Probleme cheval de troie

Question

Bonjour,

Depuis quelque temps mon antivirus Avira me detecte un cheval de troie nommé TR/Mondera.65536.1
L'antivirus me le signal a chaque ouverture de fichiers ou programmes.
J'ai aussi des spam presque toutes les minutes !

je vous colle un hijackthis, merci pour votre aide.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:49:10, on 12/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: The hdtip - {70EC7CA3-2FFC-4E43-97DE-3C91B2F65D36} - C:\WINDOWS\hdtip.dll (file missing)
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\JEAN\lsass.exe
O4 - HKLM\..\Run: [04e92ee5] rundll32.exe "C:\WINDOWS\system32\soadtqin.dll",b
O4 - HKLM\..\Run: [BM07da1d79] Rundll32.exe "C:\WINDOWS\system32\aoxqaqyn.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieservicegate.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieservicegate.com/redirect.php (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BCDB924D-4A0B-435E-9B58-580F69CE4393}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: asparagine - {65bbf06c-ea06-4818-92a3-f3550d0e1004} - C:\WINDOWS\system32kvdr.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Utilisateur anonyme · Accepted Answer

Re ,

Perte de temps.

virtual.be laisse tomber les scan en ligne et fait ceci   ,

*************************************************************

/!\ Outils très puissant , ne pas reproduire la manip ci-dessous sur son pc sans y avoir été autorisé par une personne compétente /!\


_________________________________________________

1)Désactive ta restauration système
Clic sur « Démarrer »
Clic droit sur « Poste de travail », puis sur « Propriétés »,
Vas sur l’onglet « Restauration système »
Tu y coches la case « Désactiver la restauration »
Termine par [Appliquer] [OK] 

_________________________________________________


2)Télécharge ComboFix ici &#8594; http://download.bleepingcomputer.com/sUBs/ComboFix.exe  

Et enregistre le sur le bureau >>> /!\ IMPORTANT /!\

Regardes ici, si tu souhaites te familiariser avec son utilisation: https://www.google.fr/?gws_rd=ssl

 AVANT d'utiliser ComboFix :
&#8594; Déconnecte ton PC d'Internet et referme les fenêtres de tous les programmes en cours.   /!\
&#8594; Désactive provisoirement (et seulement le temps de l'utilisation de ComboFix), la protection en temps réel de ton Antivirus et de tes Antispywares et de TOUT tes logiciels de protection !!!, (activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil). /!\

3)Sur ton bureau double clic sur Combofix.exe.
Appuies sur la touche 1, pour que le programme commence à s'exécuter et suis les instructions à l'écran.

/!\ PENDANT TOUTE la durée (ça peut être assez long si le pc est très infecté) du scan de ComboFix, n'ouvres aucun programme, ne touche pas à ta souris et ne surfe pas sur le net /!\

Soit patient (même si tu penses que le PC est arrêté) ; les temps « d'arrêt apparent » sont parfois de plusieurs minutes (il y a ± 40 étapes d’analyse).

En cours de nettoyage il est possible, que tu reçoives un avertissement te disant que le pc va redémarrer, laisse le faire.

Après le redemarrage du pc, un rapport s'ouvrira dans le Bloc notes en fin d'analyse, copie et colle tout son contenu dans ton prochain message.

(Le fichier rapport Combofix.txt , est ensuite automatiquement sauvegardé dans C:\Combofix.txt)


_________________________________________________

4)Ensuite réactive ta restauration système
Clic droit sur « Poste de travail », puis sur « Propriétés »,
Vas sur l’onglet « Restauration système »
Tu décoches la case « Désactiver la restauration »
Termine par [Appliquer] [OK] 

_________________________________________________

Tutorial ( aide ): 

http://bibou0007.com/outils-specifiques-f78/tutorial-combofix-t121.htm

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


*************************************************************



A++

Utilisateur anonyme · Answer

Salut fais ceci:

Tu fais un scan en mode sans échec avec AntiVir. Tu lances le scan et si il détecte un virus (normalement oui) tu cliques sur "delete" et "apply sélection to all following détections. (pour qu'il le supprimes automatiquement). A la fin du scan tu cliques sur "Report" puis normalement un bloc-note s'ouvrira tu l'enregistre sur ton bureau avec le titre "Rapport AntiVir"puis  tu redémarre en mode normal puis tu me postes le rapport.

Mode sans Echec: 

Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8] (ou [F5] sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionner "Mode sans échec" et appuie sur [Entrée]
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre.
Regarde ici si besoin : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm

PS: JE TE CONSEILLE D'ENREGISTRER CE MESSAGE DANS TON BUREAU OU CAS OU.

Utilisateur anonyme · Answer

Salut ,

Au passage , infection Vundo.

A++

virtual.be · Answer

rebonjour,

j'ai deja fais une analyse avira en mode normale doij-je quand meme le faire en mode sans echec ?

merci pour l'aide a+

virtual.be · Answer

Voila je viens de faire l'analyse mais au redemarrage il a encore detecter le meme trojan! Avira AntiVir Personal Report file date: vendredi 13 juin 2008 11:39 Scanning for 1328777 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Save mode Username: ****** Computer name: ****** Version information: BUILD.DAT : 8.1.0.308 16478 Bytes 28/05/2008 17:03:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 26/04/2008 15:30:14 AVSCAN.DLL : 8.1.1.0 53505 Bytes 26/04/2008 15:30:14 LUKE.DLL : 8.1.2.9 151809 Bytes 26/04/2008 15:30:23 LUKERES.DLL : 8.1.2.1 12033 Bytes 26/04/2008 15:30:23 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 7/03/2008 15:07:05 ANTIVIR2.VDF : 7.0.4.120 2206720 Bytes 1/06/2008 13:43:29 ANTIVIR3.VDF : 7.0.4.186 347136 Bytes 12/06/2008 17:24:25 Engineversion : 8.1.0.55 AEVDF.DLL : 8.1.0.5 102772 Bytes 26/04/2008 15:30:34 AESCRIPT.DLL : 8.1.0.40 266618 Bytes 12/06/2008 13:43:35 AESCN.DLL : 8.1.0.21 119156 Bytes 12/06/2008 13:43:34 AERDL.DLL : 8.1.0.20 418165 Bytes 26/04/2008 15:30:33 AEPACK.DLL : 8.1.1.5 364918 Bytes 16/05/2008 06:31:56 AEOFFICE.DLL : 8.1.0.18 192890 Bytes 26/04/2008 15:30:32 AEHEUR.DLL : 8.1.0.30 1253750 Bytes 12/06/2008 13:43:34 AEHELP.DLL : 8.1.0.15 115063 Bytes 30/05/2008 14:42:03 AEGEN.DLL : 8.1.0.28 307572 Bytes 12/06/2008 13:43:32 AEEMU.DLL : 8.1.0.6 430451 Bytes 16/05/2008 06:31:49 AECORE.DLL : 8.1.0.31 168310 Bytes 12/06/2008 13:43:31 AVWINLL.DLL : 1.0.0.7 14593 Bytes 26/04/2008 15:30:14 AVPREF.DLL : 8.0.0.1 25857 Bytes 26/04/2008 15:30:13 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24 AVREG.DLL : 8.0.0.0 30977 Bytes 26/04/2008 15:30:13 AVARKT.DLL : 1.0.0.23 307457 Bytes 26/04/2008 15:30:11 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 26/04/2008 15:30:12 SQLITE3.DLL : 3.3.17.1 339968 Bytes 26/04/2008 15:30:26 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 26/04/2008 15:30:25 NETNT.DLL : 8.0.0.1 7937 Bytes 26/04/2008 15:30:24 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 26/04/2008 15:29:56 RCTEXT.DLL : 8.0.32.0 86273 Bytes 26/04/2008 15:29:57 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, E:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: vendredi 13 juin 2008 11:39 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'aawservice.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 12 processes with 12 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD2 [INFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD3 [INFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Master boot sector HD4 [INFO] No virus was found! [WARNING] Le périphérique n'est pas prêt. Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Boot sector 'E:\' [INFO] No virus was found! Starting to scan the registry. C:\WINDOWS\system32\ddcDvSlm.dll [DETECTION] Is the Trojan horse TR/Mondera.65536.1 [WARNING] The file could not be deleted! The registry was scanned ( '38' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\ddcDvSlm.dll [DETECTION] Is the Trojan horse TR/Mondera.65536.1 [WARNING] The file could not be deleted! Begin scan in 'D:\' D:\ff9bc8b8ae950205835e49a0f77603d0\xpsp1hfm.exe [WARNING] The file could not be opened! Begin scan in 'E:\' End of the scan: vendredi 13 juin 2008 13:28 Used time: 1:48:54 min The scan has been done completely. 7230 Scanning directories 289094 Files were scanned 2 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 289092 Files not concerned 6958 Archives were scanned 8 Warnings 0 Notes

