Redirection Google Résolu

Question

Bonjour,
J'ai rechercher sur CCM les moyen de resoudre mon problème sans aucun succès.
Lorsque je vais sur Google, sois par opera ou Internet Explorer (derniere version) ça me redirige sur des sites sauf celui sur lequel j'ai cliqué sur Google.
Voici mon rapport HiJackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:05:47, on 2008-10-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'Default user')
O4 - Startup: Raccourci vers ScreenSize.lnk = C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
O4 - Global Startup: GA511 Smart Wizard Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

Rien d'alarmant non ?

Mon rapport FixWareout :

Username "Jonathan" - 2008-10-21 22:22:32 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Cache de résolution DNS vidé.


System was rebooted successfully. 
 
~~~~~ Postrun check 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)

....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

Et finalement mon rapport SmitfraudFix :

SmitFraudFix v2.366

Rapport fait à 23:05:30,25, 2008-10-21
Executé à partir de C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est 
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 24.200.241.37
DNS Server Search Order: 24.201.245.77
DNS Server Search Order: 24.200.243.189

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7691BF3C-58AC-47EE-AB93-C2E689EDE831}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7691BF3C-58AC-47EE-AB93-C2E689EDE831}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7691BF3C-58AC-47EE-AB93-C2E689EDE831}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS3\Services\Tcpip\..\{7691BF3C-58AC-47EE-AB93-C2E689EDE831}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189

»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 24.200.241.37
DNS Server Search Order: 24.201.245.77
DNS Server Search Order: 24.200.243.189

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7691BF3C-58AC-47EE-AB93-C2E689EDE831}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7691BF3C-58AC-47EE-AB93-C2E689EDE831}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7691BF3C-58AC-47EE-AB93-C2E689EDE831}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS3\Services\Tcpip\..\{7691BF3C-58AC-47EE-AB93-C2E689EDE831}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189

Après des recherches j'ai trouver les IP de redirection qui mène, devinez ou ? 

IP Adress : 64.111.196.126
Country : UNITED STATES
Latitude/Longitude : 38.9048/-77.0354
Time Zone : -05:00
Domain : ISPRIME.COM
ISP : ISPRIME INC
IDD Code : 1
Weather Station : USDC0001 - WASHINGTON

Voila si quelqu'un peux m'aider S.V.P. ça serait bien !

P.S. : Mon PC à une lenteur internet incoyable depuis ce problème.

Destrio5 · Answer

Salut,

Pour avancer jlpjlp,

---> Télécharge SDFix (créé par AndyManchesta) sur ton Bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
- Double-clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. 
- Redémarre ton ordinateur en mode sans échec.

---> Pour redémarrer en mode sans échec :
- Redémarre ton PC.
- Au démarrage, tapote sur F8 (F5 sur certains PC) juste après l'affichage du BIOS et juste avant le chargement de Windows.
- Dans le menu d'options avancées, choisis Mode sans échec.
- Choisis ton compte.

---> Déroule la liste des instructions ci-dessous :
- Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double-clique sur RunThis.bat pour lancer le script.
- Appuie sur Y pour commencer le processus de nettoyage.
- Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
- Appuie sur une touche pour redémarrer le PC.
- Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
- Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
- Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
- Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
- Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse.

Destrio5 · Answer

---> Fais un scan avec Antivir comme jlpjlp le demande (poste le rapport).

jlpjlp · Answer

slt destrio5 
merci d'être passé

josnaker · Answer

Avira AntiVir Personal
Report file date: 22 octobre, 2008  22:10

Scanning for 1704573 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 3)  [5.1.2600]
Boot mode:        Normally booted
Username:         Jonathan
Computer name:    JONATHAN-U2KZFI

Version information:
BUILD.DAT     : 8.1.0.331      16934 Bytes  12/08/2008 11:46:00
AVSCAN.EXE    : 8.1.4.7       315649 Bytes  26/06/2008 14:57:53
AVSCAN.DLL    : 8.1.4.0        40705 Bytes  26/05/2008 13:56:40
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 18:44:19
LUKERES.DLL   : 8.1.4.0        12033 Bytes  26/05/2008 13:58:52
ANTIVIR0.VDF  : 6.40.0.0    11030528 Bytes  18/07/2007 16:33:34
ANTIVIR1.VDF  : 7.0.5.1      8182784 Bytes  24/06/2008 19:54:15
ANTIVIR2.VDF  : 7.0.7.59     4366336 Bytes  19/10/2008 01:48:45
ANTIVIR3.VDF  : 7.0.7.75      148480 Bytes  22/10/2008 01:48:46
Engineversion : 8.2.0.5   
AEVDF.DLL     : 8.1.0.6       102772 Bytes  23/10/2008 01:48:58
AESCRIPT.DLL  : 8.1.1.9       319867 Bytes  23/10/2008 01:48:57
AESCN.DLL     : 8.1.1.3       123252 Bytes  23/10/2008 01:48:56
AERDL.DLL     : 8.1.1.2       438644 Bytes  23/10/2008 01:48:55
AEPACK.DLL    : 8.1.2.4       369014 Bytes  23/10/2008 01:48:54
AEOFFICE.DLL  : 8.1.0.28      196987 Bytes  23/10/2008 01:48:53
AEHEUR.DLL    : 8.1.0.59     1438071 Bytes  23/10/2008 01:48:52
AEHELP.DLL    : 8.1.1.2       115062 Bytes  23/10/2008 01:48:50
AEGEN.DLL     : 8.1.0.41      319861 Bytes  23/10/2008 01:48:50
AEEMU.DLL     : 8.1.0.9       393588 Bytes  23/10/2008 01:48:49
AECORE.DLL    : 8.1.2.6       172406 Bytes  23/10/2008 01:48:48
AEBB.DLL      : 8.1.0.3        53618 Bytes  23/10/2008 01:48:47
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 14:40:05
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 15:28:01
AVREP.DLL     : 8.0.0.2        98344 Bytes  23/10/2008 01:48:46
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 17:26:40
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 14:29:23
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 18:27:49
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 23:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 18:49:40
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 18:05:10
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  12/06/2008 19:48:07
RCTEXT.DLL    : 8.0.52.0       86273 Bytes  27/06/2008 19:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, 
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 22 octobre, 2008  22:10

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'opera.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'GA511.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'soundman.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'winvnc4.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
26 processes with 26 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!
