Trojans récalcitrants Résolu

Question

Bonjour,


Depuis quelque temps, je suis infecté par un(des ?) trojan(s).

Je reçois régulièrement des fausses alertes du pare feu Windows, m’incitant à aller sur un site web, permettant de télécharger des AdvWare à mon insu. De plus le gestionnaire de tâche à était bloqué.

Apres recherche sur Internet, et scan de avast et de Spybot - Search & Destroy. J’ai réussi à réactiver le gestionnaire de tache, mais je reçois toujours ces fausses alertes du pare-feu.

Que dois-je faire ?
Merci d’avance !

Ps : voici les noms des trojans que le faux pare-feu m’envois :

trojan-spy.win32.keylogger.aa
trojan-spy.html.bankfraud.dq
trojan-downloader.win32.agent.bq
trojan-spy.win32.greenscreen
trojan-clicker.win32.tiny.h

Scipion02 · Answer

logiquement, c'est ceci :

E:\DOCUME~1\ALLUSE~1\APPLIC~1\bwjypabo moved successfully.
E:\DOCUME~1\ALLUSE~1\APPLIC~1\DateBowsLoadBash moved successfully.
E:\DOCUME~1\Quentin\APPLIC~1\Greycake(2) moved successfully.
E:\WINDOWS\system32\dglirqzs.exe moved successfully.
E:\WINDOWS\system32\orsrcvsd.exe moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08202008_183833

Destrio5 · Answer

Bien.

- Télécharge Deckard's System Scanner (DSS) sur ton bureau :
http://deckard.geekstogo.com/dss.exe
- Ferme toutes les applications en cours antivirus y compris
- Double-clique sur dss.exe pour lancer le soft 
- S'il ne trouve pas HijackThis, clique sur Oui    
- Clique sur OK à chaque fois que cela sera demandé
- L'analyse finie, un fichier texte s'affichera. Enregistre-le et poste-le.
- Le rapport se trouve ici : C:\Deckard\System Scanner\main.txt

Scipion02 · Answer

Le lien est Hs :s

Et je n'ai pas trouver d'autre site de téléchargement opérationnel.

Destrio5 · Answer

Ok, pour l'instant, il n'est plus disponible, il ne faut plus l'utiliser.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Scipion02 · Answer

Voilà :

ComboFix 08-08-19.02 - Anglais 2008-08-20 19:53:07.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.245 [GMT 2:00]
Endroit: E:\Documents and Settings\Anglais\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\Documents and Settings\Alain\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
E:\Documents and Settings\Anglais\Cookies\anglais@edt02[1].txt
E:\Documents and Settings\Anglais\Cookies\anglais@serving-sys[1].txt

.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))))))))
.

2008-08-20 18:58 . 2008-08-20 18:58 86,016 --a------ E:\WINDOWS\system32\jmvipaze.exe
2008-08-20 18:38 . 2008-08-20 18:38 <REP> d-------- E:\_OTMoveIt
2008-08-20 12:44 . 2008-08-20 13:06 <REP> d-------- E:\Lop SD
2008-08-20 10:00 . 2008-08-20 10:00 86,016 --a------ E:\WINDOWS\system32\honmhalm.exe
2008-08-20 09:34 . 2008-08-20 09:34 <REP> d-------- E:\Program Files\Trend Micro
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Program Files\Malwarebytes' Anti-Malware
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Documents and Settings\Anglais\Application Data\Malwarebytes
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-19 18:32 . 2008-08-17 15:01 38,472 --a------ E:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-19 18:32 . 2008-08-17 15:01 17,144 --a------ E:\WINDOWS\system32\drivers\mbam.sys
2008-08-19 10:51 . 2008-08-19 10:57 17,454 --a------ E:\WINDOWS\wininit.ini
2008-08-18 19:23 . 2008-08-18 19:24 <REP> d-------- E:\Program Files\Spybot - Search & Destroy
2008-08-18 19:23 . 2008-08-18 22:10 <REP> d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 23:40 . 2008-08-17 23:40 54,156 --ah----- E:\WINDOWS\QTFont.qfn
2008-08-17 23:40 . 2008-08-17 23:40 1,409 --a------ E:\WINDOWS\QTFont.for
2008-08-11 01:42 . 2008-08-11 01:53 <REP> d-------- E:\WINDOWS\system32\NtmsData
2008-08-10 18:54 . 2008-08-10 18:54 <REP> d-------- E:\Program Files\lracan
2008-08-10 18:40 . 2008-08-18 12:53 <REP> d-------- E:\Documents and Settings\All Users\Application Data\GenInfoCom