virtual.be · Answer

voila je vien de le faire, mais avira me detecte encore et toujours le meme trojan a chaque ouverture de prgorammes

je vous colle le rapport

Malwarebytes' Anti-Malware 1.17
Version de la base de données: 854

14:14:50 14/06/2008
mbam-log-6-14-2008 (14-14-44).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 104608
Temps écoulé: 1 hour(s), 14 minute(s), 47 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 48
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 16

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\khfFUOee.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ddcDvSlm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\rkvdr.dll (Trojan.Zlob) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c1c09b2e-7d09-477b-adb4-5d9c9319269b} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c1c09b2e-7d09-477b-adb4-5d9c9319269b} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a1e716c4-d172-4fcb-9c66-21bef1dd2d44} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1e716c4-d172-4fcb-9c66-21bef1dd2d44} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcdvslm (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{65bbf06c-ea06-4818-92a3-f3550d0e1004} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{0be385a3-85a5-4722-b677-68dae891ff21} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{272c0d60-0561-4c83-b3db-eb0a71f9d2eb} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{284477e4-a7cb-4055-9e1b-0ea7cba28945} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{70ca4938-6a0f-4641-a9a9-c936e4c1e7de} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{7468213e-010e-4ec6-a17d-642e909ba7ec} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a916af3c-976d-4358-8736-95bea0b5fd2c} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{b86f4810-19a9-4050-9ac9-b5cf60b5799a} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{bb5b7e14-f8b4-4365-a24d-f4965c33e1ee} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{be45f056-e005-437b-be88-23acf70b0b6a} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{c13d4627-02f5-4b03-897a-bf6a90022dd2} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{c636f1fc-6ae4-4e6a-90ab-6d61d821a0dd} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{cb971ac0-6408-40da-a540-92f9f256f51f} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d5694dfe-43b6-4e05-aa29-8c556c968973} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e2032ec2-a9ac-4ed7-9bdb-ebecacf076f2} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{ebab4a71-8c34-461a-b57d-dd041d439555} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{f06fea43-0cc3-4bf6-a85b-5efb1c07aa4b} (Adware.WhenUSave) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{fc94a0f7-9c7c-4ae2-9106-5c212332b209} (Adware.WhenUSave) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0ac49246-419b-4ee0-8917-8818daad6a4e} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{99410cde-6f16-42ce-9d49-3807f78f0287} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\Software\UpMedia (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\NetProject (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.3.exe 4.3 (Rogue.VirusHeat) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.3 (Rogue.VirusHeat) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RichVideoCodec (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\hdtip.bgkd (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\hdtip.toolbar.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\VAC.Video (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert (Trojan.Zlob) -> No action taken.
HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04e92ee5 (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{a1e716c4-d172-4fcb-9c66-21bef1dd2d44} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{65bbf06c-ea06-4818-92a3-f3550d0e1004} (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\ZangoToolbar 4.8.3 (Adware.Zango) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\khffuoee -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\khffuoee  -> No action taken.

Dossier(s) infecté(s):
C:\Program Files\RichVideoCodec (Trojan.FakeAlert) -> No action taken.
C:\Program Files\NetProject (Trojan.Zlob) -> No action taken.
C:\WINDOWS\system32\UpMedia (Adware.SmartShopper) -> No action taken.
C:\WINDOWS\system32\215651 (Trojan.BHO) -> No action taken.

Fichier(s) infecté(s):
C:\WINDOWS\system32\khfFUOee.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\eeOUFfhk.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\eeOUFfhk.ini2 (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\xqqyflea.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\aelfyqqx.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ddcDvSlm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\rkvdr.dll (Trojan.Zlob) -> No action taken.
C:\System Volume Information\_restore{C9D4939E-1D21-4856-B31C-89202670BFBC}\RP3\A0001122.dll (Trojan.Vundo) -> No action taken.
C:\Program Files\RichVideoCodec\install.ico (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\~.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> No action taken.
C:\WINDOWS\werbetxdp.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\monhop.exe (Trojan.FakeAlert) -> No action taken.
C:\Program Files\Setup.exe (Rogue.Installer) -> No action taken.
C:\Documents and Settings\JEAN\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.3.lnk (Rogue.VirusHeat) -> No action taken.

fiat500 · Answer

bonjour a tous

vire tous se qu'a trouver malwarbytes aide:

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

virtual.be · Answer

Voila et ensuite ?

fiat500 · Answer

reposte un log hijackthis

virtual.be · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:32:42, on 14/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: The hdtip - {70EC7CA3-2FFC-4E43-97DE-3C91B2F65D36} - C:\WINDOWS\hdtip.dll (file missing)
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\JEAN\lsass.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BCDB924D-4A0B-435E-9B58-580F69CE4393}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Utilisateur anonyme · Answer

Ok merci maintenant fais un scan en ligne avec Internet Explorer stp: 

BitDefender en ligne: http://www.bitdefender.fr/scan_fr/scan8/ie.html 
Tutoriel BitDefender en ligne: http://cybersecurite.xooit.com/t201-Scan-en-ligne-BitDefender.htm 

Ps: N'oublies pas de me poster le rapport. Si tu as besoin d'aide aide toi tu tutoriel.

fiat500 · Answer

coche la case:

 	O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\JEAN\lsass.exe

puis clic sur fix cheked

puis :

fais un scan en ligne avec Internet Explorer stp:

BitDefender en ligne: http://www.bitdefender.fr/scan_fr/scan8/ie.html
Tutoriel BitDefender en ligne: http://cybersecurite.xooit.com/t201-Scan-en-ligne-BitDefender.htm

virtual.be · Answer

Voila il en a trouver mais ils n'ont pas été tous supprimé


C:\Documents and Settings\JEAN\Incomplete\T-3545425-i love techno 2008 dj rush.mp3
 Infected with: Trojan.Downloader.WMA.Wimad.N
 
C:\Documents and Settings\JEAN\Incomplete\T-3545425-i love techno 2008 dj rush.mp3
 Deleted
 
C:\Documents and Settings\JEAN\Mes documents\Mes fichiers reçus\03 Track 3 (ricard).wma
 Infected with: Trojan.Downloader.WMA.Wimad.Q
 
C:\Documents and Settings\JEAN\Mes documents\Mes fichiers reçus\03 Track 3 (ricard).wma
 Deleted
 