Master boot sector HD1
    [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!
Boot sector 'D:\'
    [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '53' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau2d2.dll
    [DETECTION] Is the TR/Peed.B.7 Trojan
    [NOTE]      The file was moved to '4963de29.qua'!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\R2Map.dgl
    [DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
    [NOTE]      The file was moved to '494cde35.qua'!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4	emporary_download\C3PO.zip
    [0] Archive type: ZIP
    --> R2Map.dgl
      [DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
    --> r2d2.dll
      [DETECTION] Is the TR/Peed.B.7 Trojan
    [NOTE]      The file was moved to '494fdeeb.qua'!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4	emporary_download\D2BSInstaller.zip
    [0] Archive type: ZIP
    --> D2BSInstaller/Scripts/AutoD2BS/AutoD2BS.exe
      [DETECTION] Is the TR/Midgare.mxm.2 Trojan
    --> D2BSInstaller/Scripts/EMB/D2BS.exe
      [DETECTION] Is the TR/Hijacker.Gen Trojan
    --> D2BSInstaller/Scripts/YADB/scripts/AutoD2BS.exe
      [DETECTION] Is the TR/Midgare.mxm.2 Trojan
    [NOTE]      The file was moved to '4941def8.qua'!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4	emporary_download\SmitfraudFix.exe
    [DETECTION] Contains recognition pattern of the DR/Tool.Reboot.F.173 dropper
    [WARNING]   The file was ignored!
C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4	emporary_download\VersionHack.zip
    [0] Archive type: ZIP
    --> d2loader.exe
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was moved to '4971df70.qua'!
C:\Program Files\Rockstar Games\GTA San Andreas\gta_sa_dll.exe
    [DETECTION] Is the TR/Armin.I Trojan
    [WARNING]   The file was ignored!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\AJHI.007.vir
    [DETECTION] Is the TR/Keylog.Ardamax.NAF Trojan
    [NOTE]      The file was moved to '4947e2ce.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\AJHI.exe.vir
    [DETECTION] Is the TR/Spy.Ardamax.J Trojan
    [NOTE]      The file was moved to '4947e2d2.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\AKV.exe.vir
    [DETECTION] Is the TR/Spy.Ardamax.A.1 Trojan
    [NOTE]      The file was moved to '4955e2d5.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\IUCB.006.vir
    [DETECTION] Is the TR/Keylog.Ardamax.NAJ.1 Trojan
    [NOTE]      The file was moved to '4942e2e1.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\IUCB.007.vir
    [DETECTION] Is the TR/Keylog.Ardamax.NAJ.2 Trojan
    [NOTE]      The file was moved to '4942e2e3.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\IUCB.exe.vir
    [DETECTION] Is the TR/Spy.Ardamax.J Trojan
    [NOTE]      The file was moved to '4942e2e5.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\NYFC.007.vir
    [DETECTION] Is the TR/Keylog.Ardamax.NAF Trojan
    [NOTE]      The file was moved to '4945e2ea.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\28463\NYFC.exe.vir
    [DETECTION] Is the TR/Spy.Ardamax.J Trojan
    [NOTE]      The file was moved to '4945e2ec.qua'!
C:\SDFix\backups\catchme.zip
    [0] Archive type: ZIP
    --> TDSSmaxt.sys
      [DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.ats back-door program
    --> TDSSmaxt.sys.1
      [DETECTION] Is the TR/Trash.Gen Trojan
    --> TDSSofxh.dll
      [DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.acx back-door program
    --> TDSSnrsr.dll
      [DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.adb back-door program
    --> TDSSriqp.dll
      [DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.acs back-door program
    --> TDSScfum.dll
      [DETECTION] Is the TR/FakeAV.1.Gen.67 Trojan
    [WARNING]   The file was ignored!
C:\WINDOWS\system32\fwlhncot.dll
    [DETECTION] Is the TR/Crypt.Morphine.Gen Trojan
    [NOTE]      The file was moved to '496befee.qua'!
C:\WINDOWS\system32\leyybnyr.exe
    [DETECTION] Is the TR/QLowZones.S Trojan
    [NOTE]      The file was moved to '4978efe9.qua'!
C:\WINDOWS\system32\wini10804.exe
    [DETECTION] Is the TR/Fakealert.QE Trojan
    [NOTE]      The file was moved to '496df01e.qua'!
C:\WINDOWS\system32\wiwvunsk.exe
    [DETECTION] Is the TR/QLowZones.S Trojan
    [NOTE]      The file was moved to '4976f01f.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
    [WARNING]   The file could not be opened!
Begin scan in 'D:\'
D:\Documents and Settings\Jonathan\Mes documents\Diablo 2\D2BS\Scripts\AutoD2BS\AutoD2BS.exe
    [DETECTION] Is the TR/Midgare.mxm.2 Trojan
    [NOTE]      The file was moved to '4973f2c8.qua'!
