Virus party : rapport MSNfix

http://www.technicland.com/malpolitus.swf

bonsoir,

Normalement, tu a été conpletement desinfecter, MAintenant si tu en doute, essai de relancer msnfix encor un coup, mais il ne devrait plu trouver grand chose.

bonjour redemare en mode sans echec c'est important et passe a l'option 2 de msnfix copie ton ordi demande un reboot execute ,attend , copie et colle le raport dans ta prochaine reponse

bonjours sophie/benjamin,

peux tu refaire msnfix et poster le rapport ici stp car apparament un fichier n´as pas pu etre supprimé lors de son passage...

- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt

@+

Merci pour vos réponses si rapides! effectivement Marie il manque la fin du rapport, le voici au complet

MSNFix 1.601

C:\Documents and Settings\Benjamin\Bureau\MSNFix
Fix exécuté le 07/12/2007 - 15:11:54,26 By Benjamin
mode normal

************************ Recherche les fichiers présents

... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton
... C:\Program Files\Fichiers communs\Carlson\carlton
... C:\PROGRA~1\FICHIE~1\Carlson\carlton
... C:\8e9w3l6u1g1.exe
... C:\WINDOWS\msimn.exe
... C:\WINDOWS\system32\microsoft\backup.ftp
... C:\WINDOWS\system32\microsoft\backup.tftp
... C:\WINDOWS\party_jpg.zip

************************ MSNCHK ***** /!\ beta test /!\

[!] C:\WINDOWS\party_jpg.zip is INFECTED

************************ Recherche les dossiers présents

... C:\Program Files\Fichiers communs\Carlson\
... C:\PROGRA~1\FICHIE~1\Carlson\
... C:\Temp\

************************ Suppression des fichiers

.. OK ... C:\DOCUME~1\ALLUSE~1\MENUDM~1\carlton
.. OK ... C:\Program Files\Fichiers communs\Carlson\carlton
.. OK ... C:\PROGRA~1\FICHIE~1\Carlson\carlton
.. OK ... C:\8e9w3l6u1g1.exe
/!\ ... C:\WINDOWS\msimn.exe
.. OK ... C:\WINDOWS\system32\microsoft\backup.ftp
.. OK ... C:\WINDOWS\system32\microsoft\backup.tftp
.. OK ... C:\WINDOWS\party_jpg.zip

************************ Suppression des dossiers

.. OK ... C:\Program Files\Fichiers communs\Carlson\
.. OK ... C:\PROGRA~1\FICHIE~1\Carlson\
.. OK ... C:\Temp\

************************ Nettoyage du registre

Les fichiers encore présents seront supprimés au prochain redémarrage

************************ Suppression des fichiers

.. OK ... C:\WINDOWS\msimn.exe

************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[C:\eMule0.47c-Installer.exe] D388CDC4DDA65263F7DB385989AF7160
[C:\setupfre.exe] 344BFAC571828B079F2595FAC6FC1458
[C:\spybotsd15.exe] 9286D3952F8CB08AD1BB4F3122E144CC
[C:\PROGRA~1\Install_Messenger.exe] 4408BC2F0845D823E24B8C8B1B69895E
[C:\PROGRA~1\uTorrent-1.6-install.exe] A4FA400AEC5E3E6AFD9ECF5774F8CAD4

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier [b] C:\DOCUME~1\Benjamin\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 07122007_15165081.zip

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------

J'ai relancer MSNfix et cette fois il n'a rien détécté "infection absente" suis-je débarassée?

salut sophie/benjamin,

cette fois ci c´est ok pour msnfix, tous les fichiers on bien ete supprimé.

peux tu envoyé le fichier C:\DOCUME~1\Benjamin\Bureau\Upload_Me.zip sur cette adresse : http://upload.changelog.fr ca serait cool de ta part : c´est pour le crateur du fix...

puis fais ceci :

Télécharge HijackThis ici :

-> https://www.zebulon.fr/telechargements/securite/systeme/hijackthis.html

Tutoriel d´installation (images) :

-> http://pchelpbordeaux.free.fr/tuto.html

Tutoriel d´utilisation (video) :

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

Post le rapport généré ici stp...

@+

Voilà le rapport, merci beaucoup pour votre aide :-)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:27:12, on 07/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\EPSON\ESM2\eEBSVC.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\jnkiaeis.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\PnkBstrB.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\utorrent\utorrent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
F:\daemon tools\daemon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\Benjamin\LOCALS~1\Temp\Rar$EX00.562\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [3cd8c406] rundll32.exe "C:\WINDOWS\System32\wrutfrcb.dll",b
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Instant Access] C:\WINDOWS\System32\prodsrvs.exe /res
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent\utorrent.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "F:\daemon tools\daemon.exe" -lang 1033
O4 - HKCU\..\Policies\Explorer\Run: [{3CD8C4A9-06D2-1036-0804-040209240021}] "C:\Program Files\Fichiers communs\{3CD8C4A9-06D2-1036-0804-040209240021}\Update.exe" mc-110-12-0000144
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O20 - AppInit_DLLs:
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\jnkiaeis.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\EPSON\ESM2\eEBSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe (file missing)

re,

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

voilà le rapport combofix mais depuis que j'ai fait le scan mon pc rame....