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-19 21:17 --------- d-----w E:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-10 19:59 --------- d-----w E:\Program Files\Wanadoo
2008-08-10 19:05 --------- d-----w E:\Program Files\Fichiers communs\Symantec Shared
2008-08-10 16:57 --------- d-----w E:\Documents and Settings\All Users\Application Data\Symantec
2008-08-10 08:33 --------- d-----w E:\Documents and Settings\Anglais\Application Data\gtk-2.0
2008-06-20 17:41 247,808 ----a-w E:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w E:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w E:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w E:\WINDOWS\system32\drivers\tcpip6.sys
2006-08-05 09:04 21,924,135 -c--a-w E:\Documents and Settings\Alain\securitoo_controle_parental_orange_r8.exe
1998-08-24 11:09 10,000 -c--a-w E:\WINDOWS\inf\unregpn.exe
.

------- Sigcheck -------

2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 E:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-19 18:09 1036288 2a7bd330924252a2fd80344fc949bb72 E:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\system32\dllcache\explorer.exe

2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-10 13:47 68856]
"Picasa Media Detector"="E:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
"Steam"="f:\steram~1\steam.exe" [2008-07-31 15:34 1271032]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="E:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"avast!"="E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert"="E:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [2006-08-03 17:29 67264]

E:\Documents and Settings\Anglais\Menu D‚marrer\Programmes\D‚marrage\
TransBar.lnk - E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536]
UberIcon.lnk - E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 09:43:08 180224]
Y'z Shadow.lnk - E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 09:43:14 155648]

E:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - E:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-18 00:05:56 65588]
Outil de mise … jour Google.lnk - E:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-10 13:46:58 124912]
Utilitaire r‚seau pour SAGEM Wi-Fi 11g USB adapter.lnk - E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe [2007-05-07 11:36:41 835584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"HlpStrCom"= {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll [2008-08-10 18:54 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.NSVI"= NSVIDEO.DLL
"VIDC.JPEG"= JpegCode.dll
"VIDC.MJPG"= JpegCode.dll
"VIDC.HFYU"= huffyuv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"E:\\Program Files\\Messenger\\msmsgs.exe"=
"E:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"E:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;E:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;E:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 NwSapAgent;Agent SAP;E:\WINDOWS\system32\svchost.exe [2004-08-19 18:10]
R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;E:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 16:37]
S3 DSCVc;Video Capture;E:\WINDOWS\system32\DRIVERS\CoachVc.sys [2003-11-03 18:31]
S3 ZDCndis5;ZDCndis5 Protocol Driver;E:\WINDOWS\system32\ZDCndis5.SYS []

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
*Newly Created Service* - ZDPNDIS5
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

2008-07-29 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- E:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]
.
- - - - ORPHANS REMOVED - - - -

BHO-{6488DF32-3582-2E07-8DD6-842DF26C4684} - (no file)
HKCU-Run-webset - E:\WINDOWS\system32\dglirqzs.exe
HKCU-Run-comappmon - E:\WINDOWS\system32\orsrcvsd.exe
HKCU-Run-ForkEach - E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe
HKLM-Explorer_Run-RRaJS1O11u - E:\Documents and Settings\All Users\Application Data\bwjypabo\telonijy.exe
Notify-WgaLogon - (no file)

.
------- Supplementary Scan -------
.
FireFox -: Profile - E:\Documents and Settings\Anglais\Application Data\Mozilla\Firefox\Profiles\4xqg1e25.default\
FF -: plugin - E:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - E:\Program Files\Google\Google Updater\2.2.940.34809\npCIDetect11.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-20 19:55:41
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-08-20 19:58:02
ComboFix-quarantined-files.txt 2008-08-20 17:57:56

Pre-Run: 4,482,740,224 octets libres
Post-Run: 4,748,832,768 octets libres

140 --- E O F --- 2008-07-28 19:59:29

Destrio5 · Answer

* Télécharge SDFix (par Andy Manchesta) et sauvegarde-le sur ton bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

* Double-clique sur SDFix.exe et choisis Install pour l'extraire dans son dossier sur le bureau.
* Redémarre le PC en mode sans échec :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
* Choisis ton compte.