D:\Documents and Settings\Jonathan\Mes documents\Diablo 2\D2BS\Scripts\EMB\D2BS.exe
    [DETECTION] Is the TR/Hijacker.Gen Trojan
    [NOTE]      The file was moved to '4941f285.qua'!
D:\Documents and Settings\Jonathan\Mes documents\Diablo 2\D2BS\Scripts\YADB\scripts\AutoD2BS.exe
    [DETECTION] Is the TR/Midgare.mxm.2 Trojan
    [NOTE]      The file was moved to '4973f2cb.qua'!
D:\Documents and Settings\Jonathan\Mes documents\Diablo 2\Edge of Nowhere\D2BSInstaller.zip
    [0] Archive type: ZIP
    --> D2BSInstaller/Scripts/AutoD2BS/AutoD2BS.exe
      [DETECTION] Is the TR/Midgare.mxm.2 Trojan
    --> D2BSInstaller/Scripts/EMB/D2BS.exe
      [DETECTION] Is the TR/Hijacker.Gen Trojan
    --> D2BSInstaller/Scripts/YADB/scripts/AutoD2BS.exe
      [DETECTION] Is the TR/Midgare.mxm.2 Trojan
    [NOTE]      The file was moved to '4941f28a.qua'!
D:\Documents and Settings\Jonathan\Mes documents\Fruity Loops Studio 8.0 Full Producers Edition\fruityloops.studio.producer.edition.xxl.v8.0.0.EXE
    [0] Archive type: RSRC
      --> Object
        [1] Archive type: CAB (Microsoft)
        --> FRUITY~1.EXE
          [DETECTION] Is the TR/Agent.74081.A Trojan
    [NOTE]      The file was moved to '4974f2d0.qua'!


End of the scan: 22 octobre, 2008  23:49
Used time:  1:38:35 Hour(s)

The scan has been done completely.

   7218 Scanning directories
 346822 Files were scanned
     35 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     22 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 346785 Files not concerned
   3108 Archives were scanned
      5 Warnings
     22 Notes

jlpjlp · Answer

ok vire ce qui est en quarantaine dans antivir

_________

vire ce qui est dans le dossier quarantine et backups en allant dans poste de travail puis: 

C:\QooBox\Quarantine

C:\SDFix\backups


____________

recolle un rapport antivir et dis tes soucis actuels

josnaker · Answer

Pour l'instant aucun soucis a l'horizon. Le posterai le rapport dès que j'ai le temps necessaire. ( C'est quand même assez long )

josnaker · Answer

Meme rapport que l'autre. Le virus revient lorsque je redémarre mon PC.
- Redirection Goole
- PC Ralenti
- Gèle souvent ( Besoin d'un redémarrage )

jlpjlp · Answer

remet un rapport combofix et hijackhtis

josnaker · Answer

ComboFix 08-08-13.01 - Jonathan 2008-10-24 13:23:02.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.65 [GMT -4:00]
Endroit: C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\ComboFix-Must Have-Windows spyware-Antivires-Smitfraud-Virtuemoddll-Vundo- Remover-www.PcHurricane.com-\ComboFix-www.PcHurricane.com-.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
- FONCTIONNALITES REDUITES -
.

((((((((((((((((((((((((((((( Fichiers créés 2008-09-24 to 2008-10-24 ))))))))))))))))))))))))))))))))))))
.

2008-10-24 11:41 . 2008-10-24 11:41 <REP> d-------- C:\Program Files\ElcomSoft
2008-10-24 11:41 . 2008-10-24 11:42 1,158 --a------ C:\WINDOWS\AZPR3.INI
2008-10-24 11:19 . 2008-10-15 12:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-24 10:56 . 2008-10-24 10:56 0 --a------ C:\WINDOWS\nsreg.dat
2008-10-24 10:51 . 2008-10-24 11:15 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-10-23 23:37 . 2008-10-23 23:37 <REP> d-------- C:\Program Files\Avira
2008-10-23 18:22 . 2008-10-23 18:22 <REP> d-------- C:\Program Files\Zone Labs
2008-10-23 18:21 . 2008-10-24 10:45 <REP> d-------- C:\WINDOWS\Internet Logs
2008-10-22 22:10 . 2008-10-22 22:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AntiVir PersonalEdition Classic
2008-10-22 21:59 . 2008-10-22 21:59 579,584 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-10-22 21:58 . 2008-10-22 21:58 <REP> d-------- C:\WINDOWS\ERUNT
2008-10-22 21:54 . 2008-10-24 11:18 <REP> d-------- C:\SDFix
2008-10-22 21:46 . 2008-10-22 21:46 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Avira
2008-10-21 22:47 . 2008-10-23 18:36 800 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-21 22:32 . 2008-10-21 22:32 <REP> d-------- C:\Program Files\Trend Micro
2008-10-21 22:21 . 2008-10-23 23:34 <REP> d-------- C:\fixwareout
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 12:10 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 12:03 . 2008-10-18 12:03 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\SmitfraudFix
2008-10-17 23:42 . 2008-10-17 23:42 41,984 --a------ C:\WINDOWS\system32\av.dat
2008-10-16 13:54 . 2008-10-16 13:56 <REP> d-------- C:\KillerJohn's TurboT v8.0
2008-10-16 03:03 . 2008-10-16 03:03 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-10-15 17:12 . 2008-10-23 17:56 <REP> d-------- C:\Program Files\Image-Line
2008-10-15 16:36 . 2008-08-14 09:23 2,191,232 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,068,096 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 16:36 . 2008-09-15 11:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 16:36 . 2008-09-08 06:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 07:36 . 2008-10-24 11:54 <REP> d-------- C:\Program Files\Magnum
2008-10-13 15:24 . 2008-10-13 15:24 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
2008-10-13 12:17 . 2008-10-13 12:17 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-12 23:41 . 2008-10-12 23:51 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NexonUS
2008-10-12 17:10 . 2008-10-15 07:36 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Media Player Classic
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Media Player Classic
2008-09-27 17:27 . 2008-09-27 17:29 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Tracing
2008-09-27 17:15 . 2008-09-27 17:15 <REP> d-------- C:\Program Files\Fichiers communs\Windows Live
2008-09-27 15:42 . 2008-09-27 15:43 <REP> d-------- C:\Documents and Settings\Denise et Jean\Application Data\Winamp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-23 22:32 33,280 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-10-23 22:30 34,304 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-10-23 21:57 --------- d-----w C:\Program Files\StealthBot
2008-10-21 21:41 30 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\jagex_runescape_preferences.dat