C:\WINDOWS\system32\ddcDvSlm.dll
 Infected with: MemScan:Trojan.Vundo.ENF
 
C:\WINDOWS\system32\ddcDvSlm.dll
 Disinfection failed
 
C:\WINDOWS\system32\ddcDvSlm.dll
 Delete failed
 
C:\WINDOWS\system32\khfFUOee.dll
 Infected with: Trojan.Vundo.ESY
 
C:\WINDOWS\system32\khfFUOee.dll
 Disinfection failed
 
C:\WINDOWS\system32\khfFUOee.dll
 Delete failed
 
C:\WINDOWS\system32\rkvdr.dll
 Infected with: Trojan.Renos.NBU
 
C:\WINDOWS\system32\rkvdr.dll
 Disinfection failed
 
C:\WINDOWS\system32\rkvdr.dll
 Deleted

virtual.be · Answer

ok merci pour ton aide je ferrais sa demain matin parce que la je n'ai pas le temps 

a demain ;-)

virtual.be · Answer

Bonjour,

apparement j'ai deja combofix puisqu'il me disent que je ne peut pas le renommé.
Le probleme c'est que je ne le trouve pas dans mon disque dur ni sur mon bureau

a+

Utilisateur anonyme · Answer

Salut ,

puisqu'il me disent que je ne peut pas le renommé. 
J'ai demandé de le renommer ?

Explique un peu mieux stp parce que là , je t'avoue je comprend pas ce que tu veux dire :)

A+

virtual.be · Answer

Quand je lance l'installation ils me disent you cannot rename Combofix en combofix[1]

sa veut dire que je l'ai deja installer mais je ne sais pas ou il est

Utilisateur anonyme · Answer

Re ,

On va arranger ça.


&#8594; Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.

&#8594; Double clique sur ToolsCleaner2.exe >
&#8594; Clique sur .Recherche
&#8594; puis sur Suppression quand la liste est trouvée.
&#8594; Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )
 
Note : ton bureau RISQUE de disparaître, c'est normal. S'il n'apparaît pas à la fin du scan, fais la manip suivante :

CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau

Tuto : http://www.commentcamarche.net/faq/sujet 8341 toolscleaner suppression des fix de force brute ( merci espion3004 )


Poste le rapport et réésaye Combofix.
A++

virtual.be · Answer

voila le rapport

je vais réessayer combofix

EDIT: combofix me fais la meme erreur: you cannot rename ...

-->- Recherche: 

C:\Vundofix backups: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\JEAN\Bureau\HijackThis.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\JEAN\Bureau\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Vundofix backups: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

virtual.be · Answer

petit up

Utilisateur anonyme · Answer

Re ,

Boy , t'as pas l'impression d'être à côté de la plaque ?

*********************

Virtual.be , Laisse tomber Combofix et fait ceci :



&#8594; Télécharge sur ton bureau DSS (ex Comboscan) de Deckard:

(choisis enregistrer, puis Bureau comme emplacement)

Ferme toutes les applications en cours.

&#8594; Double-clic sur DSS.exe pour lancer l'outil.

&#8594; Une fenêtre s'ouvre, invitant à fermer toutes les applications, clique sur OK.

&#8594; A la fin de l'analyse, une fenêtre s'ouvre, clique sur OK.

Le rapport main.txt va s'afficher, copie le dans ta prochaine réponse.
Si un rapport complémentaire a été créé, poste le aussi dans ta réponse.


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

A+

virtual.be · Answer

Voila le rapport de main.txt:

Deckard's System Scanner v20071014.68
Run by JEAN on 2008-06-16 07:37:42
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Failed to create restore point; System Restore is disabled (service is not running).


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-16 07:39:20
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\JEAN\Local Settings\Temporary Internet Files\Content.IE5\S56VW9AN\dss[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - (no file)
O2 - BHO: {07c3a95b-6390-5e58-6364-61ca3f5540f0} - {0f0455f3-ac16-4636-85e5-0936b59a3c70} - C:\WINDOWS\system32\smolkdwf.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {A1E716C4-D172-4FCB-9C66-21BEF1DD2D44} - C:\WINDOWS\system32\ddcDvSlm.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: (no name) - {F97B1075-39B7-46AA-8073-74FA82697612} - C:\WINDOWS\system32\khfFUOee.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {70EC7CA3-2FFC-4E43-97DE-3C91B2F65D36} - (no file)
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [04e92ee5] rundll32.exe "C:\WINDOWS\system32\aiksqbcv.dll",b
O4 - HKLM\..\Run: [BM07da1d79] Rundll32.exe "C:\WINDOWS\system32\hwuwpjbo.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32
wprovau.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37899.1981365741
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab Class) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{BCDB924D-4A0B-435E-9B58-580F69CE4393}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O20 - Winlogon Notify: ddcDvSlm - C:\WINDOWS\system32\ddcDvSlm.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\Program Files\Common Files\X10\Common\X10nets.exe

Utilisateur anonyme · Answer

Re ,

alors.

C:\Documents and Settings\JEAN\Local Settings\Temporary Internet Files\Content.IE5\S56VW9AN\dss[1].exe 
Ne télécharge pas DSS dans les fichier temporaires stp ...
tu le changeras de place.

********************************************

/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\


1)Télécharge  OTMoveIt2 ( de Old Timer ) 

2)Une fois téléchargé  double-clique sur OTMoveIt2.exe pour le lancer.

Assure toi que la case Unregister Dll's and Ocx's soit bien cochée

3)puis copie les lignes en gras qui se trouvent en dessous :



C:\WINDOWS\system32\smolkdwf.dll 
C:\WINDOWS\system32\ddcDvSlm.dll 
C:\WINDOWS\system32\khfFUOee.dll 
C:\WINDOWS\system32\aiksqbcv.dll
C:\WINDOWS\system32\hwuwpjbo.dll
C:\WINDOWS\system32\eeOUFfhk.ini2
C:\WINDOWS\system32\wilbirgr.dll
C:\WINDOWS\system32\bsudmsow.dll
C:\WINDOWS\system32\xvdfswxu.dll
C:\WINDOWS\system32\aoxqaqyn.dll 
C:\WINDOWS\system32\oytpucvc.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0f0455f3-ac16-4636-85e5-0936b59a3c70}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1E716C4-D172-4FCB-9C66-21BEF1DD2D44}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F97B1075-39B7-46AA-8073-74FA82697612}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04e92ee5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM07da1d79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{A1E716C4-D172-4FCB-9C66-21BEF1DD2D44}
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ddcDvSlm
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3
C:\Program Files\PartyGaming
C:\Documents and Settings\JEAN\Application Data\Malwarebytes
C:\Documents and Settings\All Users\Application Data\Malwarebytes
C:\Program Files\Malwarebytes' Anti-Malware
Emptytemp





et colle-les dans le cadre de gauche de OTMoveIt :   "Paste List Of Files/Folders to Move."
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
4) Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

5) Il te sera peut-être demander de redémarrer le pc pour achever la suppression -> Accepte ( si il ne fait pas automatiquement , fait-le toi même )

/!\ Note : Au démarrage ton bureau RISQUE de ne plus apparaître , dans ce cas fait --> CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau.


********************************************

ENSUITE , tu va re-télécharger Malware byte's et me refaire une analyse stp .


fiat500 / Boy / regardez un peu mieux :  No action taken. 



********************************************


Virtual.be ,, Suis A LA LETTRE ceci :



&#8594; Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

&#8594; Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau.

&#8594; A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

&#8594; Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

&#8594; Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

&#8594; MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

&#8594; Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

&#8594; MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

&#8594; A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

&#8594; Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine . &#9658;&#9658; FAIT LE

&#8594; MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

&#8594; Ferme MBAM en cliquant sur Quitter.