Déroule la liste des instructions ci-dessous :
* Ouvre le dossier SDFix qui vient d'être créé sur le bureau et double-clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le nettoyage.
* Quand il te le demandera, appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long à redémarrer car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du bureau, l'outil aura terminé et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton bureau.
* Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.
* Enfin, copie/colle le rapport du fichier Report.txt.

Scipion02 · Answer

Voici :


[b]SDFix: Version 1.218 [/b]
Run by Anglais on 21/08/2008 at 16:48

Microsoft Windows XP [version 5.1.2600]
Running From: E:\antivirustest\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found




Folder E:\Documents and Settings\Anglais\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 17:14:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:a1,8a,86,11,a6,bd,a6,db,90,07,37,58,80,f7,b8,86,5e,37,24,80,03,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:a1,8a,86,11,a6,bd,a6,db,90,07,37,58,80,f7,b8,86,5e,37,24,80,03,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"="E:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
"E:\Program Files\Messenger\msmsgs.exe"="E:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"E:\Program Files\MSN Messenger\msnmsgr.exe"="E:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"E:\Program Files\MSN Messenger\livecall.exe"="E:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\MSN Messenger\msnmsgr.exe"="E:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"E:\Program Files\MSN Messenger\livecall.exe"="E:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Sat  8 Mar 2008     6,104,632 A..H. --- "E:\Program Files\Picasa2\setup.exe"
Mon  7 Jul 2008     1,429,840 A.SHR --- "E:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon  7 Jul 2008     4,891,472 A.SHR --- "E:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon  7 Jul 2008     2,156,368 A.SHR --- "E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 10 May 2006         4,348 A.SH. --- "E:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 19 Aug 2008        20,992 ...H. --- "E:\Documents and Settings\Anglais\Bureau\~WRL1693.tmp"
Sun  2 Mar 2008             0 A.SH. --- "E:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sat 19 Jul 2008             0 A..H. --- "E:\WINDOWS\SoftwareDistribution\Download\be077a0a5c65554c0fa221a5c8a0529b\BIT7.tmp"
Sat  5 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0001.tmp"
Mon 28 May 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0003.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0004.tmp"
Sun  9 Sep 2007        20,992 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0005.tmp"
Sun 14 Oct 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0006.tmp"
Thu  3 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0007.tmp"
Sat  5 Jan 2008        20,480 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0008.tmp"
Sun  6 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0009.tmp"
Sun  6 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0010.tmp"
Sun  3 Feb 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0011.tmp"
Sat  9 Feb 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0012.tmp"
Tue 17 Jun 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0013.tmp"
Wed  2 Jul 2008        19,968 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0014.tmp"
Mon 18 Aug 2008        20,992 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0015.tmp"
Sun  6 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0446.tmp"
Sun  3 Feb 2008        20,480 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0736.tmp"
Sat  5 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0749.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1107.tmp"
Sat 11 Aug 2007        20,480 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1200.tmp"
Thu  3 Jan 2008        19,968 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1216.tmp"
Sat 11 Aug 2007        19,968 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1376.tmp"
Wed  2 Jul 2008        20,480 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1647.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1663.tmp"
Wed 20 Aug 2008        20,992 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL2194.tmp"
Wed 15 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL2372.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL2454.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL2635.tmp"
Mon 18 Aug 2008        21,504 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL3056.tmp"
Sun  9 Sep 2007        22,528 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL3873.tmp"
Sat 30 Jun 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0003.tmp"
Sun 30 Apr 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0004.tmp"
Sat 30 Jun 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0005.tmp"
Sun  1 Jul 2007        21,504 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0006.tmp"
Wed  4 Jul 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0007.tmp"
Thu  5 Jul 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0008.tmp"
Wed 27 Dec 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0363.tmp"
Sat 30 Jun 2007        21,504 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL1526.tmp"
Mon  5 Feb 2007        19,968 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL1568.tmp"
Wed 18 Oct 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL2253.tmp"
Tue 31 Oct 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL2461.tmp"
Sat 30 Jun 2007        20,480 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL2501.tmp"
Tue 31 Oct 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL3496.tmp"
Sat 30 Jun 2007        20,480 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL3788.tmp"
Wed 14 Mar 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL3911.tmp"
Wed 14 Mar 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL4079.tmp"

[b]Finished![/b]

Destrio5 · Answer

---> Télécharge le fichier CFScript et enregistre-le sur ton bureau :
http://www.megaupload.com/fr/?d=NKK50MM2

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

Scipion02 · Answer

Les Symptômes du trojan, ont visiblement disparus, verdict ? Reste encore des risques ?