2008-10-13 14:29 --------- d-----w C:\Program Files\Opera
2008-10-13 01:58 --------- d---a-w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2008-10-10 12:58 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-10-10 12:58 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-10-01 19:51 87,552 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-09-27 21:36 --------- d-----w C:\Program Files\Windows Live
2008-09-27 21:35 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
2008-09-25 05:00 856,064 ----a-w C:\WINDOWS\system32\JS32.dll
2008-09-20 01:44 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\ViStart
2008-09-20 01:44 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\ViStart
2008-09-20 00:55 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-20 00:42 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-09-20 00:42 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2008-09-20 00:35 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Hamachi
2008-09-20 00:35 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Hamachi
2008-09-20 00:26 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-09-19 23:16 --------- d-----w C:\Program Files\Microsoft SDKs
2008-09-16 21:26 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Audacity
2008-09-16 21:26 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Audacity
2008-09-16 10:12 35 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
2008-09-15 15:26 1,846,528 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-14 21:38 34 ----a-w C:\Documents and Settings\Denise et Jean\ScreenSize.bat
2008-09-14 21:35 45,056 ----a-w C:\vidchng.exe
2008-09-09 03:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-05 02:14 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\SmartFTP
2008-09-05 02:14 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\SmartFTP
2008-09-03 17:26 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-09-02 09:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 09:40 --------- d-----w C:\Program Files\Rockstar Games
2008-09-01 02:55 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Musicnotes
2008-08-27 00:01 --------- d-----w C:\Program Files\Web Publish
2008-08-26 08:11 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-24 20:41 --------- d-----w C:\Program Files\RealVNC
2008-08-18 16:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-08-14 13:23 2,191,232 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:23 2,068,096 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-12 03:52 0 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\links.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 22:33 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-11-17 17:29 7700480]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-11-17 17:29 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"nwiz"="nwiz.exe" [2006-11-17 17:29 1622016 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]

C:\Documents and Settings\Denise et Jean\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Denise et Jean\ScreenSize.bat [2008-09-14 17:38:37 34]

C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 17:38:58 35]

C:\DOCUME~1\ALLUSE~1.WIN\MENUDM~1\PROGRA~1\DMARRA~1\
GA511 Smart Wizard Utility.lnk - C:\WINDOWS\Installer\{52CAD7C7-1E41-43FE-8613-AB9D79B2DBBC}\NewShortcut1.exe [2008-08-12 11:12:16 40960]

C:\DOCUME~1\JONATH~1.JON\MENUDM~1\PROGRA~1\DMARRA~1\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 17:38:58 35]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\webface\\TurboTwebface.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\bluevex\\rvx.exe"=
"D:\\Program Files\\Diablo II\\RedVex3\\RedVex3.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Windows Live\\Copie de Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\Magnum\\eMule0.49b\\eMule0.49b\\emule.exe"=

R3 dfmirage;dfmirage;C:\WINDOWS\system32\DRIVERS\dfmirage.sys [2005-11-25 17:43]
S3 Diag69xp;Diag69xp;C:\WINDOWS\system32\Drivers\Diag69xp.sys [2006-11-28 11:48]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-07-25 20:57]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10]
S4 echovnc-service;echovnc-service;C:\Program Files\EchoVNC\winvnc.exe []
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DAEMON Tools Lite - C:\Program Files\DAEMON Tools Lite\daemon.exe

.
------- Supplementary Scan -------
.

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_3_0.cab
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-24 13:23:44
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys)]
"imagepath"="\systemroot\system32\drivers\TDSSpqxt.sys"
.
Temps d'accomplissement: 2008-10-24 13:25:16
ComboFix-quarantined-files.txt 2008-10-24 17:25:08

Pre-Run: 29,311,426,560 octets libres
Post-Run: 29,313,351,680 octets libres

171 --- E O F --- 2008-10-24 15:22:25

________________________________________________________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:59:29, on 2008-10-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Raccourci vers ScreenSize.lnk = C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
O4 - Global Startup: GA511 Smart Wizard Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

jlpjlp · Answer

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :



File::
C:\WINDOWS\system32\drivers\TDSSmaxt.sys 
C:\WINDOWS\system32\TDSSofxh.dll 
C:\WINDOWS\system32\TDSSnrsr.dll 
C:\WINDOWS\system32\TDSSriqp.dll 
C:\WINDOWS\system32\TDSScfum.dll 
C:\WINDOWS\system32\TDSSlxwp.dll 
C:\WINDOWS\system32\TDSSrhym.dll 
C:\WINDOWS\system32\PfModNT.sys 
C:\WINDOWS\system32\drivers	dssserv.sys 
C:\WINDOWS\system32	dssadw.dll 
C:\WINDOWS\system32	dssinit.dll 
C:\WINDOWS\system32	dssl.dll 
C:\WINDOWS\system32	dsslog.dll 
C:\WINDOWS\system32	dssmain.dll 
C:\WINDOWS\system32	dssserf.dll 
C:\WINDOWS\system32	dssservers.dat 
C:\WINDOWS\Temp	dss13b9.tmp
C:\WINDOWS\Temp	dss1530.tmp 
C:\WINDOWS\Temp	dss16b6.tmp 

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys)]
"imagepath"=-


Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

. 