ComboFix 07-12-07.3 - Benjamin 2007-12-07 19:38:37.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.159 [GMT 1:00]
Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fichiers communs\{3CD8C~1
C:\Program Files\Fichiers communs\{3CD8C~2
C:\Program Files\Fichiers communs\uninstall information
C:\Program Files\ipwindows
C:\Program Files\ipwindows\pop154.tmp
C:\Program Files\ipwindows\pop161.tmp
C:\Program Files\ipwindows\pop165.tmp
C:\Program Files\ipwindows\pop166.tmp
C:\Program Files\ipwindows\pop167.tmp
C:\Program Files\ipwindows\pop16B.tmp
C:\Program Files\ipwindows\pop16C.tmp
C:\Program Files\ipwindows\pop16E.tmp
C:\Program Files\ipwindows\pop171.tmp
C:\Program Files\ipwindows\pop17C.tmp
C:\Program Files\ipwindows\pop180.tmp
C:\Program Files\ipwindows\pop181.tmp
C:\Program Files\ipwindows\pop18A.tmp
C:\Program Files\ipwindows\pop18D.tmp
C:\Program Files\ipwindows\pop18E.tmp
C:\Program Files\ipwindows\pop193.tmp
C:\Program Files\ipwindows\pop194.tmp
C:\Program Files\ipwindows\pop195.tmp
C:\Program Files\ipwindows\pop198.tmp
C:\Program Files\ipwindows\pop1A1.tmp
C:\Program Files\ipwindows\pop1A5.tmp
C:\Program Files\ipwindows\pop1B1.tmp
C:\Program Files\ipwindows\pop1BA.tmp
C:\Program Files\ipwindows\set152.tmp
C:\Program Files\ipwindows\set153.tmp
C:\Program Files\ipwindows\Uninst.exe
C:\Program Files\ipwins
C:\Program Files\ipwins\pop101.tmp
C:\Program Files\ipwins\pop11D.tmp
C:\Program Files\ipwins\pop11F.tmp
C:\Program Files\ipwins\Uninst.exe
C:\WINDOWS\pack.epk
C:\WINDOWS\system32\bcrfturw.ini
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\f3
C:\WINDOWS\system32\h1
C:\WINDOWS\system32\jkkjghg.dll
C:\WINDOWS\system32\khfebyw.dll
C:\WINDOWS\system32\l4
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\rheqtvmd.dll
C:\WINDOWS\System32\sstts.dll
C:\WINDOWS\system32\sttss.ini
C:\WINDOWS\system32\sttss.ini2
C:\WINDOWS\system32\svchosts.lzma
C:\WINDOWS\system32\whrflouw.dll
C:\WINDOWS\system32\wrutfrcb.dll
C:\WINDOWS\tmlpcert2007

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_COM+_MESSAGES
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_IPRIP
-------\DomainService
-------\Iprip

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))))))))
.

2007-12-07 19:43 . 2007-12-07 19:43 66,055 --ah----- C:\WINDOWS\system32\yxst.exe
2007-12-07 19:43 . 2007-12-07 19:43 59,392 --a------ C:\WINDOWS\tr941.exe
2007-12-07 19:43 . 2007-12-07 19:43 50,448 --ah----- C:\WINDOWS\system32\oqbjhmv.exe
2007-12-07 19:43 . 2007-12-07 19:43 37,376 --a------ C:\WINDOWS\system32\awtqnkh.dll
2007-12-07 19:43 . 2007-12-07 19:43 36,864 --ah----- C:\WINDOWS\system32\daicsnc.exe
2007-12-07 09:28 . 2007-12-07 09:28 74,304 --a------ C:\WINDOWS\system32\wopvimtf.exe
2007-12-06 18:55 . 2007-12-07 09:20 831,657 ---hs---- C:\WINDOWS\system32\hswgpftq.ini
2007-12-06 18:45 . 2007-12-06 18:45 74,304 --a------ C:\WINDOWS\system32\jnkiaeis.exe
2007-12-06 17:40 . 2007-12-06 17:40 107 --a------ C:\WINDOWS\wininit.ini
2007-12-06 16:51 . 2007-12-06 16:53 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe
2007-12-05 22:24 . 2007-12-07 13:03 0 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-12-05 18:34 . 2007-12-05 18:34 <REP> d-------- C:\Program Files\wide
2007-12-05 18:34 . 2007-12-05 18:34 <REP> d-------- C:\Program Files\Fichiers communs\wide
2007-12-05 18:32 . 2007-12-05 18:32 <REP> d-------- C:\WINDOWS\system32\daSgo01
2007-11-21 10:02 . 2007-12-06 00:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-21 10:02 . 2007-11-21 10:02 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-17 10:05 . 2007-11-17 10:05 0 --a------ C:\WINDOWS\htba

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 18:43 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent
2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES
2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems
2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink
2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro
2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT
2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe
2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe
2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys
2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe
----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe

----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe

----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak\realsched.exe

----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe

----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe

----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe
----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe

----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe

----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe

----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe

----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe

.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42D2C2E9-E83F-47CA-AA39-B1471152D444}]
C:\Program Files\Internet Explorer\menorusC:\WINDOWS\System32\l4\swdrv83122.exe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1412445-4FF8-410e-8D24-F2CF86B171A4}]
C:\Program Files\PeDevice\PeDev.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
"µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47]
"DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" []
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"Windows Logon Application"="C:\WINDOWS\System32\logon.exe" [2002-08-29 12:45]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{9C0ADB68-353A-61DD-ED09-1D8003A61111}"= C:\WINDOWS\system32\kb1111p.dll [1999-01-01 01:01 18944]
"{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\System32\awtqnkh.dll [2007-12-07 19:43 37376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqnkh]
awtqnkh.dll 2007-12-07 19:43 37376 C:\WINDOWS\system32\awtqnkh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe"
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe
S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys
S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT
*Newly Created Service* - SHAREDACCESS
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-07 15:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job"
- C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 19:43:44
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 19:46:27 - machine was rebooted
.
--- E O F ---

re

je me demande, ce que tu as bien pu faire pour etre autant infecté?!

commence par installer un par feu; ca limitera les degats...

