Ca a l´air d´aller

beaucoups EvilElf

Okay.

Télécharge combofix (par sUBs) puis redémarre en mode sans échec.
http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe
- Double clique sur combofix.exe.
- Appuie sur Y (Yes) pour lancer le scan.
- Quand le scan sera terminé, copie/colle le rapport ici ainsi qu´un nouveau rapport Hijackthis.
ps: Si le rapport ne s´ouvre pas, tu peux le trouver ici: C:\Combofix.txt

Je me doute que ça va mieux mais nous n´avons pas tout à fait terminé !! !!

ok

ComboFix 07-09-26 - subaman 2007-09-25 21:35:15.1 - NTFSx86 NETWORK
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.793 [GMT 2:00]
Running from: C:\Documents and Settings\subaman\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-08-26 to 2007-09-26 ))))))))))))))))))))))))))))))))))))
.

2007-09-25 21:34 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-25 20:53 <REP> d-------- C:\WINDOWS\ERUNT
2007-09-25 20:46 <REP> d-------- C:\Program Files\Yahoo!
2007-09-25 20:46 <REP> d-------- C:\Program Files\CCleaner
2007-09-25
20:09 24,576 --a------ C:\WINDOWS\system32\huhl.ex
e
2007-09-25 20:06 <REP> d-------- C:\Documents and Settings\LocalService\Menu D‚marrer
2007-09-25
19:59 97,280 -----c--- C:\WINDOWS\system32\dllcach
e\dpcdll.dll
2007-09-25
19:59 9,728 --------- C:\WINDOWS\system32\comsdupd
.exe
2007-09-25
19:59 40,832 --------- C:\WINDOWS\system32\drivers
\irbus.sys
2007-09-25
19:59 221,184 --a------ C:\WINDOWS\system32\wmpns.
dll
2007-09-25
19:57 <REP> d-------- C:\WINDOWS\ServicePackFiles

2007-09-25
19:53 15,872 --a------ C:\WINDOWS\system32\spupdsv
c.exe
2007-09-25 19:51 <REP> d-------- C:\WINDOWS\EHome
2007-09-25
19:42 <REP> d-------- C:\9b545cd0ec66399ee938713f