_______________


scan avec ceci: ensuite
https://downloads.exterminate-it.com/install/ExterminateItSetup.exe

josnaker · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:04:21, on 2008-10-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Raccourci vers ScreenSize.lnk = C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
O4 - Global Startup: GA511 Smart Wizard Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

jlpjlp · Answer

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :




drivers::
TDSSserv
TDSSmaxt



Registry:: 
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys)]
"imagepath"="\systemroot\system32\drivers\TDSSpqxt.sys"


Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt 


________________


installe  malwarebyte et colle nous un  rapport:

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

josnaker · Answer

ComboFix 08-08-13.01 - Jonathan 2008-10-24 13:23:02.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.65 [GMT -4:00]
Endroit: C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Bureau\ComboFix-Must Have-Windows spyware-Antivires-Smitfraud-Virtuemoddll-Vundo- Remover-www.PcHurricane.com-\ComboFix-www.PcHurricane.com-.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
- FONCTIONNALITES REDUITES -
.

((((((((((((((((((((((((((((( Fichiers créés 2008-09-24 to 2008-10-24 ))))))))))))))))))))))))))))))))))))
.

2008-10-24 11:41 . 2008-10-24 11:41 <REP> d-------- C:\Program Files\ElcomSoft
2008-10-24 11:41 . 2008-10-24 11:42 1,158 --a------ C:\WINDOWS\AZPR3.INI
2008-10-24 11:19 . 2008-10-15 12:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-24 10:56 . 2008-10-24 10:56 0 --a------ C:\WINDOWS\nsreg.dat
2008-10-24 10:51 . 2008-10-24 11:15 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-10-23 23:37 . 2008-10-23 23:37 <REP> d-------- C:\Program Files\Avira
2008-10-23 18:22 . 2008-10-23 18:22 <REP> d-------- C:\Program Files\Zone Labs
2008-10-23 18:21 . 2008-10-24 10:45 <REP> d-------- C:\WINDOWS\Internet Logs
2008-10-22 22:10 . 2008-10-22 22:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AntiVir PersonalEdition Classic
2008-10-22 21:59 . 2008-10-22 21:59 579,584 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-10-22 21:58 . 2008-10-22 21:58 <REP> d-------- C:\WINDOWS\ERUNT
2008-10-22 21:54 . 2008-10-24 11:18 <REP> d-------- C:\SDFix
2008-10-22 21:46 . 2008-10-22 21:46 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Avira
2008-10-21 22:47 . 2008-10-23 18:36 800 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-21 22:32 . 2008-10-21 22:32 <REP> d-------- C:\Program Files\Trend Micro
2008-10-21 22:21 . 2008-10-23 23:34 <REP> d-------- C:\fixwareout
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 12:10 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 12:03 . 2008-10-18 12:03 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\SmitfraudFix
2008-10-17 23:42 . 2008-10-17 23:42 41,984 --a------ C:\WINDOWS\system32\av.dat
2008-10-16 13:54 . 2008-10-16 13:56 <REP> d-------- C:\KillerJohn's TurboT v8.0
2008-10-16 03:03 . 2008-10-16 03:03 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-10-15 17:12 . 2008-10-23 17:56 <REP> d-------- C:\Program Files\Image-Line
2008-10-15 16:36 . 2008-08-14 09:23 2,191,232 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,068,096 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 16:36 . 2008-09-15 11:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 16:36 . 2008-09-08 06:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 07:36 . 2008-10-24 11:54 <REP> d-------- C:\Program Files\Magnum
2008-10-13 15:24 . 2008-10-13 15:24 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
2008-10-13 12:17 . 2008-10-13 12:17 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-12 23:41 . 2008-10-12 23:51 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NexonUS
2008-10-12 17:10 . 2008-10-15 07:36 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Media Player Classic
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Media Player Classic
2008-09-27 17:27 . 2008-09-27 17:29 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Tracing
2008-09-27 17:15 . 2008-09-27 17:15 <REP> d-------- C:\Program Files\Fichiers communs\Windows Live
2008-09-27 15:42 . 2008-09-27 15:43 <REP> d-------- C:\Documents and Settings\Denise et Jean\Application Data\Winamp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-23 22:32 33,280 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-10-23 22:30 34,304 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-10-23 21:57 --------- d-----w C:\Program Files\StealthBot
2008-10-21 21:41 30 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\jagex_runescape_preferences.dat
2008-10-13 14:29 --------- d-----w C:\Program Files\Opera
2008-10-13 01:58 --------- d---a-w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2008-10-10 12:58 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-10-10 12:58 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-10-01 19:51 87,552 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-09-27 21:36 --------- d-----w C:\Program Files\Windows Live
2008-09-27 21:35 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
2008-09-25 05:00 856,064 ----a-w C:\WINDOWS\system32\JS32.dll
2008-09-20 01:44 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\ViStart
2008-09-20 01:44 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\ViStart
2008-09-20 00:55 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-20 00:42 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-09-20 00:42 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2008-09-20 00:35 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Hamachi