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

Copie le texte ci-dessous :

File::
C:\WINDOWS\system32\yxst.exe
C:\WINDOWS\tr941.exe
C:\WINDOWS\system32\oqbjhmv.exe
C:\WINDOWS\system32\awtqnkh.dll
C:\WINDOWS\system32\daicsnc.exe
C:\WINDOWS\system32\wopvimtf.exe
C:\WINDOWS\system32\hswgpftq.ini
C:\WINDOWS\system32\jnkiaeis.exe
C:\WINDOWS\wininit.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
C:\WINDOWS\htba
C:\Program Files\PeDevice\PeDev.dll
C:\WINDOWS\System32\logon.exe
C:\WINDOWS\System32\awtqnkh.dll
C:\WINDOWS\system32\kb1111p.dll
C:\WINDOWS\system32\awtqnkh.dll

Folder::
C:\Program Files\wide
C:\Program Files\Fichiers communs\wide
C:\Program Files\PeDevice

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42D2C2E9-E83F-47CA-AA39-B1471152D444}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1412445-4FF8-410e-8D24-F2CF86B171A4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Logon Application"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{9C0ADB68-353A-61DD-ED09-1D8003A61111}"=-
"{ED203331-9C33-49D8-8714-D24A366A04EC}"= -
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqnkh]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt2.

S'il n'y a pas de rédémarrage, poste quand même le rapport.

et :

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

donc post le rapport de combofix2 et celui de sdfix

@+

Rapport combofix

ComboFix 07-12-07.3 - Benjamin 2007-12-07 20:58:06.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.162 [GMT 1:00]
Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Benjamin\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\PeDevice\PeDev.dll
C:\WINDOWS\htba
C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\System32\awtqnkh.dll
C:\WINDOWS\system32\awtqnkh.dll
C:\WINDOWS\system32\daicsnc.exe
C:\WINDOWS\system32\hswgpftq.ini
C:\WINDOWS\system32\jnkiaeis.exe
C:\WINDOWS\system32\kb1111p.dll
C:\WINDOWS\System32\logon.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\oqbjhmv.exe
C:\WINDOWS\system32\wopvimtf.exe
C:\WINDOWS\system32\yxst.exe
C:\WINDOWS\tr941.exe
C:\WINDOWS\wininit.ini
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fichiers communs\wide
C:\Program Files\wide
C:\Program Files\wide\Activate.exe
C:\Program Files\wide\Config\pgs.xml
C:\Program Files\wide\Dat\BkSites.dat
C:\Program Files\wide\Dat\incmp.dat
C:\Program Files\wide\Dat\index.dat
C:\Program Files\wide\Engines\plugins\BORLNDMM.DLL
C:\Program Files\wide\Engines\plugins\SCANADWR.DLL
C:\Program Files\wide\Engines\plugins\SCANBCDR.DLL
C:\Program Files\wide\Engines\plugins\SCANDLDR.DLL
C:\Program Files\wide\Engines\plugins\SCANDOS1.DLL
C:\Program Files\wide\Engines\plugins\SCANEMUL.DLL
C:\Program Files\wide\Engines\plugins\SCANFUNC.DLL
C:\Program Files\wide\Engines\plugins\SCANKRNL.DLL
C:\Program Files\wide\FMTR.sys
C:\Program Files\wide\fopnl.dll
C:\Program Files\wide\Graphics\cross.gif
C:\Program Files\wide\Graphics\ga6p.gif
C:\Program Files\wide\Graphics\main.ico
C:\Program Files\wide\Graphics\mini.ico
C:\Program Files\wide\Graphics\support.ico
C:\Program Files\wide\Graphics\uninstall.ico
C:\Program Files\wide\LA\License.rtf
C:\Program Files\wide\Restart.exe
C:\Program Files\wide\rpt.dll
C:\Program Files\wide\RTasks.exe
C:\Program Files\wide\scnkrnl.dll
C:\Program Files\wide\sqlite3.dll
C:\Program Files\wide\Tools\IEFWBHO.dll
C:\Program Files\wide\unins000.dat
C:\Program Files\wide\unins000.exe
C:\Program Files\wide\Up\gup.exe
C:\WINDOWS\htba
C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\system32\accdd.ini
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\awtqnkh.dll
C:\WINDOWS\system32\cbxuvus.dll
C:\WINDOWS\system32\ddcbcyx.dll
C:\WINDOWS\System32\ddcca.dll
C:\WINDOWS\system32\efcdcda.dll
C:\WINDOWS\system32\hswgpftq.ini
C:\WINDOWS\system32\iexplore.exe
C:\WINDOWS\system32\jnkiaeis.exe
C:\WINDOWS\system32\kb1111p.dll
C:\WINDOWS\system32\khfcdax.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\opnkkjh.dll
C:\WINDOWS\system32\wopvimtf.exe
C:\WINDOWS\system32\yaywtrr.dll
C:\WINDOWS\system32\yayywxw.dll
C:\WINDOWS\system32\yxst.exe
C:\WINDOWS\wininit.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))))))))
.