&#8594; Poste le rapport dans ta réponse


Tutorial : https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm

A+++

virtual.be · Answer

J'ai une question : comment on remet la barre bleu du dessus dans le gestionnaire des taches ? elle a disparue un jour et je ne sais plus la remettre.

j'ai le rapport de OTmoveit2

DllUnregisterServer procedure not found in C:\WINDOWS\system32\smolkdwf.dll
C:\WINDOWS\system32\smolkdwf.dll NOT unregistered.
C:\WINDOWS\system32\smolkdwf.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcDvSlm.dll
C:\WINDOWS\system32\ddcDvSlm.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ddcDvSlm.dll scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\khfFUOee.dll
C:\WINDOWS\system32\khfFUOee.dll NOT unregistered.
C:\WINDOWS\system32\khfFUOee.dll moved successfully.
File/Folder C:\WINDOWS\system32\aiksqbcv.dll not found.
File/Folder C:\WINDOWS\system32\hwuwpjbo.dll not found.
C:\WINDOWS\system32\eeOUFfhk.ini2 moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\wilbirgr.dll
C:\WINDOWS\system32\wilbirgr.dll NOT unregistered.
C:\WINDOWS\system32\wilbirgr.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\bsudmsow.dll
C:\WINDOWS\system32\bsudmsow.dll NOT unregistered.
C:\WINDOWS\system32\bsudmsow.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\xvdfswxu.dll
C:\WINDOWS\system32\xvdfswxu.dll NOT unregistered.
C:\WINDOWS\system32\xvdfswxu.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\aoxqaqyn.dll
C:\WINDOWS\system32\aoxqaqyn.dll NOT unregistered.
C:\WINDOWS\system32\aoxqaqyn.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\oytpucvc.dll
C:\WINDOWS\system32\oytpucvc.dll NOT unregistered.
C:\WINDOWS\system32\oytpucvc.dll moved successfully.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0f0455f3-ac16-4636-85e5-0936b59a3c70} >
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0f0455f3-ac16-4636-85e5-0936b59a3c70} \\ not found.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1E716C4-D172-4FCB-9C66-21BEF1DD2D44} >
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1E716C4-D172-4FCB-9C66-21BEF1DD2D44} \\ not found.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F97B1075-39B7-46AA-8073-74FA82697612} >
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F97B1075-39B7-46AA-8073-74FA82697612} \\ not found.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\04e92ee5 >
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\04e92ee5 not found.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BM07da1d79 >
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BM07da1d79 not found.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{A1E716C4-D172-4FCB-9C66-21BEF1DD2D44} >
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{A1E716C4-D172-4FCB-9C66-21BEF1DD2D44} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1E716C4-D172-4FCB-9C66-21BEF1DD2D44} \ not found.
< HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcDvSlm >
Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcDvSlm \\ not found.
< HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3 >
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3 \\ not found.
C:\Program Files\PartyGaming\tmpUpgrade moved successfully.
C:\Program Files\PartyGaming\PartyPoker\tmpUpgrade moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Temp moved successfully.
C:\Program Files\PartyGaming\PartyPoker\PokerTrainer moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Language\fr_FR\images moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Language\fr_FR\Articles moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Language\fr_FR moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Language\en_US\images moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Language\en_US\articles moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Language\en_US moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Language moved successfully.
C:\Program Files\PartyGaming\PartyPoker\Images moved successfully.
C:\Program Files\PartyGaming\PartyPoker moved successfully.
C:\Program Files\PartyGaming\PartyCasino\Language\en_US\articles moved successfully.
C:\Program Files\PartyGaming\PartyCasino\Language\en_US moved successfully.
C:\Program Files\PartyGaming\PartyCasino\Language moved successfully.
C:\Program Files\PartyGaming\PartyCasino moved successfully.
C:\Program Files\PartyGaming moved successfully.
C:\Documents and Settings\JEAN\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine moved successfully.
C:\Documents and Settings\JEAN\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs moved successfully.
C:\Documents and Settings\JEAN\Application Data\Malwarebytes\Malwarebytes' Anti-Malware moved successfully.
C:\Documents and Settings\JEAN\Application Data\Malwarebytes moved successfully.
C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware moved successfully.
C:\Documents and Settings\All Users\Application Data\Malwarebytes moved successfully.
C:\Program Files\Malwarebytes' Anti-Malware\Languages moved successfully.
C:\Program Files\Malwarebytes' Anti-Malware moved successfully.
< Emptytemp >
Temp folders emptied.
IE temp folders emptied.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06162008_170359

Utilisateur anonyme · Answer

Re ,

Redémarre , et fait MBAM.

J'attends le rapport.


quand a la barre bleue on verra ça a la fin ;))

A++

virtual.be · Answer

Voila le rapport MBAM, il en a supprimé mais au redemarrage Avira antivir m'en a trouver d'autres :s

Malwarebytes' Anti-Malware 1.17
Version de la base de données: 861

19:09:19 16/06/2008
mbam-log-6-16-2008 (19-09-19).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 105788
Temps écoulé: 1 hour(s), 14 minute(s), 58 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 10
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\iifgExxV.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\itpdltrw.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32	wijbwah.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\ddcDvSlm.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{292064dc-1d48-40aa-9ee7-6bc61142d568} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{292064dc-1d48-40aa-9ee7-6bc61142d568} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a1e716c4-d172-4fcb-9c66-21bef1dd2d44} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1e716c4-d172-4fcb-9c66-21bef1dd2d44} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcdvslm (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04e92ee5 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{a1e716c4-d172-4fcb-9c66-21bef1dd2d44} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM07da1d79 (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):

Utilisateur anonyme · Answer

Re ,

Vide la quarantaine de Malwarebyte's Anti-Malware: Clique sur le raccourci de Malwarebytes' Anti-Malware , puis sur Quarantaine, sélectionne les divers éléments en cliquant sur Tout puis clique sur Supprime.

*****************************************

+ nouveau rapport DSS.


A+

virtual.be · Answer

Et voila. Mais cette fois je n'ai pas eu de extra.txt  juste main.txt

Deckard's System Scanner v20071014.68
Run by JEAN on 2008-06-16 19:29:19
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-16 19:29:28
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\JEAN\Bureau\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: {cb23a599-55f4-7e88-5284-0c292e217717} - {717712e2-92c0-4825-88e7-4f55995a32bc} - C:\WINDOWS\system32\mwlyftod.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: (no name) - {F4736DE3-9437-4BA8-BB71-3556E0376022} - C:\WINDOWS\system32\khfFUOee.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {70EC7CA3-2FFC-4E43-97DE-3C91B2F65D36} - (no file)
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32
wprovau.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37899.1981365741
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab Class) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{BCDB924D-4A0B-435E-9B58-580F69CE4393}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\Program Files\Common Files\X10\Common\X10nets.exe

Utilisateur anonyme · Answer

Re ,

Va falloir utiliser Combofix là.

Désactive toute tes protections et coupe l'accès à internet durant le scan.