2008-09-20 00:35 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Hamachi
2008-09-20 00:26 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-09-19 23:16 --------- d-----w C:\Program Files\Microsoft SDKs
2008-09-16 21:26 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Audacity
2008-09-16 21:26 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Audacity
2008-09-16 10:12 35 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
2008-09-15 15:26 1,846,528 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-14 21:38 34 ----a-w C:\Documents and Settings\Denise et Jean\ScreenSize.bat
2008-09-14 21:35 45,056 ----a-w C:\vidchng.exe
2008-09-09 03:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-05 02:14 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\SmartFTP
2008-09-05 02:14 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\SmartFTP
2008-09-03 17:26 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-09-02 09:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 09:40 --------- d-----w C:\Program Files\Rockstar Games
2008-09-01 02:55 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Musicnotes
2008-08-27 00:01 --------- d-----w C:\Program Files\Web Publish
2008-08-26 08:11 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-24 20:41 --------- d-----w C:\Program Files\RealVNC
2008-08-18 16:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-08-14 13:23 2,191,232 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:23 2,068,096 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-12 03:52 0 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\links.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 22:33 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-11-17 17:29 7700480]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-11-17 17:29 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"nwiz"="nwiz.exe" [2006-11-17 17:29 1622016 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]

C:\Documents and Settings\Denise et Jean\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Denise et Jean\ScreenSize.bat [2008-09-14 17:38:37 34]

C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 17:38:58 35]

C:\DOCUME~1\ALLUSE~1.WIN\MENUDM~1\PROGRA~1\DMARRA~1\
GA511 Smart Wizard Utility.lnk - C:\WINDOWS\Installer\{52CAD7C7-1E41-43FE-8613-AB9D79B2DBBC}\NewShortcut1.exe [2008-08-12 11:12:16 40960]

C:\DOCUME~1\JONATH~1.JON\MENUDM~1\PROGRA~1\DMARRA~1\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 17:38:58 35]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\webface\\TurboTwebface.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\bluevex\\rvx.exe"=
"D:\\Program Files\\Diablo II\\RedVex3\\RedVex3.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Windows Live\\Copie de Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\Magnum\\eMule0.49b\\eMule0.49b\\emule.exe"=

R3 dfmirage;dfmirage;C:\WINDOWS\system32\DRIVERS\dfmirage.sys [2005-11-25 17:43]
S3 Diag69xp;Diag69xp;C:\WINDOWS\system32\Drivers\Diag69xp.sys [2006-11-28 11:48]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-07-25 20:57]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10]
S4 echovnc-service;echovnc-service;C:\Program Files\EchoVNC\winvnc.exe []
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DAEMON Tools Lite - C:\Program Files\DAEMON Tools Lite\daemon.exe

.
------- Supplementary Scan -------
.

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_3_0.cab
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-24 13:23:44
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys)]
"imagepath"="\systemroot\system32\drivers\TDSSpqxt.sys"
.
Temps d'accomplissement: 2008-10-24 13:25:16
ComboFix-quarantined-files.txt 2008-10-24 17:25:08

Pre-Run: 29,311,426,560 octets libres
Post-Run: 29,313,351,680 octets libres

171 --- E O F --- 2008-10-24 15:22:25

________________________________________________________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:59:29, on 2008-10-24
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Raccourci vers ScreenSize.lnk = C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
O4 - Global Startup: GA511 Smart Wizard Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

jlpjlp · Answer

slt

et merci lyonnais92 ...


le gros souci en fait c'est que tu n'as pas fais ce qui a été demandé ! tu as gardé un combofix que tu avais qui n'est pas a jour depuis aout 2008!!!!!

vire le et télécharge la derniere version en suivant le lien déjà donné et colle le rapport

josnaker · Answer

Je ne peux pas télécharger combofix au lien que tu m'as envoyé. La page s'ouvre blanche et rien le charge.
Lorsque je ping bleepingcomputer.com, ça ma donne l'ip : 127.0.0.1 ce qui est localhost... Surement rapport avec le virus. Il me faudrai quelqu'un pour l'uploader sur rapidshare par exemple.

josnaker · Answer

ComboFix 08-10-24.02 - Jonathan 2008-10-25 19:18:58.5 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.17 [GMT -4:00]

[COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\TDSSpqxt.sys
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\TDSSbivk.log
C:\WINDOWS\system32\TDSSciou.dll
C:\WINDOWS\system32\TDSSfpmp.dll
C:\WINDOWS\system32\TDSSliqp.dll
C:\WINDOWS\system32\TDSSnrse.dll
C:\WINDOWS\system32\TDSSoiqh.dll
C:\WINDOWS\system32\TDSSosvn.dat
C:\WINDOWS\system32\TDSSsbhc.log
C:\WINDOWS\system32\TDSSthym.dll
C:\WINDOWS\system32\TDSStkdv.dll
C:\WINDOWS\system32\TDSSvvbi.log

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv
-------\Legacy_TDSSserv
-------\Legacy_NPF
-------\Service_NPF

((((((((((((((((((((((((((((( Fichiers créés du 2008-09-25 au 2008-10-25 ))))))))))))))))))))))))))))))))))))
.