2007-12-07 21:07 . 2007-12-07 21:07 32,456 --a------ C:\WINDOWS\system32\veyruyh.exe
2007-12-07 20:52 . 2007-12-07 20:52 32,456 --a------ C:\WINDOWS\system32\bgvnj.exe
2007-12-07 20:48 . 2007-12-07 20:48 <REP> d-------- C:\Program Files\Sunbelt Software
2007-12-07 20:47 . 2007-12-07 20:48 6,575,800 --a------ C:\Sunbelt-Personal-Firewall.exe
2007-12-07 20:38 . 2007-12-07 20:38 32,456 --a------ C:\WINDOWS\system32\etxpfit.exe
2007-12-07 20:36 . 2007-12-07 20:36 <REP> d--h----- C:\Program Files\Fichiers communs\Carlson
2007-12-07 20:36 . 2007-12-07 20:54 45,632 --a------ C:\8e9w3l6u1g1.exe
2007-12-07 20:35 . 2007-12-07 20:35 569,856 -r-hs---- C:\WINDOWS\Mrshield.exe
2007-12-07 20:35 . 2007-12-07 20:35 24,916 --ah----- C:\WINDOWS\system32\gsjyxsl.exe
2007-12-07 20:20 . 2007-12-07 20:20 16,820 --ah----- C:\WINDOWS\system32\dlhiyas.exe
2007-12-07 20:18 . 2007-12-07 20:18 32,456 --a------ C:\WINDOWS\system32\mwoyaetd.exe
2007-12-07 20:09 . 2007-12-07 20:09 129 --a------ C:\WINDOWS\system32\bhkkpvt.bat
2007-12-07 20:08 . 2007-12-07 20:09 66,055 --ah----- C:\WINDOWS\system32\hvtmpqlh.exe
2007-12-07 20:05 . 2007-12-07 20:05 32,456 --a------ C:\WINDOWS\system32\buyia.exe
2007-12-07 19:57 . 2007-12-07 19:57 6,504 --ah----- C:\WINDOWS\system32\dcipnt.exe
2007-12-07 19:51 . 2007-12-07 19:52 33,256 --ah----- C:\WINDOWS\system32\sfbzqd.exe
2007-12-07 19:49 . 2007-12-07 19:49 32,456 --a------ C:\WINDOWS\system32\nwma.exe
2007-12-07 19:45 . 2007-12-07 19:46 4,968 --ah----- C:\WINDOWS\system32\haiprc.exe
2007-12-07 19:43 . 2007-12-07 19:43 1,460 --ah----- C:\WINDOWS\system32\jtdfuf.exe
2007-12-06 16:51 . 2007-12-06 16:53 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe
2007-12-05 18:32 . 2007-12-05 18:32 <REP> d-------- C:\WINDOWS\system32\daSgo01

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 20:07 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent
2007-12-07 20:05 44,032 ----a-w C:\WINDOWS\system32\ftp.exe
2007-12-07 20:05 17,920 ----a-w C:\WINDOWS\system32\tftp.exe
2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll
2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES
2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems
2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink
2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro
2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT
2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe
2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe
2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys
2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2007-12-07_19.44.48.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\ARPPRODUCTICON.exe
+ 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe
+ 2007-12-07 19:49:05 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe
- 2007-12-03 08:34:00 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2007-12-07 19:35:54 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2007-12-03 08:34:00 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2007-12-07 19:35:54 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2007-12-03 08:34:00 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-12-07 19:35:54 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-12-07 14:08:09 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe
+ 2007-12-07 20:05:54 44,032 -c--a-w C:\WINDOWS\system32\dllcache\ftp.exe
- 2001-08-28 14:00:00 17,920 -c--a-w C:\WINDOWS\system32\dllcache\tftp.exe
+ 2007-12-07 20:05:54 17,920 -c--a-w C:\WINDOWS\system32\dllcache\tftp.exe
+ 2007-04-26 09:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys
+ 2007-04-26 09:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys
- 2007-12-07 18:43:21 208,513 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2007-12-07 20:06:15 208,518 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2002-08-29 11:45:10 64,902 ---h--w C:\WINDOWS\system32\lssas.exe
- 2007-10-28 10:16:38 72,016 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-12-07 18:44:40 72,016 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-10-28 10:16:38 85,020 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2007-12-07 18:44:40 85,020 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2007-10-28 10:16:38 431,880 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-12-07 18:44:40 431,880 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-10-28 10:16:38 501,828 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2007-12-07 18:44:40 501,828 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2007-12-07 20:05:15 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5d0.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe
----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe

----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe

----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak\realsched.exe

----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe

----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe

----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe
----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe

----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe

----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe

----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe

----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe

.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
"µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47]
"DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" []
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"Application Layer Gateway Service"="C:\WINDOWS\System32\algs.exe" []
"Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [2002-08-29 12:45]
"Advanced DHTML Enable"="C:\WINDOWS\System32\veyruyh.exe" [2007-12-07 21:07]
"Spooler SubSystem App"="C:\WINDOWS\System32\spoolsvc.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe %WINDIR%\\Mrshield.exe"
"SFCDisable"=dword:ffffff9d

R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys
R2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe"
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe"
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe
S2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys
S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-07 19:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job"
- C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 21:07:23
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 21:09:57 - machine was rebooted
C:\ComboFix2.txt ... 2007-12-07 19:46
.
--- E O F ---

post le rapport de sdfix et refais un combofix et post les deux rapports stp

rapport sdfix

SDFix: Version 1.117

Run by Benjamin on 07/12/2007 at 21:19

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
Microsoft register shield

Path:
"C:\WINDOWS\Mrshield.exe"

Microsoft register shield - Deleted

C:\WINDOWS\system32\Microsoft\backup.ftp Found
C:\WINDOWS\system32\Microsoft\backup.tftp Found

Checking files:

Genuine:
C:\WINDOWS\system32\Microsoft\backup.tftp

Dummy:
C:\WINDOWS\system32\Microsoft\backup.ftp
C:\WINDOWS\system32\ftp.exe
C:\WINDOWS\system32\tftp.exe
C:\WINDOWS\system32\dllcache\ftp.exe
C:\WINDOWS\system32\dllcache\tftp.exe

Files copied to SDFix\Backups

Restoring files if backups are found

Final Check:

Genuine:
C:\WINDOWS\system32\Microsoft\backup.tftp
C:\WINDOWS\system32\tftp.exe
C:\WINDOWS\system32\dllcache\tftp.exe

Dummy:
C:\WINDOWS\system32\Microsoft\backup.ftp
C:\WINDOWS\system32\ftp.exe
C:\WINDOWS\system32\dllcache\ftp.exe

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\Program Files\Fichiers communs\Carlson\carlton - Deleted
C:\WINDOWS\Mrshield.exe - Deleted
C:\WINDOWS\system32\algs.exe - Deleted
C:\WINDOWS\system32\i - Deleted
C:\WINDOWS\system32\lssas.exe - Deleted
C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted
C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted
C:\WINDOWS\system32\setup_74474.exe - Deleted
C:\WINDOWS\system32\TFTP844 - Deleted
C:\WINDOWS\Temp\removalfile.bat - Deleted

Folder C:\Program Files\Fichiers communs\Carlson - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 21:25:22
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

IPC error: 2 Le fichier spécifié est introuvable.
scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:eaf5973b
"s2"=dword:5ea2f835
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000001
"ujdew"=hex:cb,63,eb,6e,4b,53,69,2c,0c,94,94,40,0e,dc,a8,5f,76,78,7c,4a,b9,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:86,97,a0,18,97,1c,d3,91,56,c0,21,ef,f8,62,62,0b,bb,fa,43,da,00,..
"p0"="F:\daemon tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,a4,3a,e1,df,05,33,9c,48,44,c6,e2,6e,98,a5,0c,36,6a,..
"khjeh"=hex:b5,a2,e0,6b,4f,4f,73,e9,a9,96,aa,8e,61,10,53,85,06,af,94,a4,af,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:fb,47,fa,ea,4d,1e,e8,0e,6d,bf,01,7d,14,38,b3,bd,42,82,59,e4,3e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000001
"ujdew"=hex:cb,63,eb,6e,4b,53,69,2c,0c,94,94,40,0e,dc,a8,5f,76,78,7c,4a,b9,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:86,97,a0,18,97,1c,d3,91,56,c0,21,ef,f8,62,62,0b,bb,fa,43,da,00,..
"p0"="F:\daemon tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,a4,3a,e1,df,05,33,9c,48,44,c6,e2,6e,98,a5,0c,36,6a,..
"khjeh"=hex:b5,a2,e0,6b,4f,4f,73,e9,a9,96,aa,8e,61,10,53,85,06,af,94,a4,af,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:fb,47,fa,ea,4d,1e,e8,0e,6d,bf,01,7d,14,38,b3,bd,42,82,59,e4,3e,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000091
"TracesSuccessful"=dword:00000002

scanning hidden files ...

