Fenetres de pub......

Question

Bonjour,

Des fenetres de pub apparaissent incessemment. Hier j'ai réussi à éradiquer leprobleme en restaurant sur un point antérieur. Ce matin, les fenetres sont de retour et la lenteur aussi... Quand j'ai voulu restaurer comme hier, j'ai constaté que les points de restauration avaient disparu.....

J'ai parcouru le forum  et réussi à identifier la présence du vilain ntos.exe... Avec SDFix en suivant les conseils trouvés sur le foum je pense l'avoir dégagé.... et pourtant les fenetres reviennent et la lenteur aussi. 

A tout hasard je joins le rapport SDI ix :


[b]SDFix: Version 1.205 [/b]
Run by user on 13/07/2008 at 09:15

Microsoft Windows XP [version 5.1.2600]
Running From: C:\PROGRA~1\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\DOCUME~1\user\LOCALS~1\Tempemovalfile.bat  - Deleted
C:\WINDOWS\system32
tos.exe  - Deleted
C:\Documents and Settings\Caroline\Application Data\wsnpoem\video.dll - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll - Deleted
C:\Documents and Settings\Caroline\Application Data\wsnpoem\audio.dll - Deleted
C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll - Deleted
C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted



Folder C:\WINDOWS\system32\wsnpoem - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-13 09:25:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:36,67,8c,9f,43,9d,31,1c,79,f2,b1,5b,da,4d,9f,d6,fa,59,61,b0,1e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cc,49,68,7e,bc,c7,ef,6b,a4,df,0e,ea,d0,6c,eb,a8,c2,..
"khjeh"=hex:98,31,64,dd,32,04,be,95,09,7c,17,7f,c2,63,e7,67,2a,5b,36,d7,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:51,a3,d2,93,82,99,6a,55,29,5f,07,27,04,d3,72,09,1e,9e,22,00,82,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:36,67,8c,9f,43,9d,31,1c,79,f2,b1,5b,da,4d,9f,d6,fa,59,61,b0,1e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cc,49,68,7e,bc,c7,ef,6b,a4,df,0e,ea,d0,6c,eb,a8,c2,..
"khjeh"=hex:98,31,64,dd,32,04,be,95,09,7c,17,7f,c2,63,e7,67,2a,5b,36,d7,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:51,a3,d2,93,82,99,6a,55,29,5f,07,27,04,d3,72,09,1e,9e,22,00,82,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:36,67,8c,9f,43,9d,31,1c,79,f2,b1,5b,da,4d,9f,d6,fa,59,61,b0,1e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cc,49,68,7e,bc,c7,ef,6b,a4,df,0e,ea,d0,6c,eb,a8,c2,..
"khjeh"=hex:98,31,64,dd,32,04,be,95,09,7c,17,7f,c2,63,e7,67,2a,5b,36,d7,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:51,a3,d2,93,82,99,6a,55,29,5f,07,27,04,d3,72,09,1e,9e,22,00,82,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe"="C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:*:Enabled:Football Manager 2008"
"C:\Program Files\THQ\Frontlines-Fuel of War Demo\Binaries\FFOW-MPDemo.exe"="C:\Program Files\THQ\Frontlines-Fuel of War Demo\Binaries\FFOW-MPDemo.exe:*:Enabled:Frontlines Game"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:


File Backups: - C:\PROGRA~1\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 22 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\326d1a08fc685e3efad9e9a5b059ebfb\BIT12C.tmp"
Wed  4 Jun 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT2.tmp"
Thu 22 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5b6da8fb69b176ee583a3734e2af76e6\BIT12F.tmp"
Sun  1 Jun 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ab59ac72525ea90a47679441587835c9\BIT4.tmp"

[b]Finished![/b]

Je suis en train de scanner avec Kaspersky mais apres 30 minutes il n'a vu que 10 % du disque dur...

J'ajoute que mes deux diablotins de fils vont se faire gronder car je suis quasi certaine que le probleme vient du chargement de jeux "gratuits" qu'ils effectuent régulièrement.

Merci à tous de votre aide. Je suis désesépérée en fait...

Caro

geoffrey5 · Answer

Salut !!

Télécharger et enregistrer sur le Bureau LopSD : https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

 
= Double-clic Lop S&D 
= Faire l'installation 
Fermer toutes les applications 
= Le lancer par un double-clic sur le raccourci qui est sur le bureau 
Avec VISTA => clic-droit et => Exécuter en tant qu'administrateur 
= Taper F pour français , puis presser entrée 
= Taper 1 
= Presser Entrée 
= Le PC va redémarrer 
Note= si l'antivirus annonce une infection dans TEMP , l'ignorer 
= Attendre l'apparition du rapport 
Copier le rapport et le coller dans la réponse 
le rapport se trouve aussi à C:\lopR 
--------- 
Relancer Lop S&D 

= Choisir cette fois 2 


note: 
Si le Bureau ne réapparait pas 
= Presser Ctrl Alt Suppr 
= Dans Fichier => Nouvelle tâche 
=> Ecrire: explorer => entrée 

ensuite :

Télécharge  hijackthis : http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe 

voici un tuto pour bien l installer : https://forums.cnetfrance.fr

-une fois installé, le renommer HJT.exe pour contrer une éventuelle infection vundo
-Double-clic dessus 
- Clic sur "Do a system scan and save the log" 
- copier le rapport, le coller dans la réponse

jorginho67 · Answer

Salut !

Voyons ça....

Télécharge Hijackthis
Hijackthis (HJT) est un outil de diagnostic pour voir si tout va bien avec ton pc....


*.Enregistre HJTInstall.exe sur ton bureau
*. Double-clique sur HJTInstall.exe pour lancer le programme
*. Par défaut, il s'installera là C:\Program Files\Trend Micro\HijackThis
*. Accepte la license en cliquant sur le bouton "I Accept"
*. Choisis l'option "Do a system scan and save a log file"
*. Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
*. Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport
*. Colle le rapport que tu viens de copier sur ce forum
*. Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement

Tutoriel Générer un rapport


@+

Caro75 · Answer

Merci à vous

J'ai commencé par la proposition de Geoffrey et effectué "un LOPSD....

Voila le rapport initial :


   -----------------------[  Lop S&D 4.2.2-1  XP/Vista  ]---------------------

   [ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
   [ USER : user ] [ "C:\Lop SD" ] [ Selection : 1 ]
   [ 13/07/2008 | 10:35:21,56 ] [ PC : TOTO-2B4B14FB5B ]
   [ MAJ : 09-07-2008 | 21:02 ]
 
   -------------[ Listing des dossiers dans Application Data ]------------  

   [20/05/2008|20:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
   [20/05/2008|18:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [30/05/2008|20:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [12/07/2008|22:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [12/07/2008|22:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [02/06/2008|09:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [20/05/2008|20:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [12/06/2008|12:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log
   [12/07/2008|08:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [21/05/2008|14:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
   [09/06/2008|20:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [21/05/2008|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
   [26/05/2008|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OrbNetworks
   [02/06/2008|10:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
   [02/06/2008|10:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
   [09/07/2008|01:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
   [22/05/2008|18:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [27/05/2008|22:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [22/05/2008|22:04] C:\DOCUME~1\Caroline\APPLIC~1\Adobe
   [20/05/2008|20:04] C:\DOCUME~1\Caroline\APPLIC~1\desktop.ini
   [22/05/2008|22:04] C:\DOCUME~1\Caroline\APPLIC~1\Identities
   [22/05/2008|22:19] C:\DOCUME~1\Caroline\APPLIC~1\Macromedia
   [10/07/2008|16:25] C:\DOCUME~1\Caroline\APPLIC~1\Microsoft
   [02/03/2006|14:00] C:\DOCUME~1\Caroline\APPLIC~1
tos.exe
   [02/06/2008|19:11] C:\DOCUME~1\Caroline\APPLIC~1\Sony Ericsson
   [29/06/2008|15:35] C:\DOCUME~1\Caroline\APPLIC~1\Teleca
   [10/07/2008|15:07] C:\DOCUME~1\Caroline\APPLIC~1\Winamp
   [13/07/2008|09:25] C:\DOCUME~1\Caroline\APPLIC~1\wsnpoem