2008-10-25 19:16 . 2008-10-25 19:30 135,200 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-25 19:16 . 2008-10-25 19:24 3,608 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-25 19:06 . 2008-10-25 19:10 <REP> d-------- C:\CF148185
2008-10-24 22:58 . 2008-10-24 22:58 <REP> d-------- C:\CF14818
2008-10-24 13:20 . 2008-10-24 13:25 <REP> d-------- C:\ComboFix-www.PcHurricane.com-
2008-10-24 11:41 . 2008-10-24 11:41 <REP> d-------- C:\Program Files\ElcomSoft
2008-10-24 11:41 . 2008-10-24 11:42 1,158 --a------ C:\WINDOWS\AZPR3.INI
2008-10-24 11:19 . 2008-10-15 12:35 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-24 10:56 . 2008-10-24 10:56 0 --a------ C:\WINDOWS\nsreg.dat
2008-10-24 10:51 . 2008-10-25 19:17 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-10-23 23:37 . 2008-10-23 23:37 <REP> d-------- C:\Program Files\Avira
2008-10-23 18:22 . 2008-10-23 18:22 <REP> d-------- C:\WINDOWS\system32\ZoneLabs
2008-10-23 18:22 . 2008-10-23 18:22 <REP> d-------- C:\Program Files\Zone Labs
2008-10-23 18:22 . 2008-07-09 09:05 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2008-10-23 18:22 . 2008-10-25 19:25 352,917 --a------ C:\WINDOWS\system32\vsconfig.xml
2008-10-23 18:21 . 2008-10-25 19:24 <REP> d-------- C:\WINDOWS\Internet Logs
2008-10-22 22:10 . 2008-10-22 22:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\AntiVir PersonalEdition Classic
2008-10-22 21:59 . 2008-10-22 21:59 579,584 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-10-22 21:58 . 2008-10-22 21:58 <REP> d-------- C:\WINDOWS\ERUNT
2008-10-22 21:54 . 2008-10-24 11:18 <REP> d-------- C:\SDFix
2008-10-22 21:46 . 2008-10-22 21:46 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Avira
2008-10-21 22:47 . 2008-10-23 18:36 800 --a------ C:\WINDOWS\system32\tmp.reg
2008-10-21 22:46 . 2008-10-24 11:06 <REP> d-------- C:\SmitfraudFix
2008-10-21 22:46 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-10-21 22:46 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-10-21 22:46 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-10-21 22:46 . 2008-10-01 15:51 87,552 --a------ C:\WINDOWS\system32\VACFix.exe
2008-10-21 22:46 . 2008-10-10 08:58 82,944 --a------ C:\WINDOWS\system32\o4Patch.exe
2008-10-21 22:46 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-10-21 22:46 . 2008-10-10 08:58 82,944 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-10-21 22:46 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-10-21 22:46 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-10-21 22:46 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-10-21 22:46 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-10-21 22:32 . 2008-10-21 22:32 <REP> d-------- C:\Program Files\Trend Micro
2008-10-21 22:21 . 2008-10-23 23:34 <REP> d-------- C:\fixwareout
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-10-18 12:10 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Malwarebytes
2008-10-18 12:10 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-18 12:10 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 12:03 . 2008-10-18 12:03 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\SmitfraudFix
2008-10-17 23:42 . 2008-10-17 23:42 41,984 --a------ C:\WINDOWS\system32\av.dat
2008-10-17 23:42 . 2008-10-22 12:15 164 --a------ C:\WINDOWS\system32\TDSSosvd.dat
2008-10-16 13:54 . 2008-10-16 13:56 <REP> d-------- C:\KillerJohn's TurboT v8.0
2008-10-16 03:03 . 2008-10-16 03:03 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-10-15 17:12 . 2008-10-23 17:56 <REP> d-------- C:\Program Files\Image-Line
2008-10-15 16:36 . 2008-08-14 09:23 2,191,232 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,068,096 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 16:36 . 2008-08-14 09:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 16:36 . 2008-09-15 11:26 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 16:36 . 2008-09-08 06:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 07:36 . 2008-10-24 11:54 <REP> d-------- C:\Program Files\Magnum
2008-10-13 15:24 . 2008-10-13 15:24 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Messenger Plus!
2008-10-13 12:17 . 2008-10-13 12:17 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-10-12 23:41 . 2008-10-12 23:51 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\NexonUS
2008-10-12 17:10 . 2008-10-15 07:36 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Media Player Classic
2008-09-30 08:07 . 2008-09-30 08:08 <REP> d-------- C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Media Player Classic
2008-09-27 17:27 . 2008-09-27 17:29 <REP> d-------- C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Tracing
2008-09-27 17:15 . 2008-09-27 17:15 <REP> d-------- C:\Program Files\Fichiers communs\Windows Live
2008-09-27 15:42 . 2008-09-27 15:43 <REP> d-------- C:\Documents and Settings\Denise et Jean\Application Data\Winamp

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-25 23:16 694,123 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-10-25 23:15 191,488 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-10-25 03:08 --------- d-----w C:\Program Files\ma-config.com
2008-10-25 03:08 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ma-config.com
2008-10-23 22:32 33,280 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-10-23 22:30 34,304 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-10-23 21:57 --------- d-----w C:\Program Files\StealthBot
2008-10-21 21:41 30 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\jagex_runescape_preferences.dat
2008-10-13 14:29 --------- d-----w C:\Program Files\Opera
2008-10-13 01:58 --------- d---a-w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\TEMP
2008-09-27 21:36 --------- d-----w C:\Program Files\Windows Live
2008-09-27 21:35 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\WLInstaller
2008-09-25 05:00 856,064 ----a-w C:\WINDOWS\system32\JS32.dll
2008-09-20 01:44 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\ViStart
2008-09-20 01:44 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\ViStart
2008-09-20 00:55 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-20 00:42 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2008-09-20 00:42 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Microsoft Help
2008-09-20 00:35 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Hamachi
2008-09-20 00:35 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Hamachi
2008-09-20 00:26 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-09-19 23:16 --------- d-----w C:\Program Files\Microsoft SDKs
2008-09-16 21:26 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\Audacity
2008-09-16 21:26 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\Audacity
2008-09-16 10:12 35 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat
2008-09-15 15:26 1,846,528 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-14 21:38 34 ----a-w C:\Documents and Settings\Denise et Jean\ScreenSize.bat
2008-09-14 21:35 45,056 ----a-w C:\vidchng.exe
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-05 02:14 --------- d-----w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Application Data\SmartFTP
2008-09-05 02:14 --------- d-----w C:\DOCUME~1\JONATH~1.JON\APPLIC~1\SmartFTP
2008-09-03 17:26 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-09-02 09:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-02 09:40 --------- d-----w C:\Program Files\Rockstar Games
2008-09-01 02:55 --------- d-----w C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Musicnotes
2008-08-27 00:01 --------- d-----w C:\Program Files\Web Publish
2008-08-26 08:11 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-14 13:23 2,191,232 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:23 2,068,096 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-12 03:52 0 ----a-w C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\links.dat
.

