SmitFraudFix v2.271

Rapport fait à 19:16:33,43, 17/12/2007
Executé à partir de C:\Documents and Settings\Jean-Baptiste\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Giganology\Gigaget\Gigaget.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\Tasks\At?.job PRESENT !
C:\WINDOWS\Tasks\At??.job PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jean-Baptiste

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jean-Baptiste\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JEAN-B~1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

"Source"="
http://wallpapers.notrecinema.com/images
/wallpapers/hip%20hop%2023.jpg"

"SubscribedURL"="
http://wallpapers.notrecinema.com
/images/wallpapers/hip%20hop%2023.jpg"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d´accueil"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!! !Attention, les clés qui suivent ne sont pas forcément infectées!!!

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!! !Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler´s .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!! !Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!! !Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter - Miniport d´ordonnancement de paquets
DNS Server Search Order: 195.5.219.1

Description: NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter - Miniport d´ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3AB01957-AD90-4
E46-91C8-0B5F23FA3705}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A57F7557-3365-4
33C-BE27-5D0310A7A7AD}: DhcpNameServer=195.5.219.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{3AB01957-AD90-4
E46-91C8-0B5F23FA3705}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{A57F7557-3365-4
33C-BE27-5D0310A7A7AD}: DhcpNameServer=195.5.219.1

HKLM\SYSTEM\CS3\Services\Tcpip\..\{3AB01957-AD90-4
E46-91C8-0B5F23FA3705}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS3\Services\Tcpip\..\{A57F7557-3365-4
33C-BE27-5D0310A7A7AD}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonsoir,

Oui bien sur, tu fais tout ce que te demande le deuxième rapport GenProc. Tu as bien fait d´attendre ma réponse, le rapport peu être mal interprété, et il ne faudrait pas supprimer n´importe quoi

C´est quoi ce Gigaget.exe logé dans C:\Program Files\Giganology\Gigaget\ ?

Sinon, t´as une imprimante Brother chez toi ?

C´est un gestionnaire de téléchargement, non ?

j´avais une imprimante brother aujourd´hui devnue une epson...
gigaget est un utilitaire permettant d´aider les telechargements et de les reprendres si ma connexion se coupe ( ce qui arrive souvent c´esttres penible d´avoiri a telecharger 2x le meme patch)

voila mon rapport combofix

ComboFix 07-12-17.1 - Jean-Baptiste 2007-12-17 20:44:41.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.685 [GMT 1:00]
Running from: C:\Documents and Settings\Jean-Baptiste\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jean-Baptiste\Menu Démarrer\Programmes\WebMediaPlayer
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\arxeuiyj.ini
C:\WINDOWS\system32\byxywwv.dll
C:\WINDOWS\system32\ccweykbh.exe
C:\WINDOWS\system32\ekqwydyu.exe
C:\WINDOWS\system32\iifggda.dll
C:\WINDOWS\system32\iitsbxuv.exe
C:\WINDOWS\system32\jyiuexra.dll
C:\WINDOWS\system32\kfhqafan.dll
C:\WINDOWS\system32\kpycpyyp.dll
C:\WINDOWS\system32\ktdfnice.dll
C:\WINDOWS\system32\kupxwoef.dll
C:\WINDOWS\system32\nafaqhfk.ini
C:\WINDOWS\system32\neboulrm.exe
C:\WINDOWS\system32\ngddymcg.dll
C:\WINDOWS\system32\nmuogmli.exe
C:\WINDOWS\system32\nnuiykje.dll
C:\WINDOWS\system32\pmnolki.dll
C:\WINDOWS\system32\pxhhngry.exe
C:\WINDOWS\system32\rvllnvcs.exe
C:\WINDOWS\system32\sungaqij.dll
C:\WINDOWS\system32\tonrbnnw.exe
C:\WINDOWS\system32\uhsigoqv.ini
C:\WINDOWS\system32\vbpbsodw.exe
C:\WINDOWS\system32\vqogishu.dll
C:\WINDOWS\system32\wmfnwhgt.exe
C:\WINDOWS\system32\xifepvyh.dll
C:\WINDOWS\system32\ypkpsbsq.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services
)))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
-------\nm

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-17 to 2007-12-17 ))))))))))))))))))))))))))))))))))))
.