C:\Documents and Settings\Benjamin\Local Settings\Application Data\Microsoft\Messenger\baj14@hotmail.fr\SharingMetadata\julienmarie55@hotmail.fr\DFSR\Staging\CS{D7666AA6-430C-1755-FD5E-754704CD9672}\01\10-{D7666AA6-430C-1755-FD5E-754704CD9672}-v1-{741C0C78-B3A3-4962-90CF-50961B2A2F72}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
C:\Documents and Settings\Benjamin\Local Settings\Application Data\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims™ 2 : Boit@Look.lnk 540 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 7 Dec 2007 6,504 A..H. --- "C:\WINDOWS\system32\dcipnt.exe"
Fri 7 Dec 2007 16,820 A..H. --- "C:\WINDOWS\system32\dlhiyas.exe"
Thu 19 May 2005 56 ..SHR --- "C:\WINDOWS\system32\E6766994AD.sys"
Fri 7 Dec 2007 24,916 A..H. --- "C:\WINDOWS\system32\gsjyxsl.exe"
Fri 7 Dec 2007 4,968 A..H. --- "C:\WINDOWS\system32\haiprc.exe"
Fri 7 Dec 2007 66,055 A..H. --- "C:\WINDOWS\system32\hvtmpqlh.exe"
Fri 7 Dec 2007 1,460 A..H. --- "C:\WINDOWS\system32\jtdfuf.exe"
Sun 20 Aug 2006 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Fri 7 Dec 2007 28,328 A..H. --- "C:\WINDOWS\system32\kkhbef.exe"
Fri 7 Dec 2007 33,256 A..H. --- "C:\WINDOWS\system32\sfbzqd.exe"
Mon 6 Nov 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 13 Apr 2006 74,240 ...H. --- "C:\Documents and Settings\Benjamin\Mes documents\~WRL0882.tmp"
Wed 23 May 2007 39,424 ...H. --- "C:\Documents and Settings\Benjamin\Mes documents\~WRL1516.tmp"
Wed 23 May 2007 24,064 ...H. --- "C:\Documents and Settings\Benjamin\Mes documents\~WRL2617.tmp"
Wed 23 May 2007 48,128 ...H. --- "C:\Documents and Settings\Benjamin\Mes documents\~WRL2922.tmp"

Finished!

rapport combofix

ComboFix 07-12-07.3 - Benjamin 2007-12-07 19:38:37.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.159 [GMT 1:00]
Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fichiers communs\{3CD8C~1
C:\Program Files\Fichiers communs\{3CD8C~2
C:\Program Files\Fichiers communs\uninstall information
C:\Program Files\ipwindows
C:\Program Files\ipwindows\pop154.tmp
C:\Program Files\ipwindows\pop161.tmp
C:\Program Files\ipwindows\pop165.tmp
C:\Program Files\ipwindows\pop166.tmp
C:\Program Files\ipwindows\pop167.tmp
C:\Program Files\ipwindows\pop16B.tmp
C:\Program Files\ipwindows\pop16C.tmp
C:\Program Files\ipwindows\pop16E.tmp
C:\Program Files\ipwindows\pop171.tmp
C:\Program Files\ipwindows\pop17C.tmp
C:\Program Files\ipwindows\pop180.tmp
C:\Program Files\ipwindows\pop181.tmp
C:\Program Files\ipwindows\pop18A.tmp
C:\Program Files\ipwindows\pop18D.tmp
C:\Program Files\ipwindows\pop18E.tmp
C:\Program Files\ipwindows\pop193.tmp
C:\Program Files\ipwindows\pop194.tmp
C:\Program Files\ipwindows\pop195.tmp
C:\Program Files\ipwindows\pop198.tmp
C:\Program Files\ipwindows\pop1A1.tmp
C:\Program Files\ipwindows\pop1A5.tmp
C:\Program Files\ipwindows\pop1B1.tmp
C:\Program Files\ipwindows\pop1BA.tmp
C:\Program Files\ipwindows\set152.tmp
C:\Program Files\ipwindows\set153.tmp
C:\Program Files\ipwindows\Uninst.exe
C:\Program Files\ipwins
C:\Program Files\ipwins\pop101.tmp
C:\Program Files\ipwins\pop11D.tmp
C:\Program Files\ipwins\pop11F.tmp
C:\Program Files\ipwins\Uninst.exe
C:\WINDOWS\pack.epk
C:\WINDOWS\system32\bcrfturw.ini
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\f3
C:\WINDOWS\system32\h1
C:\WINDOWS\system32\jkkjghg.dll
C:\WINDOWS\system32\khfebyw.dll
C:\WINDOWS\system32\l4
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\rheqtvmd.dll
C:\WINDOWS\System32\sstts.dll
C:\WINDOWS\system32\sttss.ini
C:\WINDOWS\system32\sttss.ini2
C:\WINDOWS\system32\svchosts.lzma
C:\WINDOWS\system32\whrflouw.dll
C:\WINDOWS\system32\wrutfrcb.dll
C:\WINDOWS\tmlpcert2007

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_COM+_MESSAGES
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_IPRIP
-------\DomainService
-------\Iprip

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))))))))
.

2007-12-07 19:43 . 2007-12-07 19:43 66,055 --ah----- C:\WINDOWS\system32\yxst.exe
2007-12-07 19:43 . 2007-12-07 19:43 59,392 --a------ C:\WINDOWS\tr941.exe
2007-12-07 19:43 . 2007-12-07 19:43 50,448 --ah----- C:\WINDOWS\system32\oqbjhmv.exe
2007-12-07 19:43 . 2007-12-07 19:43 37,376 --a------ C:\WINDOWS\system32\awtqnkh.dll
2007-12-07 19:43 . 2007-12-07 19:43 36,864 --ah----- C:\WINDOWS\system32\daicsnc.exe
2007-12-07 09:28 . 2007-12-07 09:28 74,304 --a------ C:\WINDOWS\system32\wopvimtf.exe
2007-12-06 18:55 . 2007-12-07 09:20 831,657 ---hs---- C:\WINDOWS\system32\hswgpftq.ini
2007-12-06 18:45 . 2007-12-06 18:45 74,304 --a------ C:\WINDOWS\system32\jnkiaeis.exe
2007-12-06 17:40 . 2007-12-06 17:40 107 --a------ C:\WINDOWS\wininit.ini
2007-12-06 16:51 . 2007-12-06 16:53 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe
2007-12-05 22:24 . 2007-12-07 13:03 0 --a------ C:\WINDOWS\system32\mcrh.tmp
2007-12-05 18:34 . 2007-12-05 18:34 <REP> d-------- C:\Program Files\wide
2007-12-05 18:34 . 2007-12-05 18:34 <REP> d-------- C:\Program Files\Fichiers communs\wide
2007-12-05 18:32 . 2007-12-05 18:32 <REP> d-------- C:\WINDOWS\system32\daSgo01
2007-11-21 10:02 . 2007-12-06 00:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-21 10:02 . 2007-11-21 10:02 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-17 10:05 . 2007-11-17 10:05 0 --a------ C:\WINDOWS\htba