ComboFix 08-08-19.06 - Anglais 2008-08-21 22:41:23.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.291 [GMT 2:00]
Endroit: E:\Documents and Settings\Anglais\Bureau\ComboFix.exe
Command switches used :: E:\Documents and Settings\Anglais\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
E:\WINDOWS\system32\honmhalm.exe
E:\WINDOWS\system32\jmvipaze.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\Program Files\Symantec
E:\Program Files\Symantec\LiveUpdate\1.Settings.Default.LiveUpdate
E:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
E:\Program Files\Symantec\LiveUpdate\ALUNOTIFYRES.DLL
E:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
E:\Program Files\Symantec\LiveUpdate\AluSchedulerSvcRes.dll
E:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
E:\Program Files\Symantec\LiveUpdate\AUPDATERES.DLL
E:\Program Files\Symantec\LiveUpdate\LISEZMOI.TXT
E:\Program Files\Symantec\LiveUpdate\LSETUP.EXE
E:\Program Files\Symantec\LiveUpdate\LSETUPRES.DLL
E:\Program Files\Symantec\LiveUpdate\LUALL.EXE
E:\Program Files\Symantec\LiveUpdate\LUALLRES.DLL
E:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
E:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE
E:\Program Files\Symantec\LiveUpdate\LuComServerPS_3_0.DLL
E:\Program Files\Symantec\LiveUpdate\LuComServerRes.dll
E:\Program Files\Symantec\LiveUpdate\ludirloc.dat
E:\Program Files\Symantec\LiveUpdate\LUINFO.INF
E:\Program Files\Symantec\LiveUpdate\LUInit.exe
E:\Program Files\Symantec\LiveUpdate\LUInit.ini
E:\Program Files\Symantec\LiveUpdate\LUINSDLL.DLL
E:\Program Files\Symantec\LiveUpdate\LUINSDLLRES.DLL
E:\Program Files\Symantec\LiveUpdate\luinventoryinst.jar
E:\Program Files\Symantec\LiveUpdate\LuPreCon.DLL
E:\Program Files\Symantec\LiveUpdate\LuResult.txt
E:\Program Files\Symantec\LiveUpdate\LUSESAIntegration.dll
E:\Program Files\Symantec\LiveUpdate\LUSESAIntegrationRes.dll
E:\Program Files\Symantec\LiveUpdate\LUSETUP.EXE
E:\Program Files\Symantec\LiveUpdate\LUUPDATE.EXE
E:\Program Files\Symantec\LiveUpdate\MFC71.DLL
E:\Program Files\Symantec\LiveUpdate\MSVCP71.DLL
E:\Program Files\Symantec\LiveUpdate\MSVCR71.DLL
E:\Program Files\Symantec\LiveUpdate\NetDetectController_3_0.DLL
E:\Program Files\Symantec\LiveUpdate\ProductRegCom_3_0.DLL
E:\Program Files\Symantec\LiveUpdate\providerInst.jar
E:\Program Files\Symantec\LiveUpdate\S32LIVE1.DLL
E:\Program Files\Symantec\LiveUpdate\S32LUCP1.CPL
E:\Program Files\Symantec\LiveUpdate\S32LUCP1RES.DLL
E:\Program Files\Symantec\LiveUpdate\S32LUIS1.DLL
E:\Program Files\Symantec\LiveUpdate\S32LUWI1.DLL
E:\Program Files\Symantec\LiveUpdate\SESA.Settings.LiveUpdate
E:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.exe
E:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.log
E:\Program Files\Symantec\LiveUpdate\SymantecRootInstallerRes.dll
E:\Program Files\Symantec\LiveUpdate\UNRAR.DLL
E:\Program Files\Symantec\LiveUpdate\winluproviderinst.jar
E:\Program Files\Symantec\S32EVNT1.DLL
E:\Program Files\Symantec\SYMEVENT.CAT
E:\Program Files\Symantec\SYMEVENT.INF
E:\Program Files\Symantec\SYMEVENT.SYS
E:\WINDOWS\system32\honmhalm.exe
E:\WINDOWS\system32\jmvipaze.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-21 to 2008-08-21 ))))))))))))))))))))))))))))))))))))
.

