.06.01 -
F-Secure 6.70.13260.0 2008.06.01 -
Fortinet 3.14.0.0 2008.06.01 -
GData 2.0.7306.1023 2008.06.01 -
Ikarus T3.1.1.26.0 2008.06.01 Virus.Trojan.Win32.Pakes.cdw
Kaspersky 7.0.0.125 2008.06.01 -
McAfee 5307 2008.05.30 -
Microsoft 1.3520 2008.06.01 Trojan:Win32/Boaxxe.B
NOD32v2 3150 2008.06.01 a variant of Win32/Agent.NSG
Norman 5.80.02 2008.05.30 -
Panda 9.0.0.4 2008.06.01 Suspicious file
Prevx1 V2 2008.06.01 Fraudulent Security Program
Rising 20.46.62.00 2008.06.01 Trojan.Clicker.Win32.Delf.mm
Sophos 4.29.0 2008.06.01 -
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.06.01 -
VBA32 3.12.6.6 2008.06.01 -
VirusBuster 4.3.26:9 2008.06.01 -
Webwasher-Gateway 6.6.2 2008.06.01 Trojan.ATRAPS.Gen
Additional information
File size: 88576 bytes
MD5...: 253d9b5924390c53899d125a5f4d79dd
SHA1..: 66fd4c25631f0242a3cfe984630870f2ff0446f8
SHA256: 30eff06bb3100512a8541894cbabce46f4d6af314766fcfbb1b9853101c5f3ae
SHA512: d68dd46b71644d3af48c0e0d1304e6772db77e0d76ee7fd56755480b21cb0515
d120b7ea28d5793faee04bf94018d37f46bd2187bd428c78d0b3cb9ef718861e
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x43a840
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x25000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x26000 0x15000 0x14c00 7.89 feb73d01fe0c2f653bd0f2ad39f81e16
.rsrc 0x3b000 0x1000 0xa00 3.60 f223b7beea8cb0242ef360cdd34bdeaf
( 7 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree
> advapi32.dll: RegCloseKey
> ole32.dll: IsEqualGUID
> oleaut32.dll: LoadTypeLib
> shell32.dll: SHGetMalloc
> user32.dll: SetTimer
> wininet.dll: InternetCrackUrlA
( 5 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, InitEntry0
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=3CA7402B00B974C55AE401D438677E00ECDDE81E
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX
-
-
super
refais un scan hijackthis et post le rapport stp-
here it is
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:45:06 PM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: QXK Olive - {4F7764DC-5B4A-44B9-B629-E889E542C545} - C:\WINDOWS\boqnrwdmqed.dll (file missing)
O2 - BHO: (no name) - {8CA667BF-F25B-40FA-94FF-EE529946A9D1} - C:\WINDOWS\system32\shellstyl.dll
O2 - BHO: (no name) - {C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8} - C:\WINDOWS\system32\shellstyl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll (file missing)
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
-
-
Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
-
voila!
ComboFix 08-05-29.1 - Administrator 2008-06-01 21:28:17.1 - [color=red][b]FAT32[/b][/color]x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.40 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\LocalService\Application Data\sp1
C:\Documents and Settings\LocalService\Application Data\sp1\a.tmp
C:\Documents and Settings\wwww\Start Menu\Programs\Antivirus 2008 PRO
C:\Documents and Settings\wwww\Start Menu\Programs\Antivirus 2008 PRO\antivirus-2008pro.lnk
C:\Program Files\Antivirus 2008 PRO
C:\Program Files\Antivirus 2008 PRO\antivirus-2008pro.exe
C:\Program Files\Antivirus 2008 PRO\vscan.tsi
C:\Program Files\Antivirus 2008 PRO\zlib.dll
C:\smp.bat
C:\WINDOWS\BM4395a7a9.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\atfnecog.exe
C:\WINDOWS\system32\cbHPqBeg.ini
C:\WINDOWS\system32\cbHPqBeg.ini2
C:\WINDOWS\system32\efcCrRhI.dll
C:\WINDOWS\system32\gdeycwil.dll
C:\WINDOWS\system32\geBqPHbc.dll
C:\WINDOWS\system32\hecxqgou.dll
C:\WINDOWS\system32\IhRrCcfe.ini
C:\WINDOWS\system32\IhRrCcfe.ini2
C:\WINDOWS\system32\kjcmgbch.dll
C:\WINDOWS\system32\kksduwmv.dll
C:\WINDOWS\system32\liwcyedg.ini
C:\WINDOWS\system32\nhhwkseq.dll
C:\WINDOWS\system32\opmjllug.dll
C:\WINDOWS\system32\phmlyqql.ini
C:\WINDOWS\system32\qeskwhhn.ini
C:\WINDOWS\system32\qtBIOqru.ini
C:\WINDOWS\system32\qtBIOqru.ini2
C:\WINDOWS\system32\rwihhocq.dll
C:\WINDOWS\system32\sxvntdci.dll
C:\WINDOWS\system32\urqOIBtq.dll
C:\WINDOWS\system32\vmwudskk.ini
C:\WINDOWS\system32\voscenvv.exe
C:\WINDOWS\system32\wvUomNGX.dll
----- BITS: Possible infected sites -----
hxxp://statsboat.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_GOOGLE_ONLINE_SERVICES
-------\Legacy_ICF
-------\Service_ksnhtr
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.