Et fais ceci :

http://www.commentcamarche.net/forum/affich 6864650 probleme cheval de troie#22




A++

virtual.be · Answer

ComboFix 08-06-15.4 - JEAN 2008-06-16 19:41:14.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.636 [GMT 2:00]
Endroit: C:\Documents and Settings\JEAN\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\JEAN\Application Data\Adssite Advanced Toolbar
C:\Documents and Settings\JEAN\Application Data\Adssite Advanced Toolbar\advertbuttons.xml
C:\Documents and Settings\JEAN\Application Data\Adssite Advanced Toolbar\selected.xml
C:\WINDOWS\BM07da1d79.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\chutgmye.ini
C:\WINDOWS\system32\eeOUFfhk.ini
C:\WINDOWS\system32\eeOUFfhk.ini2
C:\WINDOWS\system32\ehykvtkb.ini
C:\WINDOWS\system32\jyikrahk.ini
C:\WINDOWS\system32\klmhadct.dll
C:\WINDOWS\system32\lsfpfgcj.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\mwlyftod.dll
C:\WINDOWS\system32\mxsbakbx.ini
C:\WINDOWS\system32\niqtdaos.ini
C:\WINDOWS\system32\nyalectu.ini
C:\WINDOWS\system32\qdkcwvwr.ini
C:\WINDOWS\system32\rehyvqet.ini
C:\WINDOWS\system32\rosrkcpe.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-16 to 2008-06-16 ))))))))))))))))))))))))))))))))))))
.

2008-06-16 17:24 . 2008-06-16 17:24 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 17:24 . 2008-06-16 17:24 <REP> d-------- C:\Documents and Settings\JEAN\Application Data\Malwarebytes
2008-06-16 17:24 . 2008-06-16 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-16 17:04 . 2008-06-16 17:04 <REP> d-------- C:\_OTMoveIt
2008-06-16 07:37 . 2008-06-16 07:37 <REP> d-------- C:\Deckard
2008-06-15 10:39 . 2008-06-16 09:35 2,070 ---hs---- C:\WINDOWS\system32\vcbqskia.ini
2008-06-14 11:29 . 2008-06-11 15:00 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-14 11:29 . 2008-06-11 15:00 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-12 19:20 . 2008-06-12 19:20 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-05-28 19:20 . 2008-05-28 19:20 <REP> d-------- C:\Documents and Settings\JEAN\Application Data\Apple Computer
2008-05-24 14:13 . 2008-05-24 14:13 <REP> d-------- C:\Logs
2008-05-21 13:14 . 2008-05-21 13:29 <REP> d-------- C:\Documents and Settings\JEAN\Application Data\Teeworlds
2008-05-17 17:00 . 2006-09-05 19:59 97,088 -ra------ C:\WINDOWS\system32\drivers\se58mdm.sys
2008-05-17 17:00 . 2006-09-05 19:59 9,360 -ra------ C:\WINDOWS\system32\drivers\se58mdfl.sys
2008-05-17 17:00 . 2006-09-05 20:00 6,240 -ra------ C:\WINDOWS\system32\drivers\se58cmnt.sys
2008-05-17 17:00 . 2006-09-05 20:00 6,240 -ra------ C:\WINDOWS\system32\drivers\se58cm.sys
2008-05-17 16:41 . 2008-05-17 16:41 <REP> d-------- C:\Program Files\Disc2Phone
2008-05-17 16:38 . 2008-05-17 16:39 <REP> d-------- C:\Program Files\QuickTime
2008-05-17 16:37 . 2008-05-17 16:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-17 16:36 . 2006-09-05 19:58 61,536 -ra------ C:\WINDOWS\system32\drivers\se58bus.sys
2008-05-17 16:36 . 2006-09-05 19:58 5,872 -ra------ C:\WINDOWS\system32\drivers\se58whnt.sys
2008-05-17 16:36 . 2006-09-05 19:58 5,872 -ra------ C:\WINDOWS\system32\drivers\se58wh.sys
2008-05-17 16:35 . 2008-06-10 19:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-17 16:35 . 2008-05-17 16:36 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-15 13:42 --------- d-----w C:\Program Files\World of Warcraft
2008-06-15 11:45 --------- d-----w C:\Program Files\Trend Micro
2008-06-12 17:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-07 13:36 2,728 ----a-w C:\Documents and Settings\JEAN\Application Data\wklnhst.dat
2008-06-07 13:25 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-04-23 18:40 --------- d-----w C:\Documents and Settings\JEAN\Application Data\ATI
2008-04-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI
2008-04-23 18:33 --------- d-----w C:\Program Files\ATI Technologies
2008-04-23 18:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-23 12:08 --------- d-----w C:\Program Files\Valve
2007-10-30 13:21 67,040 ----a-w C:\Documents and Settings\JEAN\Application Data\GDIPFONTCACHEV1.DAT
2006-12-08 13:08 0 -c--a-w C:\Program Files\Deployment.xml
2006-12-08 13:03 0 -c----w C:\Program Files\WinBootstrapper.msi
2006-12-08 12:58 0 -c--a-w C:\Program Files\WinBootstrapper1.cab
2006-11-27 20:31 49 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb41.dat
2006-11-27 20:31 382 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb1942.dat
2006-11-26 09:23 20,480 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb4827.dat
2006-11-16 06:32 0 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb5436.dat
2006-11-11 19:29 9,216 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb8467.dat
2006-11-11 19:29 0 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb6334.dat
2003-08-14 17:13 40,960 -c--a-w C:\Program Files\Uninstall_PCM.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4736DE3-9437-4BA8-BB71-3556E0376022}]
C:\WINDOWS\system32\khfFUOee.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dit"="Dit.exe" [2002-08-28 13:43 73728 C:\WINDOWS\Dit.exe]
"CHotkey"="mHotkey.exe" [2003-06-27 15:39 506368 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2003-06-27 09:36 5798912 C:\WINDOWS\CNYHKey.exe]
"Cmaudio"="cmicnfg.cpl" [2003-10-14 18:31 2269184 C:\WINDOWS\CMICNFG.CPL]
"PinnacleDriverCheck"="C:\WINDOWS\System32\PSDrvCheck.exe" [2003-05-28 16:37 394240]
"SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2002-11-12 11:02 860672]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-29 00:01 2512128]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-26 17:30 262401]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-17 16:38 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^JEAN^Menu Démarrer^Programmes^Démarrage^Morpheus.lnk]
path=C:\Documents and Settings\JEAN\Menu Démarrer\Programmes\Démarrage\Morpheus.lnk
backup=C:\WINDOWS\pss\Morpheus.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^JEAN^Menu Démarrer^Programmes^Démarrage^Xfire.lnk]
path=C:\Documents and Settings\JEAN\Menu Démarrer\Programmes\Démarrage\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DynDNS Updater]
C:\Program Files\DynDNS Updater\DynDNS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWBMOUSE]
--a------ 2001-03-26 06:35 429568 C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
C:\Program Files\MessengerPlus! 3\MsgPlus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a------ 2003-06-10 18:49 50688 C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
--a--c--- 2003-06-18 12:00 204800 C:\Program Files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-01-19 13:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
--a------ 2003-06-24 15:23 61440 C:\Program Files\Medion Home Cinema XL II\PowerCinema\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-17 16:38 155648 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2006-07-26 04:03 49263 C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weflirt]
--a------ 2007-10-12 17:39 6574080 C:\Program Files\Weflirt\weflirt.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Teamspeak2_RC2\\server_windows.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2VoipServer.exe"=
"C:\\Program Files\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\blatt72\\counter-strike\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\blatt72\\counter-strike source\\hl2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13660:TCP"= 13660:TCP:BitComet 13660 TCP
"13660:UDP"= 13660:UDP:BitComet 13660 UDP
"8332:TCP"= 8332:TCP:BitComet 8332 TCP
"8332:UDP"= 8332:UDP:BitComet 8332 UDP