   [20/05/2008|20:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [20/05/2008|18:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [20/05/2008|18:24] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [13/07/2008|09:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\wsnpoem

   [20/05/2008|18:24] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
   [13/07/2008|09:25] C:\DOCUME~1\NETWOR~1\APPLIC~1\wsnpoem

   [20/05/2008|20:04] C:\DOCUME~1\quentin\APPLIC~1\desktop.ini
   [16/06/2008|11:00] C:\DOCUME~1\quentin\APPLIC~1\Identities
   [10/07/2008|13:03] C:\DOCUME~1\quentin\APPLIC~1\Macromedia
   [10/07/2008|13:02] C:\DOCUME~1\quentin\APPLIC~1\Microsoft
   [16/06/2008|11:00] C:\DOCUME~1\quentin\APPLIC~1\Sony Ericsson
   [21/06/2008|11:25] C:\DOCUME~1\quentin\APPLIC~1\Teleca

   [30/05/2008|20:19] C:\DOCUME~1\user\APPLIC~1\Adobe
   [12/07/2008|08:38] C:\DOCUME~1\user\APPLIC~1\Azureus
   [03/07/2008|00:07] C:\DOCUME~1\user\APPLIC~1\DAEMON Tools
   [20/05/2008|20:04] C:\DOCUME~1\user\APPLIC~1\desktop.ini
   [01/07/2008|21:35] C:\DOCUME~1\user\APPLIC~1\Google
   [20/05/2008|18:36] C:\DOCUME~1\user\APPLIC~1\Identities
   [21/05/2008|13:02] C:\DOCUME~1\user\APPLIC~1\Macromedia
   [25/05/2008|13:07] C:\DOCUME~1\user\APPLIC~1\Media Player Classic
   [09/06/2008|20:18] C:\DOCUME~1\user\APPLIC~1\Microsoft
   [13/07/2008|07:27] C:\DOCUME~1\user\APPLIC~1\Mozilla
   [21/06/2008|18:43] C:\DOCUME~1\user\APPLIC~1\PnkBstrK.sys
   [21/05/2008|21:44] C:\DOCUME~1\user\APPLIC~1\SecondLife
   [02/06/2008|10:02] C:\DOCUME~1\user\APPLIC~1\Sony Ericsson
   [02/06/2008|10:06] C:\DOCUME~1\user\APPLIC~1\Sony Setup
   [09/07/2008|19:41] C:\DOCUME~1\user\APPLIC~1\Sports Interactive
   [13/07/2008|09:50] C:\DOCUME~1\user\APPLIC~1\Sun
   [12/06/2008|13:44] C:\DOCUME~1\user\APPLIC~1\Teleca
   [25/05/2008|12:12] C:\DOCUME~1\user\APPLIC~1\Winamp
 
   ----------------[ Tâches planifiées dans C:\WINDOWS	asks ]---------------

   [12/07/2008 22:05][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [13/06/2008 13:22][--a------] C:\WINDOWS	asks\WebReg 20080613132232.job
   [12/07/2008 12:43][--a------] C:\WINDOWS	asks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1213267215.job
   [22/06/2008 20:38][--a------] C:\WINDOWS	asks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1211481323.job
   [13/07/2008 09:23][--ah-----] C:\WINDOWS	asks\SA.DAT
   [02/03/2006 14:00][-r-h-----] C:\WINDOWS	asks\desktop.ini
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [21/06/2008|18:33] C:\Program Files\Activision
   [12/07/2008|08:41] C:\Program Files\Adobe
   [12/07/2008|18:59] C:\Program Files\AGEIA Technologies
   [01/06/2008|10:15] C:\Program Files\Alwil Software
   [12/07/2008|22:05] C:\Program Files\Apple Software Update
   [02/07/2008|15:28] C:\Program Files\AviSynth 2.5
   [12/07/2008|08:38] C:\Program Files\Azureus
   [13/07/2008|07:35] C:\Program Files\CCleaner
   [13/07/2008|07:35] C:\Program Files\ccsetup209.exe
   [21/05/2008|20:11] C:\Program Files\Club-Internet
   [21/05/2008|18:13] C:\Program Files\Common Files
   [20/05/2008|18:21] C:\Program Files\ComPlus Applications
   [12/07/2008|08:38] C:\Program Files\DAEMON Tools Lite
   [02/06/2008|10:18] C:\Program Files\Disc2Phone
   [02/06/2008|01:24] C:\Program Files\DivX
   [13/07/2008|09:49] C:\Program Files\Fichiers communs
   [13/07/2008|07:26] C:\Program Files\Firefox Setup 3.0.exe
   [01/06/2008|10:13] C:\Program Files\FlashGet
   [01/07/2008|21:34] C:\Program Files\Google
   [01/07/2008|21:34] C:\Program Files\Google_Earth_CZXV.exe
   [13/07/2008|08:19] C:\Program Files\GRISOFT
   [22/05/2008|20:33] C:\Program Files\HP
   [12/07/2008|18:53] C:\Program Files\InstallShield Installation Information
   [21/05/2008|13:36] C:\Program Files\Intel
   [12/07/2008|22:06] C:\Program Files\Internet Explorer
   [13/07/2008|09:50] C:\Program Files\Java
   [25/05/2008|08:00] C:\Program Files\K-Lite Codec Pack
   [11/07/2008|15:38] C:\Program Files\Lavasoft
   [21/05/2008|13:23] C:\Program Files\ma-config.com
   [21/05/2008|14:19] C:\Program Files\Marvell
   [24/05/2008|09:08] C:\Program Files\Messenger
   [30/05/2008|20:02] C:\Program Files\Microsoft ActiveSync
   [20/05/2008|18:24] C:\Program Files\microsoft frontpage
   [30/05/2008|20:02] C:\Program Files\Microsoft Office
   [09/06/2008|20:18] C:\Program Files\Microsoft Visual Studio
   [30/05/2008|20:01] C:\Program Files\Microsoft.NET
   [21/05/2008|20:11] C:\Program Files\Motive
   [20/05/2008|18:22] C:\Program Files\Movie Maker
   [13/07/2008|09:40] C:\Program Files\Mozilla Firefox
   [20/05/2008|18:20] C:\Program Files\MSN
   [20/05/2008|18:20] C:\Program Files\MSN Gaming Zone
   [24/05/2008|09:03] C:\Program Files\MSXML 4.0
   [20/05/2008|18:22] C:\Program Files\NetMeeting
   [20/05/2008|18:20] C:\Program Files\Online Services
   [24/05/2008|09:06] C:\Program Files\Outlook Express
   [12/07/2008|22:06] C:\Program Files\QuickTime
   [21/05/2008|14:45] C:\Program Files\Realtek
   [13/07/2008|09:28] C:\Program Files\SDFix
   [20/05/2008|18:23] C:\Program Files\Services en ligne
   [02/06/2008|10:00] C:\Program Files\Sony Ericsson
   [02/06/2008|10:06] C:\Program Files\Sony Setup
   [09/07/2008|19:39] C:\Program Files\Sports Interactive
   [12/07/2008|18:54] C:\Program Files\THQ
   [20/05/2008|18:36] C:\Program Files\Uninstall Information
   [12/07/2008|08:38] C:\Program Files\UnzipThemAll
   [17/06/2008|23:34] C:\Program Files\UnzipThemAll.exe
   [25/05/2008|11:43] C:\Program Files\Winamp
   [25/05/2008|11:42] C:\Program Files\Winamp Remote
   [23/05/2008|18:33] C:\Program Files\Windows Live
   [06/07/2008|21:43] C:\Program Files\Windows Media Player
   [20/05/2008|18:20] C:\Program Files\Windows NT
   [20/05/2008|18:23] C:\Program Files\WindowsUpdate
   [12/07/2008|08:38] C:\Program Files\WinRAR
   [09/07/2008|01:44] C:\Program Files\WinZip
   [20/05/2008|18:24] C:\Program Files\xerox
   [09/07/2008|19:40] C:\Program Files\Zero G Registry
  