2008-08-21 16:40 . 2008-08-21 16:40 <REP> d-------- E:\WINDOWS\ERUNT
2008-08-21 16:35 . 2008-08-21 16:35 <REP> d-------- E:\antivirustest
2008-08-20 18:38 . 2008-08-20 18:38 <REP> d-------- E:\_OTMoveIt
2008-08-20 12:44 . 2008-08-20 13:06 <REP> d-------- E:\Lop SD
2008-08-20 09:34 . 2008-08-20 09:34 <REP> d-------- E:\Program Files\Trend Micro
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Program Files\Malwarebytes' Anti-Malware
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Documents and Settings\Anglais\Application Data\Malwarebytes
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-19 18:32 . 2008-08-17 15:01 38,472 --a------ E:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-19 18:32 . 2008-08-17 15:01 17,144 --a------ E:\WINDOWS\system32\drivers\mbam.sys
2008-08-19 10:51 . 2008-08-19 10:57 17,454 --a------ E:\WINDOWS\wininit.ini
2008-08-18 19:23 . 2008-08-18 19:24 <REP> d-------- E:\Program Files\Spybot - Search & Destroy
2008-08-18 19:23 . 2008-08-18 22:10 <REP> d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 23:40 . 2008-08-17 23:40 54,156 --ah----- E:\WINDOWS\QTFont.qfn
2008-08-17 23:40 . 2008-08-17 23:40 1,409 --a------ E:\WINDOWS\QTFont.for
2008-08-11 01:42 . 2008-08-11 01:53 <REP> d-------- E:\WINDOWS\system32\NtmsData
2008-08-10 18:54 . 2008-08-10 18:54 <REP> d-------- E:\Program Files\lracan
2008-08-10 18:40 . 2008-08-18 12:53 <REP> d-------- E:\Documents and Settings\All Users\Application Data\GenInfoCom

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 08:37 --------- d-----w E:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-10 19:59 --------- d-----w E:\Program Files\Wanadoo
2008-08-10 19:05 --------- d-----w E:\Program Files\Fichiers communs\Symantec Shared
2008-08-10 16:57 --------- d-----w E:\Documents and Settings\All Users\Application Data\Symantec
2008-08-10 08:33 --------- d-----w E:\Documents and Settings\Anglais\Application Data\gtk-2.0
2008-06-20 17:41 247,808 ----a-w E:\WINDOWS\system32\mswsock.dll
2006-08-05 09:04 21,924,135 -c--a-w E:\Documents and Settings\Alain\securitoo_controle_parental_orange_r8.exe
1998-08-24 11:09 10,000 -c--a-w E:\WINDOWS\inf\unregpn.exe
.

------- Sigcheck -------

2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 E:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-19 18:09 1036288 2a7bd330924252a2fd80344fc949bb72 E:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\system32\dllcache\explorer.exe

2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((( snapshot@2008-08-20_19.57.23.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04 163,328 ----a-w E:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-08-21 14:45:23 11,419,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-08-21 14:45:23 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 14:27:04 163,328 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-08-21 14:40:53 11,419,648 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-08-21 14:40:53 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-21 20:45:33 16,384 ----atw E:\WINDOWS\Temp\Perflib_Perfdata_7b8.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="E:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
"webset"="E:\WINDOWS\system32\dglirqzs.exe" [BU]
"comappmon"="E:\WINDOWS\system32\orsrcvsd.exe" [BU]
"ForkEach"="E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe" [BU]
"swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-10 13:47 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"HlpStrCom"= {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll [2008-08-10 18:54 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.NSVI"= NSVIDEO.DLL
"VIDC.JPEG"= JpegCode.dll
"VIDC.MJPG"= JpegCode.dll
"VIDC.HFYU"= huffyuv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"E:\\Program Files\\Messenger\\msmsgs.exe"=
"E:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"E:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;E:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;E:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 NwSapAgent;Agent SAP;E:\WINDOWS\system32\svchost.exe [2004-08-19 18:10]
R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;E:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 16:37]
S3 DSCVc;Video Capture;E:\WINDOWS\system32\DRIVERS\CoachVc.sys [2003-11-03 18:31]
S3 ZDCndis5;ZDCndis5 Protocol Driver;E:\WINDOWS\system32\ZDCndis5.SYS []
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-07-29 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- E:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]
.
- - - - ORPHANS REMOVED - - - -