((((((((((((((((((((((((((((( snapshot@2008-10-24_13.24.35.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
- 2008-10-24 17:22:12 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-10-25 21:02:04 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-10-24 17:22:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2008-10-25 21:02:04 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2008-10-24 17:12:11 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008102420081025\index.dat
+ 2008-10-25 03:47:32 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008102420081025\index.dat
+ 2008-10-25 08:47:41 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008102520081026\index.dat
- 2008-10-24 17:22:12 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-10-25 21:02:04 49,152 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-11-17 7700480]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-11-17 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"nwiz"="nwiz.exe" [2006-11-17 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]

C:\Documents and Settings\Denise et Jean\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Denise et Jean\ScreenSize.bat [2008-09-14 34]

C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Menu D‚marrer\Programmes\D‚marrage\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 35]

C:\DOCUME~1\ALLUSE~1.WIN\MENUDM~1\PROGRA~1\DMARRA~1\
GA511 Smart Wizard Utility.lnk - C:\WINDOWS\Installer\{52CAD7C7-1E41-43FE-8613-AB9D79B2DBBC}\NewShortcut1.exe [2008-08-12 40960]

C:\DOCUME~1\JONATH~1.JON\MENUDM~1\PROGRA~1\DMARRA~1\
Raccourci vers ScreenSize.lnk - C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\ScreenSize.bat [2008-09-14 35]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\webface\\TurboTwebface.exe"=
"D:\\KillerJohn's TurboT v7.5\\modules\\bluevex\\rvx.exe"=
"D:\\Program Files\\Diablo II\\RedVex3\\RedVex3.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\Program Files\\Windows Live\\Copie de Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\Magnum\\eMule0.49b\\eMule0.49b\\emule.exe"=

R3 dfmirage;dfmirage;C:\WINDOWS\system32\DRIVERS\dfmirage.sys [2005-11-25 31896]
S3 Diag69xp;Diag69xp;C:\WINDOWS\system32\Drivers\Diag69xp.sys [2006-11-28 11237]
S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-09-02 191656]
S4 echovnc-service;echovnc-service;C:\Program Files\EchoVNC\winvnc.exe [ ]
.
.
------- Examen supplémentaire -------
.

O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_3_0.cab
C:\WINDOWS\Downloaded Program Files\hardwaredetection.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-25 19:26:21
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\NETGEAR GA511 Adapter\GA511.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
.
**************************************************************************
.
Heure de fin: 2008-10-25 19:33:19 - La machine a redémarré [Jonathan]
ComboFix-quarantined-files.txt 2008-10-25 23:33:08
ComboFix2.txt 2008-10-25 23:09:54
ComboFix3.txt 2008-10-25 13:26:28
ComboFix4.txt 2008-10-25 03:03:06
ComboFix5.txt 2008-10-25 23:12:24

Avant-CF: 29,249,486,848 octets libres
Après-CF: 29,234,925,568 octets libres

231 --- E O F --- 2008-10-24 15:22:25

jlpjlp · Answer

hé bien voilà!!!!!!!

quand on utilise les dernières versions!!!


encore des soucis????




merci lyonnais92  d'avoir vu cela...

josnaker · Answer

Plus de soucils pour l'instant. Je met résolus. J'ai réussit a télécharger ComboFix car j'ai scanner avec l'ancienne version, ce qui a enlevé le virus temporairement, ce qui m'a laisser la la chance de télécharger le nouveau ComboFix.
Merci a toi pour ta patience jlpjlp !

jlpjlp · Answer

ok pour virer ce qui a été utilisé


Télécharge ToolsCleaner sur ton bureau. 
-->  http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

ps : pas besoin de m´envoyer le rapport si tout a ete supprimé 






















pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

AVAST en français   ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT +/-    si tea timer non active de spybot: 
 WINDOWS    DEFENDER ou  SPYWARE TERMINATOR

+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware ont sorti de nouvelles versions cette année vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
https://forum.pcastuces.com/sujet.asp?f=25&s=35606 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus  touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/

Jason06 · Answer

arrete de cheater sur diablo 2 omfg?

je pense que ca vien de la haha rand :D

Jason06 · Answer

C:\Documents and Settings\Jonathan.JONATHAN-U2KZFI\Local Settings\Application Data\Opera\Opera\profile\cache4	emporary_download\D2BSInstaller.zip 
[0] Archive type: ZIP 
--> D2BSInstaller/Scripts/AutoD2BS/AutoD2BS.exe 
[DETECTION] Is the TR/Midgare.mxm.2 Trojan 
--> D2BSInstaller/Scripts/EMB/D2BS.exe 


espéce de cheater!

Redirection Google

26 réponses

Newsletters