   ------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------
   
   [30/05/2008|20:16] C:\Program Files\Fichiers communs\Adobe
   [30/05/2008|20:02] C:\Program Files\Fichiers communs\DESIGNER
   [22/05/2008|20:33] C:\Program Files\Fichiers communs\Hewlett-Packard
   [22/05/2008|20:31] C:\Program Files\Fichiers communs\HP
   [21/05/2008|14:45] C:\Program Files\Fichiers communs\InstallShield
   [13/07/2008|09:49] C:\Program Files\Fichiers communs\Java
   [11/06/2008|03:01] C:\Program Files\Fichiers communs\Microsoft Shared
   [21/05/2008|18:14] C:\Program Files\Fichiers communs\Motive
   [20/05/2008|18:22] C:\Program Files\Fichiers communs\MSSoap
   [25/05/2008|11:56] C:\Program Files\Fichiers communs\NSV
   [20/05/2008|20:04] C:\Program Files\Fichiers communs\ODBC
   [20/05/2008|18:22] C:\Program Files\Fichiers communs\Services
   [02/06/2008|10:00] C:\Program Files\Fichiers communs\Sony Ericsson Shared
   [20/05/2008|20:04] C:\Program Files\Fichiers communs\SpeechEngines
   [30/05/2008|20:02] C:\Program Files\Fichiers communs\System
   [02/06/2008|10:00] C:\Program Files\Fichiers communs\Teleca Shared
   [23/05/2008|18:32] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [12/07/2008|18:58] C:\Program Files\Fichiers communs\Wise Installation Wizard

   ---------------------------[ Process ]--------------------------

   ... 39

   iexplore.exe ~ [2112]

   ----------------------[ Recherche avec S_Lop ]---------------------

   Aucun fichier / dossier Lop trouvé ! 
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   C:\DOCUME~1\user\Cookies\user@adin.bigpoint[2].txt
   C:\DOCUME~1\user\Cookies\user@bigpoint[1].txt
   C:\DOCUME~1\user\Cookies\user@es.bigpoint[1].txt
   C:\DOCUME~1\user\Cookies\user@fr1.darkorbit.bigpoint[2].txt
   C:\DOCUME~1\user\Cookies\user@www.bigpoint[1].txt
   C:\DOCUME~1\user\Cookies\user@www.bigpoint[3].txt
 
   ----------------------[ Verification du Registre ]----------------------
 
   ..... OK !

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts PROPRE


   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-07-13 10:36:57
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------

   C:\WINDOWS\system32\kmnqYcdd.ini2
   C:\WINDOWS\system32\kmnqYcdd.ini
   [b]! VUNDO Possible !/b
 


   [F:722][D:17]-> C:\DOCUME~1\user\LOCALS~1\Temp
   [F:78][D:0]-> C:\DOCUME~1\user\Cookies
   [F:1460][D:4]-> C:\DOCUME~1\user\LOCALS~1\TEMPOR~1\content.IE5

   --------------------[ Fin du rapport a 10:37:53,93  ]----------------------

Je dois le relancer en faisant l'option 2 , c'est ça ?

Merci

Caro

geoffrey5 · Answer

oui tu peux faire l option 2 maintenant et ensuite passe à hijackthis stp

Caro75 · Answer

L'aventure continue....

Merci, je continue à essayer d'appliquer scupuleusement les conseils...
Voici le rapport de Hijackthis que je pense ??? avoir renommé :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:44, on 13/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0541290B-954E-4B9E-B9D0-907944A5F690} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B455E00D-F972-4C62-A754-B2DDA32939E0} - C:\WINDOWS\system32\ddcYqnmk.dll
O2 - BHO: {cfab0f01-50b0-adba-2174-f3c1409fadfc} - {cfdaf904-1c3f-4712-abda-0b0510f0bafc} - C:\WINDOWS\system32
nfgbd.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [9069a32b] rundll32.exe "C:\WINDOWS\system32\lrtjhytr.dll",b
O4 - HKLM\..\Run: [BM935a90b7] Rundll32.exe "C:\WINDOWS\system32\jgeivisu.dll",s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1215935405533&h=25c8346752a28a7c54f91ae6a9b7b78b/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O20 - Winlogon Notify: hgGXpqqN - hgGXpqqN.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

geoffrey5 · Answer

Télécharger sur le bureau malware bytes : http://ww.commentcamarche.net/telecharger/telechargement 34055379 malwarebyte s anti malware?thread
 

= double-clic sur mbam-setup pour lancer l'installation 
= Installer simplement sans rien modifier 
= Quand le programme lancé ==> faire une mise à jour ensuite cocher Exécuter un examen complet 
= Clic Rechercher 
= Eventuellement décocher les disque à ne pas analyser 
= Clic Lancer l'examen 
= En fin de scan , si infection trouvée 
==> Clic Afficher résultat 
= Fermer vos applications en cours 
= Vérifier si tout est coché et clic Supprimer la sélection 

un rapport s'ouvre le copier et le coller dans la réponse 

Puis redémarrer le pc !!

ensuite :

Télécharge sur le bureau virtumundobegone : 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

déconnecte internet et désactive ton antivirus le temps de la manipulation



=> Double clic sur VirtumundoBeGone.exe 
=> Clic Continue ==> clic Start 
=> Clic Oui 
=> A la fin si Vundo est présent , le PC s’éteint et redémarre 
- Si Ecran bleu et message : Erreur fatale .. pas de problème 
=> Poster le rapport VBG.TXT qui est sur le bureau 

Et refais un nouveau rapport hijackthis stp

Caro75 · Answer

Bon, voila ca a été long mais je ne pensais pas avoir plus de 300 000 fichiers....

les rapports :

Celui de mbam :

Malwarebytes' Anti-Malware 1.20
Version de la base de données: 944
Windows 5.1.2600 Service Pack 2

13:01:30 13/07/2008
mbam-log-7-13-2008 (13-01-30).txt

Type de recherche: Examen complet (C:\|F:\|)
Eléments examinés: 321807
Temps écoulé: 1 hour(s), 51 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 23