R2 LogWatch;Event Log Watch;C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe [2002-09-20 16:29]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-06-05 08:04]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-06-12 08:47]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
S3 CA_LIC_CLNT;Client de licence CA;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe [2002-09-20 16:27]
S3 CA_LIC_SRVR;Serveur de licence CA;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [2002-09-20 16:41]
S3 HDJCtrl;Hercules DJ Control MP3 Service;C:\WINDOWS\system32\Drivers\HDJCtrl.sys [2005-07-29 16:06]
S3 HDJMidi;Hercules DJ Console MIDI;C:\WINDOWS\system32\DRIVERS\HDJMidi.sys [2005-08-15 12:43]
S3 PRISM_A00;PRISM 802.11g Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2003-08-07 16:36]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-16 19:49:12
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-16 19:58:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-16 17:58:05

Pre-Run: 32,313,667,584 octets libres
Post-Run: 32,288,198,656 octets libres

196 --- E O F --- 2008-05-17 13:23:31

Utilisateur anonyme · Answer

Re ,

****************************************************

/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\

Ouvre le Bloc-Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)

Copie ce texte ( en gras )d'une traite ( CTRL+C pour copier ) puis colle-le ( CTRL+V dans le bloc-note ) 

File::  
C:\WINDOWS\system32\vcbqskia.ini 

Folder::
C:\_OTMoveIt 

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4736DE3-9437-4BA8-BB71-3556E0376022}] 





Sauvegarde ce fichier sur ton bureau sous le nom de CFScript.txt.



Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport DSS.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

****************************************************


a++

virtual.be · Answer

ComboFix 08-06-15.4 - JEAN 2008-06-17 7:36:44.2 - NTFSx86
Endroit: C:\Documents and Settings\JEAN\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\JEAN\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\WINDOWS\system32\vcbqskia.ini
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\_OTMoveIt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359.log
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359.res
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\news.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Documents and Settings\JEAN\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-6-14-2008 (14-15-09).txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\changes.rtf
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\albanian.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\bulgarian.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\catalan.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\danish.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\dutch.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\english.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\finnish.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\french.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\german.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\hungarian.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\italian.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\norwegian.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\portugueseBR.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\romanian.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\serbian.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\slovak.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\slovenian.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\spanish.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\Languages\swedish.lng
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\license.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\mbam.chm
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\mbam.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\unins000.dat
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\unins000.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\unins000.msg
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\vbalsgrid6.ocx
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\Malwarebytes' Anti-Malware\zlib.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\announce.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\INSTALL.LOG
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyCasino\format.ini
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyCasino\Language\allLangVersion.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyCasino\Language\en_US\version.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyCasino\Language\version.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyCasino\lobbyconfig.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyCasino\pc_uninstall.bat
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyCasino\ProductVersion.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyCasino\version.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\announce.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Images\but_help.jpg
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Images\system_but_bingo.jpg
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\100152.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\100174.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\100178.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\100180.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\100198.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\100202.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\2.html
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\4.html
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\54866.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\54870.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\62958.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\63194.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\64759.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\65478.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\75180.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\94062.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\94148.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\94150.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\94360.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\95752.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\articles\99950.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\en_US\images\system_but_gammon.jpg
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\fr_FR\Articles\100178.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\fr_FR\Articles\54870.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\fr_FR\Articles\64745.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\fr_FR\Articles\75180.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\fr_FR\Articles\94062.atc
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Language\fr_FR\images\system_but_gammon.jpg
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Notes.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\PokerTrainer.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\tmpUpgrade\INSTALL.LOG
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\tmpUpgrade\upgradepp113-114man.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\TourneyDescription.html
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\Uninstall.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\PartyPoker\usertab.txt
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\tmpUpgrade\upgradePG114-115man.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\Program Files\PartyGaming\tmpUpgrade\upgradePG115-116man.exe
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\WINDOWS\system32\aoxqaqyn.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\WINDOWS\system32\bsudmsow.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\WINDOWS\system32\eeOUFfhk.ini2
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\WINDOWS\system32\khfFUOee.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\WINDOWS\system32\oytpucvc.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\WINDOWS\system32\smolkdwf.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\WINDOWS\system32\wilbirgr.dll
C:\_OTMoveIt\MovedFiles\[u]0[/u]6162008_170359\WINDOWS\system32\xvdfswxu.dll
C:\WINDOWS\system32\vcbqskia.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-17 to 2008-06-17 ))))))))))))))))))))))))))))))))))))
.

2008-06-17 07:33 . 2008-06-17 07:34 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-06-16 17:24 . 2008-06-16 17:24 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 17:24 . 2008-06-16 17:24 <REP> d-------- C:\Documents and Settings\JEAN\Application Data\Malwarebytes
2008-06-16 17:24 . 2008-06-16 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-16 07:37 . 2008-06-16 07:37 <REP> d-------- C:\Deckard
2008-06-14 11:29 . 2008-06-11 15:00 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-14 11:29 . 2008-06-11 15:00 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-12 19:20 . 2008-06-12 19:20 <REP> d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-05-28 19:20 . 2008-05-28 19:20 <REP> d-------- C:\Documents and Settings\JEAN\Application Data\Apple Computer
2008-05-24 14:13 . 2008-05-24 14:13 <REP> d-------- C:\Logs
2008-05-21 13:14 . 2008-05-21 13:29 <REP> d-------- C:\Documents and Settings\JEAN\Application Data\Teeworlds
2008-05-17 17:00 . 2006-09-05 19:59 97,088 -ra------ C:\WINDOWS\system32\drivers\se58mdm.sys
2008-05-17 17:00 . 2006-09-05 19:59 9,360 -ra------ C:\WINDOWS\system32\drivers\se58mdfl.sys
2008-05-17 17:00 . 2006-09-05 20:00 6,240 -ra------ C:\WINDOWS\system32\drivers\se58cmnt.sys
2008-05-17 17:00 . 2006-09-05 20:00 6,240 -ra------ C:\WINDOWS\system32\drivers\se58cm.sys
2008-05-17 16:41 . 2008-05-17 16:41 <REP> d-------- C:\Program Files\Disc2Phone
2008-05-17 16:38 . 2008-05-17 16:39 <REP> d-------- C:\Program Files\QuickTime
2008-05-17 16:37 . 2008-05-17 16:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-17 16:36 . 2006-09-05 19:58 61,536 -ra------ C:\WINDOWS\system32\drivers\se58bus.sys
2008-05-17 16:36 . 2006-09-05 19:58 5,872 -ra------ C:\WINDOWS\system32\drivers\se58whnt.sys
2008-05-17 16:36 . 2006-09-05 19:58 5,872 -ra------ C:\WINDOWS\system32\drivers\se58wh.sys
2008-05-17 16:35 . 2008-06-10 19:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-17 16:35 . 2008-05-17 16:36 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-15 13:42 --------- d-----w C:\Program Files\World of Warcraft
2008-06-15 11:45 --------- d-----w C:\Program Files\Trend Micro
2008-06-12 17:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-07 13:36 2,728 ----a-w C:\Documents and Settings\JEAN\Application Data\wklnhst.dat
2008-06-07 13:25 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-23 18:40 --------- d-----w C:\Documents and Settings\JEAN\Application Data\ATI
2008-04-23 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI
2008-04-23 18:33 --------- d-----w C:\Program Files\ATI Technologies
2008-04-23 18:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-23 12:08 --------- d-----w C:\Program Files\Valve
2007-10-30 13:21 67,040 ----a-w C:\Documents and Settings\JEAN\Application Data\GDIPFONTCACHEV1.DAT
2006-12-08 13:08 0 -c--a-w C:\Program Files\Deployment.xml
2006-12-08 13:03 0 -c----w C:\Program Files\WinBootstrapper.msi
2006-12-08 12:58 0 -c--a-w C:\Program Files\WinBootstrapper1.cab
2006-11-27 20:31 49 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb41.dat
2006-11-27 20:31 382 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb1942.dat
2006-11-26 09:23 20,480 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb4827.dat
2006-11-16 06:32 0 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb5436.dat
2006-11-11 19:29 9,216 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb8467.dat
2006-11-11 19:29 0 -c--a-w C:\Documents and Settings\JEAN\Application Data\internaldb6334.dat
2003-08-14 17:13 40,960 -c--a-w C:\Program Files\Uninstall_PCM.exe
.