BHO-{6488DF32-3582-2E07-8DD6-842DF26C4684} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 22:46:11
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: E:\WINDOWS\explorer.exe
-> E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
.
------------------------ Other Running Processes ------------------------
.
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-21 22:51:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-21 20:51:01
ComboFix2.txt 2008-08-20 17:58:03

Pre-Run: 4,707,233,792 octets libres
Post-Run: 4,902,338,560 octets libres

194 --- E O F --- 2008-07-28 19:59:29

Scipion02 · Answer

Les symptôme du trojan on disparus (à savoir les fausses alerte du pare-feu), il reste encore des risques ?

ComboFix 08-08-19.06 - Anglais 2008-08-21 22:41:23.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.291 [GMT 2:00]
Endroit: E:\Documents and Settings\Anglais\Bureau\ComboFix.exe
Command switches used :: E:\Documents and Settings\Anglais\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
E:\WINDOWS\system32\honmhalm.exe
E:\WINDOWS\system32\jmvipaze.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\Program Files\Symantec
E:\Program Files\Symantec\LiveUpdate\1.Settings.Default.LiveUpdate
E:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
E:\Program Files\Symantec\LiveUpdate\ALUNOTIFYRES.DLL
E:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
E:\Program Files\Symantec\LiveUpdate\AluSchedulerSvcRes.dll
E:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
E:\Program Files\Symantec\LiveUpdate\AUPDATERES.DLL
E:\Program Files\Symantec\LiveUpdate\LISEZMOI.TXT
E:\Program Files\Symantec\LiveUpdate\LSETUP.EXE
E:\Program Files\Symantec\LiveUpdate\LSETUPRES.DLL
E:\Program Files\Symantec\LiveUpdate\LUALL.EXE
E:\Program Files\Symantec\LiveUpdate\LUALLRES.DLL
E:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
E:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE
E:\Program Files\Symantec\LiveUpdate\LuComServerPS_3_0.DLL
E:\Program Files\Symantec\LiveUpdate\LuComServerRes.dll
E:\Program Files\Symantec\LiveUpdate\ludirloc.dat
E:\Program Files\Symantec\LiveUpdate\LUINFO.INF
E:\Program Files\Symantec\LiveUpdate\LUInit.exe
E:\Program Files\Symantec\LiveUpdate\LUInit.ini
E:\Program Files\Symantec\LiveUpdate\LUINSDLL.DLL
E:\Program Files\Symantec\LiveUpdate\LUINSDLLRES.DLL
E:\Program Files\Symantec\LiveUpdate\luinventoryinst.jar
E:\Program Files\Symantec\LiveUpdate\LuPreCon.DLL
E:\Program Files\Symantec\LiveUpdate\LuResult.txt
E:\Program Files\Symantec\LiveUpdate\LUSESAIntegration.dll
E:\Program Files\Symantec\LiveUpdate\LUSESAIntegrationRes.dll
E:\Program Files\Symantec\LiveUpdate\LUSETUP.EXE
E:\Program Files\Symantec\LiveUpdate\LUUPDATE.EXE
E:\Program Files\Symantec\LiveUpdate\MFC71.DLL
E:\Program Files\Symantec\LiveUpdate\MSVCP71.DLL
E:\Program Files\Symantec\LiveUpdate\MSVCR71.DLL
E:\Program Files\Symantec\LiveUpdate\NetDetectController_3_0.DLL
E:\Program Files\Symantec\LiveUpdate\ProductRegCom_3_0.DLL
E:\Program Files\Symantec\LiveUpdate\providerInst.jar
E:\Program Files\Symantec\LiveUpdate\S32LIVE1.DLL
E:\Program Files\Symantec\LiveUpdate\S32LUCP1.CPL
E:\Program Files\Symantec\LiveUpdate\S32LUCP1RES.DLL
E:\Program Files\Symantec\LiveUpdate\S32LUIS1.DLL
E:\Program Files\Symantec\LiveUpdate\S32LUWI1.DLL
E:\Program Files\Symantec\LiveUpdate\SESA.Settings.LiveUpdate
E:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.exe
E:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.log
E:\Program Files\Symantec\LiveUpdate\SymantecRootInstallerRes.dll
E:\Program Files\Symantec\LiveUpdate\UNRAR.DLL
E:\Program Files\Symantec\LiveUpdate\winluproviderinst.jar
E:\Program Files\Symantec\S32EVNT1.DLL
E:\Program Files\Symantec\SYMEVENT.CAT
E:\Program Files\Symantec\SYMEVENT.INF
E:\Program Files\Symantec\SYMEVENT.SYS
E:\WINDOWS\system32\honmhalm.exe
E:\WINDOWS\system32\jmvipaze.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-21 to 2008-08-21 ))))))))))))))))))))))))))))))))))))
.