2008-06-01 18:09 . 2008-06-01 18:09 1,020,594 --a------ C:\upload_moi_PC.tar.gz
2008-06-01 11:46 . 2008-06-01 11:46 <DIR> d-------- C:\Program Files\Avira
2008-06-01 11:42 . 2008-06-01 11:43 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-01 06:38 . 2008-06-01 06:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-06-01 06:37 . 2008-06-01 06:38 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-01 06:37 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-01 06:37 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-01 05:35 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-01 05:35 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-01 05:35 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-01 05:35 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-01 05:35 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-01 05:35 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-01 05:35 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-01 05:35 . 2008-06-01 05:44 1,200 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-01 04:45 . 2008-06-01 04:45 <DIR> d-------- C:\fixwareout
2008-06-01 01:19 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-01 01:08 . 2008-06-01 01:08 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-06-01 01:02 . 2008-06-01 01:02 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\Grisoft
2008-06-01 00:59 . 2008-06-01 00:59 <DIR> d-------- C:\Documents and Settings\wwww\Application Data\TmpRecentIcons
2008-05-31 23:15 . 2008-05-31 01:29 94,208 --a------ C:\WINDOWS\emop.exe
2008-05-31 07:11 . 2008-05-31 07:11 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-31 06:49 . 2001-08-23 12:00 88,576 --a------ C:\WINDOWS\system32\shellstyl.dll
2008-05-31 06:18 . 2008-05-31 06:18 <DIR> d--hs---- C:\FOUND.001
2008-05-31 06:17 . 2008-05-31 06:17 29 --a------ C:\WINDOWS\system32\iodrfeup.tmp
2008-05-31 06:07 . 2008-05-31 06:07 0 --a------ C:\WINDOWS\system32\sex3.ico.tmp
2008-05-31 04:57 . 2008-05-31 04:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-31 04:45 . 2008-05-31 04:45 0 --a------ C:\WINDOWS\system32\winsrc.dll.tmp
2008-05-31 04:38 . 2008-05-31 04:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-31 04:30 . 2008-05-31 04:30 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex2.ico.tmp
2008-05-30 14:55 . 2008-05-30 14:55 0 --a------ C:\WINDOWS\system32\sex1.ico.tmp
2008-05-30 14:45 . 2008-05-30 14:45 <DIR> d--hs---- C:\FOUND.000
2008-05-30 08:31 . 2008-05-30 08:31 3,262 --a------ C:\WINDOWS\system32\sex3.ico
2008-05-30 08:26 . 2008-05-30 08:26 5,120 --a------ C:\bxqhsfpe.exe
2008-05-30 08:25 . 2008-05-30 14:46 310 --a------ C:\WINDOWS\system32\umovsb.tmp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 04:44 14,290 ----a-w C:\Program Files\settings.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7764DC-5B4A-44B9-B629-E889E542C545}]
C:\WINDOWS\boqnrwdmqed.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CA667BF-F25B-40FA-94FF-EE529946A9D1}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C636F3A2-DB6F-4C4B-B54A-9FA5DFEA01B8}]
2001-08-23 12:00 88576 --a------ C:\WINDOWS\system32\shellstyl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6813E51A-D108-4693-972A-0490411C4878}"= "C:\WINDOWS\atfxqogp.dll" [ ]
[HKEY_CLASSES_ROOT\clsid\{6813e51a-d108-4693-972a-0490411c4878}]
[HKEY_CLASSES_ROOT\atfxqogp.1]
[HKEY_CLASSES_ROOT\TypeLib\{DC225FE6-B048-46B4-8AEE-D720C14B6F66}]
[HKEY_CLASSES_ROOT\atfxqogp]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus-3444"="C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdrhk.exe"="C:\WINDOWS\system32\kdrhk.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus"="" []
"run"="regsvr32.exe" [2004-08-03 16:56 11776 C:\WINDOWS\system32\regsvr32.exe]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableCMD"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-30 01:06]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-01 21:35:06
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\WINDOWS\\system32\\kdrhk.exe"="C:\\WINDOWS\\system32\\kdrhk.exe"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\comctl32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
.
**************************************************************************
.
Completion time: 2008-06-01 21:35:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-02 04:35:48
Pre-Run: 4,906,164,224 bytes free
Post-Run: 5,652,496,384 bytes free
164
-
-
Salut,
réouvre clean, passe l option 2
et envoi le rapport clean stp + un rapport hijackthis fais apes passage de clean option 2 stp
-
rapport clean
Script executed in Safe Mode
Rapport clean par Malekal_morte - http://www.malekal.com
Script executed in Safe Mode Sun 06/01/2008 a 20:59:00.98
Microsoft Windows XP [Version 5.1.2600]
*** Suppression C:
*** Suppression C:\WINDOWS\
*** Suppression C:\WINDOWS\system32
tentative de suppression de C:\WINDOWS\system32\mcrh.tmp
*** Suppression C:\Program Files
*** Deletion of the registry keys successful..
rapport hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:04:35 PM, on 6/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: atfxqogp - {6813E51A-D108-4693-972A-0490411C4878} - C:\WINDOWS\atfxqogp.dll (file missing)
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdrhk.exe] C:\WINDOWS\system32\kdrhk.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [40a69435] rundll32.exe "C:\WINDOWS\system32\nhhwkseq.dll",b
O4 - HKLM\..\Run: [BM4395a7a9] Rundll32.exe "C:\WINDOWS\system32\rwihhocq.dll",s
O4 - HKCU\..\Run: [Tok-Cirrhatus-3444] "C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe"
O4 - HKUS\S-1-5-18\..\Run: [Tok-Cirrhatus] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [run] regsvr32.exe /s "C:\Documents and Settings\LocalService\Application Data\sp1\luapvs.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Tok-Cirrhatus] (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
-
- 1
- 2
Suivant