2007-12-17 20:46 . 2007-12-17
20:47 324,608 --a------ C:\WINDOWS\system32\pmkhf.
dll
2007-12-17 19:16 . 2007-09-05
23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSI
D.exe
2007-12-17 19:16 . 2006-04-27
16:49 288,417 --a------ C:\WINDOWS\system32\SrchST
S.exe
2007-12-17 19:16 . 2007-12-13
19:40 77,824 --a------ C:\WINDOWS\system32\IEDFix.
exe
2007-12-17 19:16 . 2003-06-05
20:13 53,248 --a------ C:\WINDOWS\system32\Process
.exe
2007-12-17 19:16 . 2004-07-31
17:50 51,200 --a------ C:\WINDOWS\system32\dumphiv
e.exe
2007-12-17 19:16 . 2007-10-03
23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.
exe
2007-12-17 19:16 . 2007-12-17
19:16 1,634 --a------ C:\WINDOWS\system32\tmp.reg

2007-12-15 17:47 . 2007-12-16
17:48 970,374 ---hs---- C:\WINDOWS\system32\ewflfw
oi.ini
2007-12-13 17:52 . 2007-12-14
17:12 905,733 ---hs---- C:\WINDOWS\system32\lxxaqm
mx.ini
2007-12-12 23:01 . 2007-12-12 23:02 1,393 --a------ C:\WINDOWS\imsins.BAK
2007-12-12 16:14 . 2007-12-13
17:46 1,020,986 ---hs---- C:\WINDOWS\system32\fdpy
abpf.ini
2007-12-10 21:14 . 2007-12-12
16:11 931,495 ---hs---- C:\WINDOWS\system32\jkmyik
tn.ini
2007-12-10 16:26 . 2007-12-10
16:26 859,439 ---hs---- C:\WINDOWS\system32\mvyqhe
iw.ini
2007-12-09 20:34 . 2007-12-09 20:41 <REP> d-------- C:\GenProc
2007-12-09 19:55 . 2007-12-09 19:55 <REP> d-------- C:\WINDOWS\ERUNT
2007-12-09 19:04 . 2007-12-04
14:04 837,496 --a------ C:\WINDOWS\system32\aswBoo
t.exe
2007-12-09 19:04 . 2004-01-09
10:13 380,928 --a------ C:\WINDOWS\system32\actski
n4.ocx
2007-12-09 19:04 . 2007-12-04
13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS
.scr
2007-12-09 19:04 . 2007-12-04
15:55 94,544 --a------ C:\WINDOWS\system32\drivers
\aswmon2.sys
2007-12-09 19:04 . 2007-12-04
15:56 93,264 --a------ C:\WINDOWS\system32\drivers
\aswmon.sys
2007-12-09 19:04 . 2007-12-04
15:51 42,912 --a------ C:\WINDOWS\system32\drivers
\aswTdi.sys
2007-12-09 19:04 . 2007-12-04
15:49 26,624 --a------ C:\WINDOWS\system32\drivers
\aavmker4.sys
2007-12-09 19:04 . 2007-12-04
15:53 23,152 --a------ C:\WINDOWS\system32\drivers
\aswRdr.sys
2007-12-09 15:50 . 2007-12-09 15:50 <REP> d-------- C:\Program Files\Avira
2007-12-09 14:39 . 2007-12-17 19:22 <REP> d-------- C:\VundoFix Backups
2007-12-09 14:09 . 2007-12-09 14:38 <REP> d-------- C:\Program Files\Navilog1
2007-12-09 00:45 . 2007-12-09 00:45 <REP> d-------- C:\Program Files\Trend Micro
2007-12-08 22:29 . 2007-12-08 22:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-12-08 20:35 . 2007-12-08
20:35 834,100 ---hs---- C:\WINDOWS\system32\ihqnes
ar.ini
2007-12-07 20:32 . 2007-12-08
19:39 834,220 ---hs---- C:\WINDOWS\system32\ophevf
fj.ini
2007-12-06 20:31 . 2007-12-07
17:27 831,597 ---hs---- C:\WINDOWS\system32\xdagey
sc.ini
2007-12-05 20:31 . 2007-12-06
18:04 807,588 ---hs---- C:\WINDOWS\system32\datfkt
nk.ini
2007-12-05 18:32 . 2007-12-16 18:04 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-05 18:32 . 2007-12-05 18:32 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-04 20:38 . 2007-12-05
18:04 805,381 ---hs---- C:\WINDOWS\system32\ipsujy
gs.ini
2007-12-03 20:43 . 2007-12-04
17:08 794,367 ---hs---- C:\WINDOWS\system32\yjthte
ep.ini
2007-12-01 22:22 . 2007-12-03
20:25 794,100 ---hs---- C:\WINDOWS\system32\fpmjou
sr.ini
2007-12-01 19:03 . 2004-05-14
16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn1
3n.dll
2007-12-01 19:03 . 2004-05-14
16:53 450,560 --a------ C:\WINDOWS\system32\ltimg1
3n.dll
2007-12-01 19:03 . 2004-05-14
16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp1
3n.dll
2007-12-01 19:03 . 2004-05-14
16:53 299,008 --a------ C:\WINDOWS\system32\ltdis1
3n.dll
2007-12-01 19:03 . 2004-01-12
02:09 206,336 --a------ C:\WINDOWS\system32\ltefx1
3n.dll
2007-12-01 19:03 . 2004-05-14
16:53 163,840 --a------ C:\WINDOWS\system32\ltfil1
3n.dll
2007-12-01 19:03 . 2003-11-04
15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13
n.dll
2007-12-01 19:03 . 2004-05-14
16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13
n.dll
2007-11-30 14:16 . 2007-03-12
16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx
9_33.dll
2007-11-30 14:16 . 2007-03-12
16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DC
ompiler_33.dll
2007-11-30 14:16 . 2007-03-15
16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10
_33.dll
2007-11-30 14:14 . 2007-11-30 14:14 <REP> d--hs---- C:\WINDOWS\ftpcache
2007-11-27 20:13 . 2007-11-27 20:20 <REP> d-------- C:\Program Files\EA Sports
2007-11-27 07:16 . 2007-11-27 07:16 268 --ah----- C:\sqmdata12.sqm
2007-11-27 07:16 . 2007-11-27 07:16 244 --ah----- C:\sqmnoopt12.sqm
2007-11-26 21:42 . 2007-11-26 21:42 244 --ah----- C:\sqmnoopt11.sqm
2007-11-26 21:42 . 2007-11-26 21:42 232 --ah----- C:\sqmdata11.sqm
2007-11-25 00:43 . 2007-11-25 20:09 <REP> d-------- C:\Program Files\uTorrent
2007-11-25 00:43 . 2007-12-15 18:17 <REP> d-------- C:\Documents and Settings\Jean-Baptiste\Application Data\uTorrent
2007-11-23 18:24 . 2007-11-23 18:24 <REP> d-------- C:\Documents and Settings\Jean-Baptiste\Application Data\EPSON
2007-11-19 20:11 . 2007-11-19 20:12 10,581,741 --a------ C:\Les Rois De La Glisse Fr (Enfant).amv