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\ddcYqnmk.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\lrtjhytr.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b455e00d-f972-4c62-a754-b2dda32939e0} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{b455e00d-f972-4c62-a754-b2dda32939e0} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0541290b-954e-4b9e-b9d0-907944a5f690} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9069a32b (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{0541290b-954e-4b9e-b9d0-907944a5f690} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm935a90b7 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\ddcyqnmk -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ddcyqnmk  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Documents and Settings\NetworkService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Caroline\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\ddcYqnmk.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\kmnqYcdd.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kmnqYcdd.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lrtjhytr.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32tyhjtrl.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Caroline\Local Settings\Temp\jkkHBSLF.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Caroline\Local Settings\Temp\lriujage.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Caroline\Local Settings\Temp
sycfdew.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Caroline\Local Settings\Temporary Internet Files\Content.IE5\CPA7C1MZ\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Caroline\Local Settings\Temporary Internet Files\Content.IE5\KLU3OTQB\kb671231[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Caroline\Local Settings\Temporary Internet Files\Content.IE5\WDYVS9IJ\css4[3] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{802844B2-6BC5-40F0-BE60-316FBF0076EF}\RP77\A0048722.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{802844B2-6BC5-40F0-BE60-316FBF0076EF}\RP78\A0049042.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{802844B2-6BC5-40F0-BE60-316FBF0076EF}\RP78\A0049045.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{802844B2-6BC5-40F0-BE60-316FBF0076EF}\RP82\A0049791.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jgeivisu.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32	uvSjIaA.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\geBqqonn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqrPggE.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM935a90b7.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM935a90b7.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Caroline\Application Data
tos.exe (Backdoor.Proxy) -> Quarantined and deleted successfully.

Celui de>Virtumundo :

07/13/2008, 13:10:14] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\user\Mes documents\VirtumundoBeGone.exe" )
[07/13/2008, 13:10:16] - Detected System Information:
[07/13/2008, 13:10:16] -  Windows Version: 5.1.2600, Service Pack 2
[07/13/2008, 13:10:16] -  Current Username: user (Admin)
[07/13/2008, 13:10:16] -  Windows is in NORMAL mode.
[07/13/2008, 13:10:16] - Searching for Browser Helper Objects:
[07/13/2008, 13:10:16] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[07/13/2008, 13:10:16] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/13/2008, 13:10:16] -  BHO 3: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[07/13/2008, 13:10:16] -  BHO 4: {cfdaf904-1c3f-4712-abda-0b0510f0bafc} ()
[07/13/2008, 13:10:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/13/2008, 13:10:16] -  Checking for HKLM\...\Winlogon\Notify
nfgbd
[07/13/2008, 13:10:16] -  Key not found: HKLM\...\Winlogon\Notify
nfgbd, continuing.
[07/13/2008, 13:10:16] -  BHO 5: {F156768E-81EF-470C-9057-481BA8380DBA} (FlashGet GetFlash Class)
[07/13/2008, 13:10:16] - Finished Searching Browser Helper Objects
[07/13/2008, 13:10:16] - Finishing up...
[07/13/2008, 13:10:16] - Nothing found! Exiting...

et celui de Hijack... :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:11:46, on 13/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {cfab0f01-50b0-adba-2174-f3c1409fadfc} - {cfdaf904-1c3f-4712-abda-0b0510f0bafc} - C:\WINDOWS\system32
nfgbd.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1215935405533&h=25c8346752a28a7c54f91ae6a9b7b78b/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O20 - Winlogon Notify: hgGXpqqN - hgGXpqqN.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

geoffrey5 · Answer

est ce que tu as bien redémarrer ton pc avant de me poster le nouveau rapport hijackthis ??

Caro75 · Answer

J'ai redémarré (ou plutot il a redémarré tout seul) entre les manips mbam et mundobegone. Il fallait pas ?

Caro

geoffrey5 · Answer

oui c est normal malwarebytes devait terminer la suppression de certain fichiers au redémarrage..

télécharge OtMoveIt 

Télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. 
Double-clique sur OTMoveIt.exe pour le lancer. 
Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste List of Files/Folders to move. 


c:\windows\system32
nfgbd.dll
 


clique sur MoveIt! pour lancer la suppression. 
Le résultat apparaitra dans le cadre "Results". 
Clique sur Exit pour fermer. 
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

Il te sera peut-être demandé de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

ensuite :

Fix.reg 

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisi nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en gras dans la citation ci-dessous (copie tout d'un trait sans les barres(x)) : 

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cfdaf904-1c3f-4712-abda-0b0510f0bafc}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cfdaf904-1c3f-4712-abda-0b0510f0bafc}]


XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
Note : Regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin. 
Puis click sur "fichier"/"enregistrer sous" : 
dans : sur le bureau 
Nom du fichier : fix.reg 
Type de fichier : "tous les fichiers" 
clique sur "enregistrer" 

ca doit ressembler à ca une fois enregistré : 

http://img520.imageshack.us/img520/4251/screenshot005ps2.png 

double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?" 
Si c'est bien le cas, clique sur "oui" 


ensuite refais un nouveau rapport hijackthis stp

Caro75 · Answer

J'ai suivi les indications, voici le rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:38:25, on 13/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1215935405533&h=25c8346752a28a7c54f91ae6a9b7b78b/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O20 - Winlogon Notify: hgGXpqqN - hgGXpqqN.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

geoffrey5 · Answer

relance hijackthis en cliquant sur scan only et coches ces lignes :

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
     
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab 

O20 - Winlogon Notify: hgGXpqqN - hgGXpqqN.dll (file missing) 

puis tu cliques sur fix checked.

je vois aussi que tu n as pas d antivirus, télécharge antivir à cette adresse : 

https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/13198.html

et voici un tuto pour bien le configurer : https://www.malekal.com/avira-free-security-antivirus-gratuit/

vas aussi faire la mise à niveau de sécurité d adobe reader à cette adresse : 

http://www.clubic.com/lancer-le-telechargement-37823-0-adobe-reader-acrobat.html

est ce que tu as encore des problemes ??

Caro75 · Answer

Ca a l'air résolu et, effectivement, l'antivirus me prévient sans cesse que des Trojans veulent s'installer sur Widows/System 32/....

Tu veux un dernier rapport pour vérifier que c'est clean ?

Dois je faire un point de restauration maintenant ?

Merci

Caro

geoffrey5 · Answer

pas besoin de rapport hijackthis ..

fais ceci :

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques : 

Télécharge toolscleaner sur ton Bureau : http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner 
* Double-clique sur ToolsCleaner2.bat et laisse le travailler 
* Clique sur Recherche et laisse le scan se terminer. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives. 
* Clique sur Quitter, pour que le rapport puisse se créer. 
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse


Désactive et réactive la Restauration du système :
 
1 Dans la barre des tâches de Windows, clique sur Démarrer.
 
2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.
 
3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.
  
5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

ensuite :

télécharge a-squared free 3.5 à cette adresse : https://www.emsisoft.com/fr/

fais la mise à jour et analyses.

Caro75 · Answer

Je fais tout ça mais je suis reparti pour un scan des 300 000 fichiers alors évidemment c'est un peu long....

En revanche l'antivirus tout neuf ;-))) continue à me dire que le méchant vundo cherche à se réimplanter...

Des nouvelles neuves dès la fin du scan.....