2007-09-25
19:14 28,160 --a------ C:\WINDOWS\system32\nuwpt.e
xe
2007-09-25
19:08 24,576 --a------ C:\WINDOWS\system32\igkrorl
s.exe
2007-09-25
17:33 28,160 --a------ C:\WINDOWS\system32\flfwhfq
z.exe
2007-09-25 16:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-25
16:31 54,784 --ah----- C:\WINDOWS\system32\rhlu.ex
e
2007-09-25
16:14 32,768 --a------ C:\WINDOWS\system32\buhowa.
exe
2007-09-25
16:12 54,784 --ah----- C:\WINDOWS\system32\ktmzuu.
exe
2007-09-25 16:05 <REP> d-------- C:\hijackthis
2007-09-25
15:23 54,784 --ah----- C:\WINDOWS\system32\zxkisp.
exe
2007-09-25
15:23 123 --a------ C:\WINDOWS\system32\qvtnsxj.ba
t
2007-09-25
15:01 54,784 --ah----- C:\WINDOWS\system32\qqcifcj
.exe
2007-09-24 18:59 <REP> d-------- C:\Program Files\rFactor
2007-09-23 01:34 <REP> d-------- C:\Documents and Settings\subaman\Application Data\AdobeUM
2007-09-23 01:32 <REP> d-------- C:\Documents and Settings\subaman\WhiteCap
2007-09-23 01:31 <REP> d-------- C:\Program Files\SoundSpectrum
2007-09-23 00:26 <REP> d-------- C:\Fraps
2007-09-21 12:09 <REP> d-------- C:\WINDOWS\Favoris
2007-09-21
04:51 58,776 --a------ C:\WINDOWS\system32\ijjiPlu
gin2.dll
2007-09-21
04:49 692,224 --a------ C:\WINDOWS\system32\ijjiSe
tup.exe
2007-09-21 04:49 <REP> d-------- C:\Program Files\NHN USA
2007-09-18
15:16 79,679 --a------ C:\WINDOWS\system32\E_FLMAG
E.DLL
2007-09-18
15:16 64,000 --a------ C:\WINDOWS\system32\E_FBCBA
GE.DLL
2007-09-18
15:16 49,152 --a------ C:\WINDOWS\system32\E_DCINS
T.DLL
2007-09-18
15:16 34,304 --a------ C:\WINDOWS\system32\E_FBCHA
GE.DLL
2007-09-18 15:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\UDL
2007-09-18 15:10 212,480 --a------ C:\WINDOWS\PCDLIB32.DLL
2007-09-18
15:10 21,248 --a------ C:\WINDOWS\system32\drivers
\pfc.sys
2007-09-18 15:10 <REP> d-------- C:\Program Files\ArcSoft
2007-09-18
14:56 15,104 --a------ C:\WINDOWS\system32\drivers
\usbscan.sys
2007-09-18
14:55 46,080 --a------ C:\WINDOWS\system32\escimgd
.dll
2007-09-18
14:55 29,696 --a------ C:\WINDOWS\system32\escwiad
.dll
2007-09-18
14:55 22,016 --a------ C:\WINDOWS\system32\esccmd.
dll
2007-09-18 14:55 <REP> d-------- C:\Program Files\epson
2007-09-18 08:56 <REP> d-------- C:\Program Files\Audacity
2007-09-17 16:20 <REP> d-------- C:\Program Files\GTA VC - NFS Undeground
2007-09-17 03:29 <REP> d-------- C:\Program Files\Schmads Inc
2007-09-17 03:22 <REP> d-------- C:\Program Files\Teamspeak2_RC2
2007-09-17 03:22 <REP> d-------- C:\Documents and Settings\subaman\Application Data\teamspeak2
2007-09-16
13:29 25,856 --a------ C:\WINDOWS\system32\drivers
\usbprint.sys
2007-09-13 20:16 <REP> d---s---- C:\Documents and Settings\subaman\UserData
2007-09-12
18:25 502,208 --a------ C:\WINDOWS\system32\driver
s\amon.sys
2007-09-12
18:25 270,336 --a------ C:\WINDOWS\system32\imon.d
ll
2007-09-12 02:07 86,094 --a------ C:\WINDOWS\BPMNT.dll
2007-09-12
02:07 71,749 --a------ C:\WINDOWS\hcextoutput.dll

2007-09-12 02:07 267,845 --a------ C:\WINDOWS\tsc.exe
2007-09-12 02:07 1,163,344 --a------ C:\WINDOWS\vsapi32.dll
2007-09-12 02:07 <REP> d-------- C:\WINDOWS\AU_Backup
2007-09-12 02:05 <REP> d-------- C:\WINDOWS\AU_Temp
2007-09-12 02:05 <REP> d-------- C:\WINDOWS\AU_Log
2007-09-12 02:03 69,689 --a------ C:\WINDOWS\UNZIP.DLL
2007-09-12 02:03 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL
2007-09-12 02:03 286,720 --a------ C:\WINDOWS\PATCH.EXE
2007-09-11
09:52 4,682 --a------ C:\WINDOWS\system32\npptNT2.
sys
2007-09-11 09:52 <REP> d-------- C:\Program Files\Fichiers communs\DirectX
2007-09-11 09:52 <REP> d-------- C:\Documents and Settings\subaman\Application Data\NHN Corporation
2007-09-11 09:51 <REP> d--h----- C:\Documents and Settings\subaman\Application Data\ijjigame
2007-09-11 09:51 <REP> d-------- C:\ijji
2007-09-11 09:33 <REP> d-------- C:\Program Files\DriftCity
2007-09-11 08:57 <REP> d-------- C:\Program Files\BMW M3 Challenge
2007-09-11 08:41 <REP> d-------- C:\Program Files\XMotorRacingDemo
2007-09-11
08:39 192,000 --a------ C:\WINDOWS\system32\iuengi
ne.dll
2007-09-11 08:39 <REP> d-------- C:\WUTemp
2007-09-11 07:50 <REP> d-------- C:\Program Files\Steam
2007-09-11 06:50 <REP> d-------- C:\Documents and Settings\subaman\Application Data\vlc
2007-09-11 06:13 <REP> d-------- C:\Program Files\Logitech
2007-09-11 06:13 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Logitech