2008-08-21 16:40 . 2008-08-21 16:40 <REP> d-------- E:\WINDOWS\ERUNT
2008-08-21 16:35 . 2008-08-21 16:35 <REP> d-------- E:\antivirustest
2008-08-20 18:38 . 2008-08-20 18:38 <REP> d-------- E:\_OTMoveIt
2008-08-20 12:44 . 2008-08-20 13:06 <REP> d-------- E:\Lop SD
2008-08-20 09:34 . 2008-08-20 09:34 <REP> d-------- E:\Program Files\Trend Micro
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Program Files\Malwarebytes' Anti-Malware
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Documents and Settings\Anglais\Application Data\Malwarebytes
2008-08-19 18:32 . 2008-08-19 18:32 <REP> d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-19 18:32 . 2008-08-17 15:01 38,472 --a------ E:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-19 18:32 . 2008-08-17 15:01 17,144 --a------ E:\WINDOWS\system32\drivers\mbam.sys
2008-08-19 10:51 . 2008-08-19 10:57 17,454 --a------ E:\WINDOWS\wininit.ini
2008-08-18 19:23 . 2008-08-18 19:24 <REP> d-------- E:\Program Files\Spybot - Search & Destroy
2008-08-18 19:23 . 2008-08-18 22:10 <REP> d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-17 23:40 . 2008-08-17 23:40 54,156 --ah----- E:\WINDOWS\QTFont.qfn
2008-08-17 23:40 . 2008-08-17 23:40 1,409 --a------ E:\WINDOWS\QTFont.for
2008-08-11 01:42 . 2008-08-11 01:53 <REP> d-------- E:\WINDOWS\system32\NtmsData
2008-08-10 18:54 . 2008-08-10 18:54 <REP> d-------- E:\Program Files\lracan
2008-08-10 18:40 . 2008-08-18 12:53 <REP> d-------- E:\Documents and Settings\All Users\Application Data\GenInfoCom

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 08:37 --------- d-----w E:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-10 19:59 --------- d-----w E:\Program Files\Wanadoo
2008-08-10 19:05 --------- d-----w E:\Program Files\Fichiers communs\Symantec Shared
2008-08-10 16:57 --------- d-----w E:\Documents and Settings\All Users\Application Data\Symantec
2008-08-10 08:33 --------- d-----w E:\Documents and Settings\Anglais\Application Data\gtk-2.0
2008-06-20 17:41 247,808 ----a-w E:\WINDOWS\system32\mswsock.dll
2006-08-05 09:04 21,924,135 -c--a-w E:\Documents and Settings\Alain\securitoo_controle_parental_orange_r8.exe
1998-08-24 11:09 10,000 -c--a-w E:\WINDOWS\inf\unregpn.exe
.

------- Sigcheck -------

2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 E:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-19 18:09 1036288 2a7bd330924252a2fd80344fc949bb72 E:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\system32\dllcache\explorer.exe

2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((( snapshot@2008-08-20_19.57.23.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 14:27:04 163,328 ----a-w E:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-08-21 14:45:23 11,419,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-08-21 14:45:23 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 14:27:04 163,328 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-08-21 14:40:53 11,419,648 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat
+ 2008-08-21 14:40:53 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-21 20:45:33 16,384 ----atw E:\WINDOWS\Temp\Perflib_Perfdata_7b8.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="E:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
"webset"="E:\WINDOWS\system32\dglirqzs.exe" [BU]
"comappmon"="E:\WINDOWS\system32\orsrcvsd.exe" [BU]
"ForkEach"="E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe" [BU]
"swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-10 13:47 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"HlpStrCom"= {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll [2008-08-10 18:54 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.NSVI"= NSVIDEO.DLL
"VIDC.JPEG"= JpegCode.dll
"VIDC.MJPG"= JpegCode.dll
"VIDC.HFYU"= huffyuv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"E:\\Program Files\\Messenger\\msmsgs.exe"=
"E:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"E:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 aswSP;avast! Self Protection;E:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
R2 aswFsBlk;aswFsBlk;E:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 NwSapAgent;Agent SAP;E:\WINDOWS\system32\svchost.exe [2004-08-19 18:10]
R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;E:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 16:37]
S3 DSCVc;Video Capture;E:\WINDOWS\system32\DRIVERS\CoachVc.sys [2003-11-03 18:31]
S3 ZDCndis5;ZDCndis5 Protocol Driver;E:\WINDOWS\system32\ZDCndis5.SYS []
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-07-29 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- E:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]
.
- - - - ORPHANS REMOVED - - - -