Caro

geoffrey5 · Answer

Ne fais pas toolscleaner maintenant, si tu l as fais c est pas grave...fais ceci :

télécharge combofix (par sUBs) ici : 

https://forospyware.com

et enregistre le sur le Bureau. 

déconnecte toi d'internet et ferme toutes tes applications. 

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware) 


double-clique sur combofix.exe et suis les instructions 

à la fin, il va produire un rapport C:\ComboFix.txt 

réactive ton parefeu, ton antivirus, la garde de ton antispyware 

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse. 

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici : 

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

caro75 · Answer

Bon ca y est, j'ai tout effectué, enfin je pense. J'étais pas rassurée pendant la phase finale mais je crois être au terme de la quête d'un ordi clean ..... voici le rapport de Cmbfix... c'est un peu indigeste....

ComboFix 08-07-12.4 - user 2008-07-13 17:05:39.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1482 [GMT 2:00]
Endroit: C:\Documents and Settings\user\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ddcYqnmk.dll
C:\WINDOWS\system32\eofiiyux.dll
C:\WINDOWS\system32\jgeivisu.dll
C:\WINDOWS\system32\lelbhgog.dll
C:\WINDOWS\system32\lrtjhytr.dll
C:\WINDOWS\system32\mcrh.tmp

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-13 to 2008-07-13 ))))))))))))))))))))))))))))))))))))
.

2008-07-13 15:47 . 2008-07-13 15:47 <REP> d-------- C:\Documents and Settings\LocalService\Mes documents
2008-07-13 14:28 . 2008-07-13 16:41 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2008-07-13 14:28 . 2008-07-13 14:28 33,095,104 --a------ C:\Program Files\a2AntiMalwareSetup.exe
2008-07-13 14:18 . 2008-07-13 14:18 452,608 --a------ C:\Program Files\ToolsCleaner2.exe
2008-07-13 13:54 . 2008-07-13 13:54 <REP> d-------- C:\Program Files\Avira
2008-07-13 13:54 . 2008-07-13 13:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-13 11:07 . 2008-07-13 11:07 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-13 11:07 . 2008-07-13 11:07 <REP> d-------- C:\Documents and Settings\user\Application Data\Malwarebytes
2008-07-13 11:07 . 2008-07-13 11:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-13 11:07 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-13 11:07 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-13 10:54 . 2008-07-13 14:25 <REP> d-------- C:\Program Files\Trend Micro
2008-07-13 09:50 . 2008-07-13 09:50 <REP> d-------- C:\WINDOWS\Sun
2008-07-13 09:50 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-13 09:49 . 2008-07-13 09:50 <REP> d-------- C:\Program Files\Java
2008-07-13 09:49 . 2008-07-13 09:49 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-07-13 09:04 . 2008-07-13 09:05 <REP> d-------- C:\WINDOWS\ERUNT
2008-07-13 08:43 . 2008-07-13 09:28 <REP> d-------- C:\Program Files\SDFix
2008-07-13 08:19 . 2007-01-18 14:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-07-13 07:35 . 2008-07-13 07:35 <REP> d-------- C:\Program Files\CCleaner
2008-07-13 07:35 . 2008-07-13 07:35 2,919,360 --a------ C:\Program Files\ccsetup209.exe
2008-07-13 07:27 . 2008-07-13 07:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-13 07:26 . 2008-07-13 07:26 7,599,856 --a------ C:\Program Files\Firefox Setup 3.0.exe
2008-07-13 03:03 . 2008-07-13 03:03 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-07-12 22:05 . 2008-07-12 22:05 <REP> d-------- C:\Program Files\Apple Software Update
2008-07-12 22:05 . 2008-07-12 22:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-12 22:05 . 2008-07-12 22:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-07-12 22:03 . 2008-07-12 22:06 <REP> d-------- C:\Program Files\QuickTime
2008-07-12 18:58 . 2008-07-12 18:58 <REP> d-------- C:\WINDOWS\system32\AGEIA
2008-07-12 18:58 . 2008-07-12 18:58 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-12 18:58 . 2008-07-12 18:59 <REP> d-------- C:\Program Files\AGEIA Technologies
2008-07-12 18:54 . 2008-07-12 18:54 <REP> d-------- C:\Program Files\THQ
2008-07-12 08:38 . 2008-07-12 08:38 <REP> d-------- C:\Program Files\UnzipThemAll
2008-07-12 08:38 . 2008-07-12 08:38 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-07-11 15:38 . 2008-07-11 15:38 <REP> d-------- C:\Program Files\Lavasoft
2008-07-11 15:38 . 2008-07-12 08:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-11 15:27 . 2008-07-11 15:27 0 --a------ C:\WINDOWS\system32\mbxacytu.tmp
2008-07-09 19:41 . 2008-07-09 19:41 <REP> d-------- C:\Documents and Settings\user\Application Data\Sports Interactive
2008-07-09 19:39 . 2008-07-09 19:40 <REP> d--h----- C:\Program Files\Zero G Registry
2008-07-09 19:39 . 2008-07-09 19:39 <REP> d-------- C:\Program Files\Sports Interactive
2008-07-09 19:39 . 2008-07-09 19:39 <REP> d--h----- C:\Documents and Settings\user\InstallAnywhere
2008-07-09 19:20 . 2008-06-20 12:45 360,320 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2008-07-09 19:20 . 2008-06-20 11:52 225,920 --a------ C:\WINDOWS\system32\drivers\tcpip6.sys
2008-07-09 19:20 . 2008-06-20 12:44 138,368 --a------ C:\WINDOWS\system32\drivers\afd.sys
2008-07-09 01:44 . 2008-07-09 01:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-07-03 00:07 . 2008-07-03 00:07 <REP> d-------- C:\Documents and Settings\user\Application Data\DAEMON Tools
2008-07-03 00:07 . 2008-07-03 00:07 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-07-02 15:28 . 2008-07-02 15:28 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-07-02 15:25 . 2004-01-08 11:38 208,896 --a------ C:\WINDOWS\system32\lame_enc.dll
2008-07-01 21:34 . 2008-07-01 21:34 <REP> d-------- C:\Program Files\Google
2008-07-01 21:34 . 2008-07-01 21:34 7,726,360 --a------ C:\Program Files\Google_Earth_CZXV.exe
2008-06-26 22:05 . 2008-07-10 15:07 <REP> d-------- C:\Documents and Settings\Caroline\Application Data\Winamp
2008-06-21 18:43 . 2008-06-21 18:43 22,328 --a------ C:\Documents and Settings\user\Application Data\PnkBstrK.sys
2008-06-21 18:42 . 2008-06-21 18:42 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-06-21 18:42 . 2008-06-27 17:43 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-06-21 18:42 . 2008-06-24 22:37 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-06-21 18:42 . 2008-06-21 18:42 319 --a------ C:\WINDOWS\game.ini
2008-06-21 18:33 . 2008-06-21 18:33 <REP> d-------- C:\Program Files\Activision
2008-06-21 18:31 . 2008-06-21 18:31 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-06-21 11:44 . 2008-06-21 11:44 268 --ah----- C:\sqmdata02.sqm
2008-06-21 11:44 . 2008-06-21 11:44 244 --ah----- C:\sqmnoopt02.sqm
2008-06-21 11:26 . 2008-06-21 11:26 268 --ah----- C:\sqmdata01.sqm
2008-06-21 11:26 . 2008-06-21 11:26 244 --ah----- C:\sqmnoopt01.sqm
2008-06-21 11:25 . 2008-06-21 11:25 <REP> d-------- C:\Documents and Settings\quentin\Application Data\Teleca
2008-06-21 11:23 . 2008-06-21 11:23 268 --ah----- C:\sqmdata00.sqm
2008-06-21 11:23 . 2008-06-21 11:23 244 --ah----- C:\sqmnoopt00.sqm
2008-06-21 11:21 . 2008-06-21 11:21 2,422 --a------ C:\WINDOWS\system32\wpa.bak
2008-06-17 23:34 . 2008-06-17 23:34 1,489,855 --a------ C:\Program Files\UnzipThemAll.exe
2008-06-16 11:00 . 2008-06-16 11:00 <REP> d-------- C:\Documents and Settings\quentin\Application Data\Sony Ericsson
2008-06-16 10:59 . 2008-05-20 20:04 <REP> d--h----- C:\Documents and Settings\quentin\Voisinage r‚seau
2008-06-16 10:59 . 2008-05-20 20:04 <REP> d--h----- C:\Documents and Settings\quentin\Voisinage d'impression
2008-06-16 10:59 . 2008-05-20 18:20 <REP> d--h----- C:\Documents and Settings\quentin\ModŠles
2008-06-16 10:59 . 2008-07-11 14:36 <REP> dr------- C:\Documents and Settings\quentin\Mes documents
2008-06-16 10:59 . 2008-05-20 20:04 <REP> dr------- C:\Documents and Settings\quentin\Menu D‚marrer
2008-06-16 10:59 . 2008-06-16 11:00 <REP> dr------- C:\Documents and Settings\quentin\Favoris
2008-06-16 10:59 . 2008-05-20 20:04 <REP> d-------- C:\Documents and Settings\quentin\Bureau
2008-06-16 10:59 . 2008-07-13 07:05 <REP> d-------- C:\Documents and Settings\quentin