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 18:43 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent
2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES
2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems
2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink
2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro
2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT
2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe
2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe
2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys
2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe
----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe

----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe

----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak\realsched.exe

----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe

----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe

----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe
----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe

----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe

----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe

----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe

----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe

.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42D2C2E9-E83F-47CA-AA39-B1471152D444}]
C:\Program Files\Internet Explorer\menorusC:\WINDOWS\System32\l4\swdrv83122.exe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E1412445-4FF8-410e-8D24-F2CF86B171A4}]
C:\Program Files\PeDevice\PeDev.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
"µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47]
"DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" []
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"Windows Logon Application"="C:\WINDOWS\System32\logon.exe" [2002-08-29 12:45]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{9C0ADB68-353A-61DD-ED09-1D8003A61111}"= C:\WINDOWS\system32\kb1111p.dll [1999-01-01 01:01 18944]
"{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\System32\awtqnkh.dll [2007-12-07 19:43 37376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqnkh]
awtqnkh.dll 2007-12-07 19:43 37376 C:\WINDOWS\system32\awtqnkh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe"
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe
S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys
S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT
*Newly Created Service* - SHAREDACCESS
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-07 15:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job"
- C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 19:43:44
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 19:46:27 - machine was rebooted
.
--- E O F ---

re,

peux tu me poster le rapport de combofix numero 3 car la c´est le meme que plus haut

@+

je n'obtiens pas de rapport combofix par contre j'ai un dossier avenger qui s'est crée et ceci:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vkquwexg

*******************

Script file located at: \??\C:\ComboFix\ComboDel.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\xxywwwx.dll not found!
File move operation C:\WINDOWS\system32\xxywwwx.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\xxywwwx.dll.vir failed!

Could not process line:
C:\WINDOWS\system32\xxywwwx.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\xxywwwx.dll.vir
Status: 0xc0000034

Completed script processing.

*******************

Finished! Terminate.

non mais j´allucine je t´ai jamais demandé d´utilisé avenger?

fais ceci :

click sur demarrer > executer >

dans la boite de dialogue tape ceci : Combofix /u et valide par ok remarque qu´il y a un espace en combofix et /u

puis choisie 2 a la demande

pour etre sur qu´il n´est plus present

verifie qu´il n´est plus sur ton bureau

et

regarde en suite a la racine de c et verifie qu´il n´y a pas de combofix ou de qoobox et pas de combofix.txt

puis

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

Je sais bien que tu ne m'as dit dit d'utiliser avenger et je ne l'ai pas fait!

voila le rapport et merci pour ton aide et ta patience

ComboFix 07-12-07.3 - Benjamin 2007-12-07 23:07:54.6 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.164 [GMT 1:00]
Running from: C:\Documents and Settings\Benjamin\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))))))))
.

2007-12-07 22:25 . 2007-12-07 22:25 <REP> d--h----- C:\Program Files\Fichiers communs\Carlson
2007-12-07 22:22 . 2007-12-07 22:22 569,856 -r-hs---- C:\WINDOWS\Mrshield.exe
2007-12-07 22:21 . 2007-12-07 22:22 59,884 --ah----- C:\WINDOWS\system32\oqvrp.exe
2007-12-07 21:18 . 2007-12-07 21:18 <REP> d-------- C:\WINDOWS\ERUNT
2007-12-07 21:16 . 2007-12-07 21:16 165 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-07 21:15 . 2007-12-07 21:15 28,328 --ah----- C:\WINDOWS\system32\kkhbef.exe
2007-12-07 21:07 . 2007-12-07 21:07 32,456 --a------ C:\WINDOWS\system32\veyruyh.exe
2007-12-07 20:52 . 2007-12-07 20:52 32,456 --a------ C:\WINDOWS\system32\bgvnj.exe
2007-12-07 20:48 . 2007-12-07 20:48 <REP> d-------- C:\Program Files\Sunbelt Software
2007-12-07 20:47 . 2007-12-07 20:48 6,575,800 --a------ C:\Sunbelt-Personal-Firewall.exe
2007-12-07 20:38 . 2007-12-07 20:38 32,456 --a------ C:\WINDOWS\system32\etxpfit.exe
2007-12-07 20:36 . 2007-12-07 22:48 45,632 --a------ C:\8e9w3l6u1g1.exe
2007-12-07 20:35 . 2007-12-07 20:35 24,916 --ah----- C:\WINDOWS\system32\gsjyxsl.exe
2007-12-07 20:20 . 2007-12-07 20:20 16,820 --ah----- C:\WINDOWS\system32\dlhiyas.exe
2007-12-07 20:18 . 2007-12-07 20:18 32,456 --a------ C:\WINDOWS\system32\mwoyaetd.exe
2007-12-07 20:09 . 2007-12-07 20:09 129 --a------ C:\WINDOWS\system32\bhkkpvt.bat
2007-12-07 20:08 . 2007-12-07 20:09 66,055 --ah----- C:\WINDOWS\system32\hvtmpqlh.exe
2007-12-07 20:05 . 2007-12-07 20:05 32,456 --a------ C:\WINDOWS\system32\buyia.exe
2007-12-07 19:57 . 2007-12-07 19:57 6,504 --ah----- C:\WINDOWS\system32\dcipnt.exe
2007-12-07 19:51 . 2007-12-07 19:52 33,256 --ah----- C:\WINDOWS\system32\sfbzqd.exe
2007-12-07 19:49 . 2007-12-07 19:49 32,456 --a------ C:\WINDOWS\system32\nwma.exe
2007-12-07 19:45 . 2007-12-07 19:46 4,968 --ah----- C:\WINDOWS\system32\haiprc.exe
2007-12-07 19:43 . 2007-12-07 19:43 1,460 --ah----- C:\WINDOWS\system32\jtdfuf.exe
2007-12-06 16:51 . 2007-12-06 16:53 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-06 16:51 . 2007-12-06 16:51 7,467,056 --a------ C:\spybotsd15.exe
2007-12-05 18:32 . 2007-12-05 18:32 <REP> d-------- C:\WINDOWS\system32\daSgo01