BHO-{6488DF32-3582-2E07-8DD6-842DF26C4684} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 22:46:11
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: E:\WINDOWS\explorer.exe
-> E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
.
------------------------ Other Running Processes ------------------------
.
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-21 22:51:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-21 20:51:01
ComboFix2.txt 2008-08-20 17:58:03

Pre-Run: 4,707,233,792 octets libres
Post-Run: 4,902,338,560 octets libres

194 --- E O F --- 2008-07-28 19:59:29

Destrio5 · Answer

---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download

---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

---> Poste un nouveau rapport HijackThis

Scipion02 · Answer

Tadam :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:03:04, on 22/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\MSN Messenger\livecall.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [webset] E:\WINDOWS\system32\dglirqzs.exe
O4 - HKCU\..\Run: [comappmon] E:\WINDOWS\system32\orsrcvsd.exe
O4 - HKCU\..\Run: [ForkEach] E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O21 - SSODL: HlpStrCom - {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Unknown owner - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Destrio5 · Answer

---> Mets à jour Internet Explorer :
http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=fr

---> Mets à jour Java :
https://www.java.com/fr/download/manual.jsp

---> Relance HijackThis et choisis Do a system scan only

---> Coche les cases qui sont devant les lignes suivantes :

R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) 

O4 - HKCU\..\Run: [webset] E:\WINDOWS\system32\dglirqzs.exe 

O4 - HKCU\..\Run: [comappmon] E:\WINDOWS\system32\orsrcvsd.exe 

O4 - HKCU\..\Run: [ForkEach] E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe 

O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE     

O21 - SSODL: HlpStrCom - {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll 

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Supprime les traces de Norton avec ceci :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

--->  Poste un nouveau rapport HijackThis

Scipion02 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:14:13, on 22/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\system32\calc.exe
E:\WINDOWS\system32
otepad.exe
E:\Program Files\Microsoft Office\Office\WINWORD.EXE
E:\Program Files\MSN Messenger\livecall.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Unknown owner - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Destrio5 · Answer

Important : Désactive TeaTimer, le résident de Spybot, il va gêner la désinfection en empêchant la modification des BHO.

--->  Démarre Spybot, clique sur Mode, coche Mode avancé
---> A gauche, clique sur Outils, puis sur Résident
--->  Décoche la case devant Résident "TeaTimer" :
http://apu.mabul.org/up/5/apu-5-gpdx9e06cwz2dypom2q7n6nc.jpg
--->  Quitte Spybot

Note : Je te conseille de ne pas le réactiver, il a été incapable d'empêcher l'infection de ton PC.

Puis recommence ce que je t'ai demandé de faire.

Pour HijackThis, si des lignes n'apparaissent plus, tu ne les coches pas tout simplement.

Scipion02 · Answer

Désolé pour le temps :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:48:39, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\MSN Messenger\livecall.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Windows Media Player\wmplayer.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Unknown owner - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Destrio5 · Answer

Mets à jour Java et Internet Explorer.

Scipion02 · Answer

Eurf oublié.

Alors je viens de mettre à jour Java, et par contre je ne me sers (quasiment) jamais de Ie.

Destrio5 · Answer

Mets-le à jour quand même.

Scipion02 · Answer

Bien , je reposte donc j'imagine, le rapport modifié :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:54:18, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\MSN Messenger\livecall.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Windows Media Player\wmplayer.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Microsoft Office\Office\WINWORD.EXE
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [NoIE4StubProcessing] E:\WINDOWS\system32eg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Unknown owner - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Trojans récalcitrants

32 réponses

Discussions similaires

Newsletters