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-12 16:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-12 06:38 --------- d-----w C:\Program Files\Azureus
2008-07-12 06:38 --------- d-----w C:\Documents and Settings\user\Application Data\Azureus
2008-06-29 13:35 --------- d-----w C:\Documents and Settings\Caroline\Application Data\Teleca
2008-06-27 15:43 138,408 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 11:44 --------- d-----w C:\Documents and Settings\user\Application Data\Teleca
2008-06-02 17:11 --------- d-----w C:\Documents and Settings\Caroline\Application Data\Sony Ericsson
2008-06-02 08:18 --------- d-----w C:\Program Files\Disc2Phone
2008-06-02 08:06 --------- d-----w C:\Program Files\Sony Setup
2008-06-02 08:06 --------- d-----w C:\Documents and Settings\user\Application Data\Sony Setup
2008-06-02 08:02 --------- d-----w C:\Documents and Settings\user\Application Data\Sony Ericsson
2008-06-02 08:00 --------- d-----w C:\Program Files\Sony Ericsson
2008-06-02 08:00 --------- d-----w C:\Program Files\Fichiers communs\Teleca Shared
2008-06-02 08:00 --------- d-----w C:\Program Files\Fichiers communs\Sony Ericsson Shared
2008-06-02 08:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2008-06-02 08:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-06-02 07:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2008-06-01 23:24 --------- d-----w C:\Program Files\DivX
2008-06-01 15:48 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
2008-06-01 08:15 --------- d-----w C:\Program Files\Alwil Software
2008-06-01 08:13 --------- d-----w C:\Program Files\FlashGet
2008-05-30 18:16 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-30 18:02 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-05-30 18:01 --------- d-----w C:\Program Files\Microsoft.NET
2008-05-26 10:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
2008-05-25 11:07 --------- d-----w C:\Documents and Settings\user\Application Data\Media Player Classic
2008-05-25 10:12 --------- d-----w C:\Documents and Settings\user\Application Data\Winamp
2008-05-25 09:56 --------- d-----w C:\Program Files\Fichiers communs\NSV
2008-05-25 09:43 --------- d-----w C:\Program Files\Winamp
2008-05-25 09:42 --------- d-----w C:\Program Files\Winamp Remote
2008-05-25 06:00 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-05-24 07:03 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-23 16:33 --------- d-----w C:\Program Files\Windows Live
2008-05-23 16:32 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-05-23 16:21 46,592 ----a-w C:\e4bc1k.exe
2008-05-22 18:33 --------- d-----w C:\Program Files\HP
2008-05-22 18:33 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-05-22 18:31 43,488 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2008-05-22 18:31 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-05-22 16:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-21 19:44 --------- d-----w C:\Documents and Settings\user\Application Data\SecondLife
2008-05-21 18:11 --------- d-----w C:\Program Files\Motive
2008-05-21 18:11 --------- d-----w C:\Program Files\Club-Internet
2008-05-21 16:14 --------- d-----w C:\Program Files\Fichiers communs\Motive
2008-05-21 16:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Motive
2008-05-21 16:13 --------- d-----w C:\Program Files\Common Files
2008-05-21 16:07 155,995 ----a-w C:\WINDOWS\java\Packages\CNTR71JB.ZIP
2008-05-21 12:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\ma-config.com
2008-05-21 12:45 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-21 12:45 --------- d-----w C:\Program Files\Realtek
2008-05-21 12:45 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-05-21 12:19 --------- d-----w C:\Program Files\Marvell
2008-05-21 11:36 --------- d-----w C:\Program Files\Intel
2008-05-21 11:23 --------- d-----w C:\Program Files\ma-config.com
2008-05-20 16:24 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-20 16:23 --------- d-----w C:\Program Files\Services en ligne
2008-05-13 01:51 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-13 01:51 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-30 15:27 442,368 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46 86016]
"Motive SmartBridge"="C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe" [2006-04-21 15:41 438359]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-06-25 11:24 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-06-26 18:50 212992]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 01:06 487424]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-07-12 22:03 413696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2008-07-13 14:37 2132112]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 14:31 16857600 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Program Files\\THQ\\Frontlines-Fuel of War Demo\\Binaries\\FFOW-MPDemo.exe"=

S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-05-19 10:01]
S3 se44bus;Sony Ericsson Device 068 driver (WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30 14:58]
S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30 14:58]
S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30 14:58]
S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30 14:58]
S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30 14:58]
S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30 14:58]
S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30 14:58]
S3 VNUWL5B;VIA Networking Technologies USB Wireless LAN Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\VNUWL5B.SYS [2006-09-19 14:34]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setup\rsrc\Autorun.exe
\Shell\dinstall\command - E:\Directx\dxsetup.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-12 20:05:17 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-22 18:38:06 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1211481323.job"
- C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 1300 series#1211481323
"2008-07-12 10:43:06 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1213267215.job"
- C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 1300 series#1213267215
"2008-07-13 11:22:07 C:\WINDOWS\Tasks\WebReg 20080713132206.job"
- C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exeX/TaskName 20080713132206 /N
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-DXDllRegExe - dxdllreg.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-13 17:09:35
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-13 17:14:31 - machine was rebooted [user]
ComboFix-quarantined-files.txt 2008-07-13 15:13:28

Pre-Run: 299,141,906,432 octets libres
Post-Run: 299,317,370,880 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

267 --- E O F --- 2008-07-13 01:03:28

Est ce que c'est réparé ?

Merci encore en tout cas car les pubs ne s'affichent plus pour l'instant....

Caro

Caro75 · Answer

Bon je pense avoir tout fini, avec quelques sueurs froides en prime mais ça a l'air bon....