((((((((((((((((((((((((((((( snapshot@2008-06-16_19.57.44.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-21 06:57:16 1,024,512 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\browseui.dll
+ 2008-04-21 06:57:16 152,064 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\cdfview.dll
+ 2008-04-21 06:57:17 1,056,768 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\danim.dll
+ 2008-04-21 06:57:17 357,888 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\dxtmsft.dll
+ 2008-04-21 06:57:18 205,312 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\dxtrans.dll
+ 2008-04-21 06:57:18 55,808 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\extmgr.dll
+ 2008-04-17 10:46:59 18,432 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\iedw.exe
+ 2008-04-21 06:57:18 251,904 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\iepeers.dll
+ 2008-04-21 06:57:18 96,768 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\inseng.dll
+ 2008-04-21 06:57:18 16,384 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\jsproxy.dll
+ 2008-04-21 06:57:22 3,087,872 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mshtml.dll
+ 2008-04-21 06:57:22 449,024 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mshtmled.dll
+ 2008-04-21 06:57:23 146,432 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\msrating.dll
+ 2008-04-21 06:57:23 532,480 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\mstime.dll
+ 2008-04-21 06:57:23 39,424 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\pngfilt.dll
+ 2008-04-21 06:57:25 1,499,648 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\shdocvw.dll
+ 2008-04-21 06:57:26 474,624 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\shlwapi.dll
+ 2008-04-17 11:03:45 370,176 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\spru040c.dll
+ 2008-04-21 06:57:26 620,544 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\urlmon.dll
+ 2008-04-21 06:57:27 670,720 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\wininet.dll
+ 2008-04-21 06:43:36 3,087,872 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\mshtml.dll
+ 2008-04-21 06:43:36 670,208 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\wininet.dll
+ 2008-04-21 06:30:24 3,088,384 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\mshtml.dll
+ 2008-04-21 06:30:24 670,720 ----a-w C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\wininet.dll
+ 2007-11-30 11:19:06 18,296 ----a-w C:\WINDOWS\$hf_mig$\KB950759\spmsg.dll
+ 2007-11-30 11:19:06 234,872 ----a-w C:\WINDOWS\$hf_mig$\KB950759\spuninst.exe
+ 2007-11-30 11:19:06 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB950759\update\spcustom.dll
+ 2007-11-30 12:39:29 767,352 ----a-w C:\WINDOWS\$hf_mig$\KB950759\update\update.exe
+ 2007-11-30 12:39:31 406,392 ----a-w C:\WINDOWS\$hf_mig$\KB950759\update\updspapi.dll
+ 2008-05-07 04:55:47 1,294,336 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP2QFE\quartz.dll
+ 2008-05-07 05:11:24 1,294,336 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3GDR\quartz.dll
+ 2008-05-07 05:04:59 1,294,336 ----a-w C:\WINDOWS\$hf_mig$\KB951698\SP3QFE\quartz.dll
+ 2007-11-30 11:19:06 18,296 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spmsg.dll
+ 2007-11-30 11:19:06 234,872 ----a-w C:\WINDOWS\$hf_mig$\KB951698\spuninst.exe
+ 2007-11-30 11:19:06 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\spcustom.dll
+ 2007-11-30 12:39:29 767,352 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\update.exe
+ 2007-11-30 12:39:31 406,392 ----a-w C:\WINDOWS\$hf_mig$\KB951698\update\updspapi.dll
- 2008-06-16 17:47:56 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-17 05:43:09 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-14 15:52:45 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
- 2008-02-16 09:02:34 1,024,000 ----a-w C:\WINDOWS\system32\browseui.dll
+ 2008-04-21 07:02:27 1,024,000 ----a-w C:\WINDOWS\system32\browseui.dll
- 2008-02-16 09:02:34 152,064 ----a-w C:\WINDOWS\system32\cdfview.dll
+ 2008-04-21 07:02:27 152,064 ----a-w C:\WINDOWS\system32\cdfview.dll
- 2008-02-16 09:02:34 1,056,768 ----a-w C:\WINDOWS\system32\danim.dll
+ 2008-04-21 07:02:28 1,056,768 ----a-w C:\WINDOWS\system32\danim.dll
- 2008-02-16 09:02:34 1,024,000 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2008-04-21 07:02:27 1,024,000 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
- 2004-08-19 22:55:31 274,944 -c--a-w C:\WINDOWS\system32\dllcache\bthport.sys
+ 2008-04-14 15:52:45 272,768 -c--a-w C:\WINDOWS\system32\dllcache\bthport.sys
- 2008-02-16 09:02:34 152,064 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll
+ 2008-04-21 07:02:27 152,064 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2008-02-16 09:02:34 1,056,768 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
+ 2008-04-21 07:02:28 1,056,768 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
- 2008-02-16 09:02:34 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-04-21 07:02:28 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-02-16 09:02:35 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-04-21 07:02:28 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2008-02-16 09:02:35 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-04-21 07:02:28 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-02-15 09:23:37 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2008-04-17 10:52:54 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
- 2008-02-16 09:02:35 251,392 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2008-04-21 07:02:29 251,392 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2008-02-16 09:02:35 96,768 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2008-04-21 07:02:29 96,768 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
- 2008-02-16 09:02:35 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-04-21 07:02:29 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2008-02-16 22:32:38 3,080,704 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-04-21 07:02:34 3,080,704 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-02-16 09:02:36 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-04-21 07:02:34 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-02-16 09:02:37 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-04-21 07:02:34 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-02-16 09:02:37 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-04-21 07:02:35 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-02-16 09:02:37 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-04-21 07:02:35 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-10-29 22:43:32 1,293,824 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2008-05-07 05:15:36 1,293,824 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2008-02-16 09:02:38 1,495,040 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2008-04-21 07:02:37 1,495,040 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2008-02-16 09:02:38 474,624 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
+ 2008-04-21 07:02:38 474,624 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2008-02-16 09:02:39 617,984 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-04-21 07:02:39 617,984 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-02-16 09:02:39 663,552 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-04-21 07:02:40 663,552 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2004-08-19 22:55:31 274,944 ------w C:\WINDOWS\system32\drivers\bthport.sys
+ 2008-04-14 15:52:45 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
- 2008-02-16 09:02:34 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-04-21 07:02:28 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-02-16 09:02:35 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-04-21 07:02:28 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-02-16 09:02:35 55,808 ------w C:\WINDOWS\system32\extmgr.dll
+ 2008-04-21 07:02:28 55,808 ------w C:\WINDOWS\system32\extmgr.dll
- 2008-02-16 09:02:35 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll
+ 2008-04-21 07:02:29 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2008-02-16 09:02:35 96,768 ----a-w C:\WINDOWS\system32\inseng.dll
+ 2008-04-21 07:02:29 96,768 ----a-w C:\WINDOWS\system32\inseng.dll
- 2008-02-16 09:02:35 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-04-21 07:02:29 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2008-05-09 21:35:04 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
- 2008-02-16 22:32:38 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-04-21 07:02:34 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-02-16 09:02:36 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-04-21 07:02:34 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-02-16 09:02:37 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-04-21 07:02:34 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
- 2008-02-16 09:02:37 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-04-21 07:02:35 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
- 2008-02-16 09:02:37 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-04-21 07:02:35 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2007-10-29 22:43:32 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
+ 2008-05-07 05:15:36 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
- 2008-02-16 09:02:38 1,495,040 ----a-w C:\WINDOWS\system32\shdocvw.dll
+ 2008-04-21 07:02:37 1,495,040 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2008-02-16 09:02:38 474,624 ----a-w C:\WINDOWS\system32\shlwapi.dll
+ 2008-04-21 07:02:38 474,624 ----a-w C:\WINDOWS\system32\shlwapi.dll
- 2006-12-10 12:10:04 15,664 -c----w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:19:06 18,296 ------w C:\WINDOWS\system32\spmsg.dll
- 2008-02-16 09:02:39 617,984 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-04-21 07:02:39 617,984 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-02-16 09:02:39 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-04-21 07:02:40 663,552 ----a-w C:\WINDOWS\system32\wininet.dll
- 2008-02-15 23:03:14 370,176 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-04-17 11:03:45 370,176 ----a-w C:\WINDOWS\system32\xpsp3res.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dit"="Dit.exe" [2002-08-28 13:43 73728 C:\WINDOWS\Dit.exe]
"CHotkey"="mHotkey.exe" [2003-06-27 15:39 506368 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2003-06-27 09:36 5798912 C:\WINDOWS\CNYHKey.exe]
"Cmaudio"="cmicnfg.cpl" [2003-10-14 18:31 2269184 C:\WINDOWS\CMICNFG.CPL]
"PinnacleDriverCheck"="C:\WINDOWS\System32\PSDrvCheck.exe" [2003-05-28 16:37 394240]
"SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2002-11-12 11:02 860672]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-29 00:01 2512128]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-26 17:30 262401]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-17 16:38 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^JEAN^Menu Démarrer^Programmes^Démarrage^Morpheus.lnk]
path=C:\Documents and Settings\JEAN\Menu Démarrer\Programmes\Démarrage\Morpheus.lnk
backup=C:\WINDOWS\pss\Morpheus.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^JEAN^Menu Démarrer^Programmes^Démarrage^Xfire.lnk]
path=C:\Documents and Settings\JEAN\Menu Démarrer\Programmes\Démarrage\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DynDNS Updater]
C:\Program Files\DynDNS Updater\DynDNS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWBMOUSE]
--a------ 2001-03-26 06:35 429568 C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
C:\Program Files\MessengerPlus! 3\MsgPlus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a------ 2003-06-10 18:49 50688 C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
--a--c--- 2003-06-18 12:00 204800 C:\Program Files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-01-19 13:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
--a------ 2003-06-24 15:23 61440 C:\Program Files\Medion Home Cinema XL II\PowerCinema\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-17 16:38 155648 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2006-07-26 04:03 49263 C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weflirt]
--a------ 2007-10-12 17:39 6574080 C:\Program Files\Weflirt\weflirt.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Teamspeak2_RC2\\server_windows.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2VoipServer.exe"=
"C:\\Program Files\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\blatt72\\counter-strike\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\blatt72\\counter-strike source\\hl2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13660:TCP"= 13660:TCP:BitComet 13660 TCP
"13660:UDP"= 13660:UDP:BitComet 13660 UDP
"8332:TCP"= 8332:TCP:BitComet 8332 TCP
"8332:UDP"= 8332:UDP:BitComet 8332 UDP