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 22:12 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\utorrent
2007-12-07 21:38 44,032 ----a-w C:\WINDOWS\system32\ftp.exe
2007-12-07 21:38 17,920 ----a-w C:\WINDOWS\system32\tftp.exe
2007-12-06 15:30 135,168 ----a-w C:\WINDOWS\system32\sfc_os.dll
2007-12-05 15:28 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-05 15:26 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-29 13:17 --------- d-----w C:\Program Files\EA GAMES
2007-11-23 09:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-23 09:11 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems
2007-11-23 09:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-11-23 09:08 --------- d-----w C:\Program Files\CyberLink
2007-11-19 08:09 --------- d-----w C:\Documents and Settings\Benjamin\Application Data\BSplayer Pro
2007-11-16 16:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-24 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-10-09 10:05 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-09-30 20:01 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-04-12 14:50 44,912 ----a-w C:\Documents and Settings\Benjamin\Application Data\GDIPFONTCACHEV1.DAT
2007-02-07 20:56 645,670 ----a-w C:\Program Files\uTorrent-1.6-install.exe
2006-12-17 09:53 16,277,288 ----a-w C:\Program Files\Install_Messenger.exe
2005-05-19 17:25 56 --sh--r C:\WINDOWS\system32\E6766994AD.sys
2006-08-20 20:17 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 108,160 2007-01-15 17:28:57 C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe
----a-w 79,224 2007-12-04 13:00:23 C:\Program Files\Alwil Software\Avast4\ashDisp.exe

----a-w 617,984 2002-12-06 14:07:48 C:\Program Files\ASUS\Probe\bak\AsusProb.exe

----a-w 180,269 2005-05-19 17:29:37 C:\Program Files\Fichiers communs\Real\Update_OB\bak\realsched.exe

----a-w 81,920 2004-05-28 03:50:20 C:\Program Files\Fichiers communs\Ulead Systems\DVD\bak\USISrv.exe

----a-w 122,368 2006-08-20 20:10:22 C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe

----a-w 49,152 2004-09-13 13:49:00 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe
----a-w 49,152 2006-02-19 00:41:10 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

----a-w 892,928 2003-12-01 09:38:16 C:\Program Files\Logitech\iTouch\bak\iTouch.exe

----a-w 269,104 2006-06-29 23:54:45 C:\Program Files\Microsoft LifeCam\bak\LifeExp.exe

----a-w 12,288 2003-04-02 02:20:37 C:\Program Files\Winamp\bak\Winampa.exe

----a-w 707,376 2006-06-29 23:42:59 C:\WINDOWS\bak\vVX1000.exe

----a-w 155,648 2001-07-09 09:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe

.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
"µTorrent"="C:\Program Files\utorrent\utorrent.exe" [2006-07-02 17:29]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-06 18:47]
"DAEMON Tools"="F:\daemon tools\daemon.exe" [2007-09-18 15:16]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 15:18]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 10:50 C:\WINDOWS\LOGI_MWX.EXE]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" []
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-09 17:53]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"Windows Network Firewall"="C:\WINDOWS\System32\firewall.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 12:45]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide du logiciel HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22]
Rappels du Calendrier Microsoft Works.lnk - C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [1999-08-06 08:53:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxywwwx]
xxywwwx.dll

R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys
R2 Microsoft register shield;Microsoft register shield;"C:\WINDOWS\Mrshield.exe"
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamSvc.exe"
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 Brndis;External USB Cable Modem;C:\WINDOWS\System32\DRIVERS\Brndis.sys
S3 VX1000;VX-1000;C:\WINDOWS\System32\DRIVERS\VX1000.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-03 08:34:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-07 19:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job"
- C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 23:11:49
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 23:13:41
.
--- E O F ---

je reviendrais demain je pars me coucher

@+