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-25 14:49 --------- d-------- C:\Documents and Settings\subaman\Application Data\Skype
2007-09-21 04:49 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-09-21 02:25 --------- d-------- C:\Program Files\Mozilla Firefox 2 Beta 2
2007-09-19 14:13 --------- d-------- C:\Program Files\Silkroad
2007-09-12 02:48 --------- d-------- C:\Documents and Settings\subaman\Application Data\Hamachi
2007-09-11 05:45 --------- d-------- C:\Program Files\Fichiers communs\SpeechEngines
2007-09-11 05:45 --------- d-------- C:\Program Files\Fichiers communs\ODBC
2007-09-11 05:25 --------- d-------- C:\Program Files\MSN Messenger
2007-09-11 05:23 --------- d-------- C:\Documents and Settings\subaman\Application Data\Talkback
2007-09-11 05:22 --------- d-------- C:\Documents and Settings\All Users\Application Data\Bluetooth
2007-09-11 05:20 --------- d-------- C:\Program Files\Skype
2007-09-11
05:19 25544 --a------ C:\WINDOWS\system32\drivers\
hamachi.sys
2007-09-11 05:19 --------- d-------- C:\Program Files\Hamachi
2007-09-11 05:18 --------- d-------- C:\Program Files\VideoLAN
2007-09-11
05:17 4608 --a------ C:\WINDOWS\system32\w95inf32.
dll
2007-09-11 05:17 --------- d-------- C:\Program Files\PCI Audio Applications
2007-09-11 05:17 --------- d-------- C:\Program Files\C-Media
2007-09-11
05:15 15939 --a------ C:\WINDOWS\system32\drivers\
AegisP.sys
2007-09-11 05:15 --------- d-------- C:\Program Files\RALINK
2007-09-11 05:15 --------- d-------- C:\Program Files\Fichiers communs\InstallShield
2007-09-11 05:14 --------- d-------- C:\Program Files\IVT Corporation
2007-09-11 05:14 --------- d-------- C:\Program Files\ATI Technologies
2007-09-11 05:07 --------- d-------- C:\Program Files\microsoft frontpage
2007-09-11 05:05 --------- d-------- C:\Program Files\Fichiers communs\MSSoap
2007-09-11 05:04 --------- d-------- C:\Program Files\Services en ligne
2007-07-30
19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll

2007-07-30
19:19 549720 --a------ C:\WINDOWS\system32\wuapi.d
ll
2007-07-30
19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.
exe
2007-07-30
19:19 43352 --a------ C:\WINDOWS\system32\wups2.dl
l
2007-07-30
19:19 325976 --a------ C:\WINDOWS\system32\wucltui
.dll
2007-07-30
19:19 203096 --a------ C:\WINDOWS\system32\wuweb.d
ll
2007-07-30
19:19 1712984 --a------ C:\WINDOWS\system32\wuauen
g.dll
2007-07-30
19:18 33624 --a------ C:\WINDOWS\system32\wups.dll

2001-11-23
06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3
D.DLL
.

((((((((((((((((((((((((((((((((( Point de chargement Reg
)))))))))))))))))))))))))))))))))))))))))))))))))

.

• Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur
rentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-01-12 21:05]
"C-Media Mixer"="Mixer.exe" [2003-03-20 08:21 C:\WINDOWS\mixer.exe]
"Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 17:31]
"Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 17:14]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-12 18:24]
"EPSON Stylus Photo RX520
Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\
3\E_FATIAGE.exe" [2005-04-07 06:00]
"System32HBHB Agent"="C:\WINDOWS\System32HBHB.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Windows Logon Application"="C:\WINDOWS\System32\winIogon.exe" []
"Application Layer Gateway Service"="C:\WINDOWS\System32\algs.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09]
"Steam"="C:\Program Files\Steam\Steam.exe" [2007-09-11 07:56]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

S1 lusbaudio;Microphone USB
Logitech;C:\WINDOWS\system32\drivers\OVSound2.sys

S1
oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\
oreans32.sys
S3 dump_wmimmc;dump_wmimmc;\??\C:\Program Files\DriftCity\GameGuard\dump_wmimmc.sys
S3 NTProcDrv;Process creation detector for NT.;\??\C:\Program Files\Silkroad\NtProcDrv.sys
S3 NTSIM;NTSIM;\??\C:\WINDOWS\System32\ntsim.sys
S3 QCAbsee;QuickCam Web Logitech (0801);C:\WINDOWS\system32\DRIVERS\OVCA.sys
S3 wbscr;Winbond Smartcard Reader for I/O;C:\WINDOWS\system32\drivers\wbscr.sys

[HKEY_CURRENT_USER\software\microsoft\windows\curr
entversion\explorer\mountpoints2\I]
AutoRun\command- I:\_SETIMG\EPSSWT.EXE /NODISP:"ALL" /NOWIZ:"..\EPSETUP.EXE" /ST:"3500,WIN98,WINME"

[HKEY_CURRENT_USER\software\microsoft\windows\curr
entversion\explorer\mountpoints2\J]
AutoRun\command- J:\FarCryAutoCD.exe

• Newly Created Service* - CATCHME

.

• • ***********************************************
  • *********************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-09-26 21:36:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

• • ***********************************************
  • *********************

.
Completion time: 2007-09-26 21:37:29
.
--- E O F ---

Logfile of HijackThis v1.99.1
Scan saved at 21:38:22, on 26/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Mozilla Firefox 2 Beta 2\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\hijackthis\Scaner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [EPSON Stylus Photo RX520 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA
GE.EXE /P31 "EPSON Stylus Photo RX520 Series" /O6 "USB001" /M "Stylus Photo RX520"
O4 - HKLM\..\Run: [System32HBHB Agent] C:\WINDOWS\System32HBHB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\winIogon.exe
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Lancement rapide d´Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: RaConfig2500.lnk = C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra ´Tools´ menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ´Tools´ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ´Tools´ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=
http://www.google.fr/
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) -
http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

Re

Relance Hijackthis coche les lignes

O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\winIogon.exe

O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe

Clique sur "Fix Checked".

Télécharge OTMoveIt (de Old_Timer) sur ton bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

• Double-clique sur OTMoveIt.exe
• Vérifie que la case "Unregister Dll´s and Ocx´s" soit bien cochée.
• Copie le texte ci-dessous, et colle le dans le cadre dans OTMoveIt appelé "Paste List of Files/Folders to be moved".

C:\WINDOWS\System32\winIogon.exe
C:\WINDOWS\System32\algs.exe

• Clique sur MoveIt!.
• Quand le résultat apparaît dans le cadre Results, clique sur Exit.
• Puis redémarre le PC.
• Enfin, envoie le rapport de OTMoveIt situé dans C:\_OTMoveIt\MovedFiles.

Fais un scan en ligne avec Kaspersky (sous Internet Explorer !! )
http://webscanner.kaspersky.fr/
Poste le rapport puis poste un nouveau log HJC, et normalement on devrait avoir terminé !

Bonne soirée ++

http://img232.imageshack.us/img232/9708/ovtet3.jpg

C´est normal ?

et dans c: il n´y a rien

Continues fais tout et poste les rapports.