Voici le rapport de Combofix :

ComboFix 08-07-12.4 - user 2008-07-13 17:05:39.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1482 [GMT 2:00]
Endroit: C:\Documents and Settings\user\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ddcYqnmk.dll
C:\WINDOWS\system32\eofiiyux.dll
C:\WINDOWS\system32\jgeivisu.dll
C:\WINDOWS\system32\lelbhgog.dll
C:\WINDOWS\system32\lrtjhytr.dll
C:\WINDOWS\system32\mcrh.tmp

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-13 to 2008-07-13 ))))))))))))))))))))))))))))))))))))
.

2008-07-13 15:47 . 2008-07-13 15:47 <REP> d-------- C:\Documents and Settings\LocalService\Mes documents
2008-07-13 14:28 . 2008-07-13 16:41 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2008-07-13 14:28 . 2008-07-13 14:28 33,095,104 --a------ C:\Program Files\a2AntiMalwareSetup.exe
2008-07-13 14:18 . 2008-07-13 14:18 452,608 --a------ C:\Program Files\ToolsCleaner2.exe
2008-07-13 13:54 . 2008-07-13 13:54 <REP> d-------- C:\Program Files\Avira
2008-07-13 13:54 . 2008-07-13 13:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-07-13 11:07 . 2008-07-13 11:07 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-13 11:07 . 2008-07-13 11:07 <REP> d-------- C:\Documents and Settings\user\Application Data\Malwarebytes
2008-07-13 11:07 . 2008-07-13 11:07 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-13 11:07 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-13 11:07 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-13 10:54 . 2008-07-13 14:25 <REP> d-------- C:\Program Files\Trend Micro
2008-07-13 09:50 . 2008-07-13 09:50 <REP> d-------- C:\WINDOWS\Sun
2008-07-13 09:50 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-13 09:49 . 2008-07-13 09:50 <REP> d-------- C:\Program Files\Java
2008-07-13 09:49 . 2008-07-13 09:49 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-07-13 09:04 . 2008-07-13 09:05 <REP> d-------- C:\WINDOWS\ERUNT
2008-07-13 08:43 . 2008-07-13 09:28 <REP> d-------- C:\Program Files\SDFix
2008-07-13 08:19 . 2007-01-18 14:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-07-13 07:35 . 2008-07-13 07:35 <REP> d-------- C:\Program Files\CCleaner
2008-07-13 07:35 . 2008-07-13 07:35 2,919,360 --a------ C:\Program Files\ccsetup209.exe
2008-07-13 07:27 . 2008-07-13 07:27 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-13 07:26 . 2008-07-13 07:26 7,599,856 --a------ C:\Program Files\Firefox Setup 3.0.exe
2008-07-13 03:03 . 2008-07-13 03:03 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-07-12 22:05 . 2008-07-12 22:05 <REP> d-------- C:\Program Files\Apple Software Update
2008-07-12 22:05 . 2008-07-12 22:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-12 22:05 . 2008-07-12 22:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-07-12 22:03 . 2008-07-12 22:06 <REP> d-------- C:\Program Files\QuickTime
2008-07-12 18:58 . 2008-07-12 18:58 <REP> d-------- C:\WINDOWS\system32\AGEIA
2008-07-12 18:58 . 2008-07-12 18:58 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-07-12 18:58 . 2008-07-12 18:59 <REP> d-------- C:\Program Files\AGEIA Technologies
2008-07-12 18:54 . 2008-07-12 18:54 <REP> d-------- C:\Program Files\THQ
2008-07-12 08:38 . 2008-07-12 08:38 <REP> d-------- C:\Program Files\UnzipThemAll
2008-07-12 08:38 . 2008-07-12 08:38 <REP> d-------- C:\Program Files\DAEMON Tools Lite
2008-07-11 15:38 . 2008-07-11 15:38 <REP> d-------- C:\Program Files\Lavasoft
2008-07-11 15:38 . 2008-07-12 08:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-11 15:27 . 2008-07-11 15:27 0 --a------ C:\WINDOWS\system32\mbxacytu.tmp
2008-07-09 19:41 . 2008-07-09 19:41 <REP> d-------- C:\Documents and Settings\user\Application Data\Sports Interactive
2008-07-09 19:39 . 2008-07-09 19:40 <REP> d--h----- C:\Program Files\Zero G Registry
2008-07-09 19:39 . 2008-07-09 19:39 <REP> d-------- C:\Program Files\Sports Interactive
2008-07-09 19:39 . 2008-07-09 19:39 <REP> d--h----- C:\Documents and Settings\user\InstallAnywhere
2008-07-09 19:20 . 2008-06-20 12:45 360,320 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2008-07-09 19:20 . 2008-06-20 11:52 225,920 --a------ C:\WINDOWS\system32\drivers\tcpip6.sys
2008-07-09 19:20 . 2008-06-20 12:44 138,368 --a------ C:\WINDOWS\system32\drivers\afd.sys
2008-07-09 01:44 . 2008-07-09 01:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-07-03 00:07 . 2008-07-03 00:07 <REP> d-------- C:\Documents and Settings\user\Application Data\DAEMON Tools
2008-07-03 00:07 . 2008-07-03 00:07 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-07-02 15:28 . 2008-07-02 15:28 <REP> d-------- C:\Program Files\AviSynth 2.5
2008-07-02 15:25 . 2004-01-08 11:38 208,896 --a------ C:\WINDOWS\system32\lame_enc.dll
2008-07-01 21:34 . 2008-07-01 21:34 <REP> d-------- C:\Program Files\Google
2008-07-01 21:34 . 2008-07-01 21:34 7,726,360 --a------ C:\Program Files\Google_Earth_CZXV.exe
2008-06-26 22:05 . 2008-07-10 15:07 <REP> d-------- C:\Documents and Settings\Caroline\Application Data\Winamp
2008-06-21 18:43 . 2008-06-21 18:43 22,328 --a------ C:\Documents and Settings\user\Application Data\PnkBstrK.sys
2008-06-21 18:42 . 2008-06-21 18:42 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-06-21 18:42 . 2008-06-27 17:43 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-06-21 18:42 . 2008-06-24 22:37 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-06-21 18:42 . 2008-06-21 18:42 319 --a------ C:\WINDOWS\game.ini
2008-06-21 18:33 . 2008-06-21 18:33 <REP> d-------- C:\Program Files\Activision
2008-06-21 18:31 . 2008-06-21 18:31 <REP> d--hs---- C:\WINDOWS\ftpcache
2008-06-21 11:44 . 2008-06-21 11:44 268 --ah----- C:\sqmdata02.sqm
2008-06-21 11:44 . 2008-06-21 11:44 244 --ah----- C:\sqmnoopt02.sqm
2008-06-21 11:26 . 2008-06-21 11:26 268 --ah----- C:\sqmdata01.sqm
2008-06-21 11:26 . 2008-06-21 11:26 244 --ah----- C:\sqmnoopt01.sqm
2008-06-21 11:25 . 2008-06-21 11:25 <REP> d-------- C:\Documents and Settings\quentin\Application Data\Teleca
2008-06-21 11:23 . 2008-06-21 11:23 268 --ah----- C:\sqmdata00.sqm
2008-06-21 11:23 . 2008-06-21 11:23 244 --ah----- C:\sqmnoopt00.sqm
2008-06-21 11:21 . 2008-06-21 11:21 2,422 --a------ C:\WINDOWS\system32\wpa.bak
2008-06-17 23:34 . 2008-06-17 23:34 1,489,855 --a------ C:\Program Files\UnzipThemAll.exe
2008-06-16 11:00 . 2008-06-16 11:00 <REP> d-------- C:\Documents and Settings\quentin\Application Data\Sony Ericsson
2008-06-16 10:59 . 2008-05-20 20:04 <REP> d--h----- C:\Documents and Settings\quentin\Voisinage r‚seau
2008-06-16 10:59 . 2008-05-20 20:04 <REP> d--h----- C:\Documents and Settings\quentin\Voisinage d'impression
2008-06-16 10:59 . 2008-05-20 18:20 <REP> d--h----- C:\Documents and Settings\quentin\ModŠles
2008-06-16 10:59 . 2008-07-11 14:36 <REP> dr------- C:\Documents and Settings\quentin\Mes documents
2008-06-16 10:59 . 2008-05-20 20:04 <REP> dr------- C:\Documents and Settings\quentin\Menu D‚marrer
2008-06-16 10:59 . 2008-06-16 11:00 <REP> dr------- C:\Documents and Settings\quentin\Favoris
2008-06-16 10:59 . 2008-05-20 20:04 <REP> d-------- C:\Documents and Settings\quentin\Bureau
2008-06-16 10:59 . 2008-07-13 07:05 <REP> d-------- C:\Documents and Settings\quentin