R2 LogWatch;Event Log Watch;C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe [2002-09-20 16:29]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-06-05 08:04]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-06-12 08:47]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 08:08]
S3 CA_LIC_CLNT;Client de licence CA;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe [2002-09-20 16:27]
S3 CA_LIC_SRVR;Serveur de licence CA;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [2002-09-20 16:41]
S3 HDJCtrl;Hercules DJ Control MP3 Service;C:\WINDOWS\system32\Drivers\HDJCtrl.sys [2005-07-29 16:06]
S3 HDJMidi;Hercules DJ Console MIDI;C:\WINDOWS\system32\DRIVERS\HDJMidi.sys [2005-08-15 12:43]
S3 PRISM_A00;PRISM 802.11g Driver;C:\WINDOWS\system32\DRIVERS\PRISMA00.sys [2003-08-07 16:36]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 07:44:15
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-17 7:54:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-17 05:54:16
ComboFix2.txt 2008-06-16 17:58:11

Pre-Run: 32,129,511,424 octets libres
Post-Run: 32,113,401,856 octets libres

408 --- E O F --- 2008-06-17 05:39:58

virtual.be · Answer

Deckard's System Scanner v20071014.68
Run by JEAN on 2008-06-17 07:58:00
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-17 07:58:02
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\JEAN\Bureau\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/toolbar/ie8/sidebar.html
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32
wprovau.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - https://www.f-secure.com/en/home/support
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37899.1981365741
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab Class) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\Program Files\Common Files\X10\Common\X10nets.exe

Utilisateur anonyme · Answer

Re ,

Hijackthis ce trouve ici :  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 

Renomme le stp.

Au final tu dois avoir ceci : C:\Program Files\Trend Micro\HijackThis\HJT.exe

ok ? :)

*****************************************************

&#8594; Relance hijackthis , en menu principal choisis ' Do a system scan only' Et fixe ces/cette ligne(s) : ( coche la case à leurs gauches )

R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - (no file) 
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - (no file)
O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) 
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') 
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) 






Ferme toutes les fenêtres (hormis Hijackthis), y compris ton navigateur web. 

&#8594; clique sur  ' fixchecked '

****************************************************

&#8594; Télécharge clean : http://www.malekal.com/download/clean.zip

&#8594; Dézippe-le ( clique droit , extraire tout) 

&#8594; Lance clean.cmd ( ou clean ), Choisi l'option 1 et poste moi le rapport.

(- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )

Note : Tu auras peut-être un message qui t'invitera a uploader un fichier , fait-le dès que tu pourras. 


Tutorial : http://bibou0007.com/outils-specifiques-f78/tuto-clean-t1007.htm

****************************************************


a++

virtual.be · Answer

il y a un probleme parce que a C:\Program Files\Trend Micro apres je n'ai plus de fichier !

Utilisateur anonyme · Answer

Re ,

Télécharge TrendMicro™ HijackThis™
Laisse le s'installer dans son repertoire par défaut.

A+++

virtual.be · Answer

Je n'ai trouver que sa dans  C/rapport_clean.txt

 mar. 17/06/2008 a 16:22:29,92 
 
*** Recherche des fichiers dans C: 
C:\StubInstaller.exe FOUND 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
 
*** Recherche des fichiers dans C:\Program Files

Utilisateur anonyme · Answer

Re ,

C'est le bon.

&#8594; Redémarre en MSE

Autre tutorials pour MSE:

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
http://www.coupdepoucepc.com/modules/news/article.php?storyid=253

&#8594; Re-lance clean  -> Choisis l'option 2

---Clean va travailler.---

&#8594; Un rapport Va etre généré , poste le moi ;)

( Le rapport est aussi sauvegardé dans C:\Rapport_clean.txt )

*************

+ un nouveau rapport Hijackthis en mode normal .

A+

virtual.be · Answer

Et voila, desolé pour le retard !

Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec jeu. 19/06/2008 a 15:01:47,06 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
tentative de suppression de C:\StubInstaller.exe 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
 
*** Suppression des fichiers dans C:\Program Files 
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport !

Utilisateur anonyme · Answer

Re !

reposte un rapport Hijackthis stp

A+

Probleme cheval de troie

40 réponses

Discussions similaires

Newsletters