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-12 16:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-12 06:38 --------- d-----w C:\Program Files\Azureus
2008-07-12 06:38 --------- d-----w C:\Documents and Settings\user\Application Data\Azureus
2008-06-29 13:35 --------- d-----w C:\Documents and Settings\Caroline\Application Data\Teleca
2008-06-27 15:43 138,408 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 11:44 --------- d-----w C:\Documents and Settings\user\Application Data\Teleca
2008-06-02 17:11 --------- d-----w C:\Documents and Settings\Caroline\Application Data\Sony Ericsson
2008-06-02 08:18 --------- d-----w C:\Program Files\Disc2Phone
2008-06-02 08:06 --------- d-----w C:\Program Files\Sony Setup
2008-06-02 08:06 --------- d-----w C:\Documents and Settings\user\Application Data\Sony Setup
2008-06-02 08:02 --------- d-----w C:\Documents and Settings\user\Application Data\Sony Ericsson
2008-06-02 08:00 --------- d-----w C:\Program Files\Sony Ericsson
2008-06-02 08:00 --------- d-----w C:\Program Files\Fichiers communs\Teleca Shared
2008-06-02 08:00 --------- d-----w C:\Program Files\Fichiers communs\Sony Ericsson Shared
2008-06-02 08:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2008-06-02 08:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-06-02 07:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2008-06-01 23:24 --------- d-----w C:\Program Files\DivX
2008-06-01 15:48 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
2008-06-01 08:15 --------- d-----w C:\Program Files\Alwil Software
2008-06-01 08:13 --------- d-----w C:\Program Files\FlashGet
2008-05-30 18:16 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-05-30 18:02 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-05-30 18:01 --------- d-----w C:\Program Files\Microsoft.NET
2008-05-26 10:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
2008-05-25 11:07 --------- d-----w C:\Documents and Settings\user\Application Data\Media Player Classic
2008-05-25 10:12 --------- d-----w C:\Documents and Settings\user\Application Data\Winamp
2008-05-25 09:56 --------- d-----w C:\Program Files\Fichiers communs\NSV
2008-05-25 09:43 --------- d-----w C:\Program Files\Winamp
2008-05-25 09:42 --------- d-----w C:\Program Files\Winamp Remote
2008-05-25 06:00 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-05-24 07:03 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-23 16:33 --------- d-----w C:\Program Files\Windows Live
2008-05-23 16:32 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-05-23 16:21 46,592 ----a-w C:\e4bc1k.exe
2008-05-22 18:33 --------- d-----w C:\Program Files\HP
2008-05-22 18:33 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard
2008-05-22 18:31 43,488 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2008-05-22 18:31 --------- d-----w C:\Program Files\Fichiers communs\HP
2008-05-22 16:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-21 19:44 --------- d-----w C:\Documents and Settings\user\Application Data\SecondLife
2008-05-21 18:11 --------- d-----w C:\Program Files\Motive
2008-05-21 18:11 --------- d-----w C:\Program Files\Club-Internet
2008-05-21 16:14 --------- d-----w C:\Program Files\Fichiers communs\Motive
2008-05-21 16:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Motive
2008-05-21 16:13 --------- d-----w C:\Program Files\Common Files
2008-05-21 16:07 155,995 ----a-w C:\WINDOWS\java\Packages\CNTR71JB.ZIP
2008-05-21 12:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\ma-config.com
2008-05-21 12:45 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-21 12:45 --------- d-----w C:\Program Files\Realtek
2008-05-21 12:45 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-05-21 12:19 --------- d-----w C:\Program Files\Marvell
2008-05-21 11:36 --------- d-----w C:\Program Files\Intel
2008-05-21 11:23 --------- d-----w C:\Program Files\ma-config.com
2008-05-20 16:24 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-20 16:23 --------- d-----w C:\Program Files\Services en ligne
2008-05-13 01:51 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-13 01:51 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-30 15:27 442,368 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-03 05:46 13529088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-03 05:46 86016]
"Motive SmartBridge"="C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe" [2006-04-21 15:41 438359]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-06-25 11:24 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-06-26 18:50 212992]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 01:06 487424]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-07-12 22:03 413696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2008-07-13 14:37 2132112]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 14:31 16857600 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Program Files\\THQ\\Frontlines-Fuel of War Demo\\Binaries\\FFOW-MPDemo.exe"=

S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-05-19 10:01]
S3 se44bus;Sony Ericsson Device 068 driver (WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30 14:58]
S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30 14:58]
S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30 14:58]
S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30 14:58]
S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30 14:58]
S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30 14:58]
S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30 14:58]
S3 VNUWL5B;VIA Networking Technologies USB Wireless LAN Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\VNUWL5B.SYS [2006-09-19 14:34]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setup\rsrc\Autorun.exe
\Shell\dinstall\command - E:\Directx\dxsetup.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-12 20:05:17 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-22 18:38:06 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1211481323.job"
- C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 1300 series#1211481323
"2008-07-12 10:43:06 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1213267215.job"
- C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 1300 series#1213267215
"2008-07-13 11:22:07 C:\WINDOWS\Tasks\WebReg 20080713132206.job"
- C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exeX/TaskName 20080713132206 /N
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-DXDllRegExe - dxdllreg.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-13 17:09:35
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-13 17:14:31 - machine was rebooted [user]
ComboFix-quarantined-files.txt 2008-07-13 15:13:28

Pre-Run: 299,141,906,432 octets libres
Post-Run: 299,317,370,880 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

267 --- E O F --- 2008-07-13 01:03:28

C'est rassurant ???

Caro

Caro75 · Answer

ARRRGGGGHHHHH

Pourtant, Geoffrey il m'a filé un sacré coup de main...

Quelles "crasses" restent et comment les enlever sans tout briser ??

Merci à tous

Bisous 

Caro

Caro75 · Answer

Un hijack T ????

Merci à toi DID mais j'ai tout enlevé avec Toolscreen....

Bouh, bouh, bouh...

Caro (déprimée après 12 heures à fixer l'écran qui lui reste imperturbable...)

Fenetres de pub......

32 réponses

Discussions similaires

Newsletters