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-12 21:35 --------- d-----w C:\Program Files\eMule
2007-12-09 19:36 --------- d-----w C:\Program Files\CCleaner
2007-12-08 18:01 --------- d-----w C:\Program Files\THQ
2007-11-30 18:21 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-16 20:43 --------- d-----w C:\Program Files\Video Converter
2007-11-15 17:37 --------- d-----w C:\Documents and Settings\Jean-Baptiste\Application Data\Media Player Classic
2007-11-15 16:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-15 16:33 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-11-15 16:33 --------- d-----w C:\Documents and Settings\Jean-Baptiste\Application Data\Apple Computer
2007-11-15 16:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-15 16:32 --------- d-----w C:\Program Files\QuickTime
2007-11-13
10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\s
ecdrv.sys
2007-11-11 14:11 --------- d-----w C:\Program Files\MP3 Player Utilities 4.15
2007-11-10 10:13 --------- d-----w C:\Program Files\Giganology
2007-11-09 18:39 --------- d-----w C:\Program Files\Anno 1701
2007-11-09
17:08 271,360 ----a-w C:\WINDOWS\system32\drivers\
atksgt.sys
2007-11-09
17:08 18,048 ----a-w C:\WINDOWS\system32\drivers\l
irsgt.sys
2007-10-29
18:32 22,328 ----a-w C:\WINDOWS\system32\drivers\P
nkBstrK.sys
2007-10-29 12:53 --------- d-----w C:\Documents and Settings\Jean-Baptiste\Application Data\.ABC
2007-10-29 12:50 --------- d-----w C:\Program Files\ABC
2007-10-27 10:10 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2007-10-27 10:10 --------- d-----w C:\Program Files\Ahead
2007-10-27 10:01 --------- d-----w C:\Program Files\Cyanide
2007-10-27 09:57 --------- d-----w C:\Program Files\Sports Interactive
2007-10-27 09:40 --------- d-----w C:\Program Files\epson
2007-10-21 11:07 --------- d-----w C:\Program Files\Electronic Arts
2007-10-20 14:44 --------- d-----w C:\Documents and Settings\Jean-Baptiste\Application Data\Sports Interactive
2007-10-20 14:42 --------- d--h--w C:\Program Files\Zero G Registry
2006-12-11 17:22 1 ----a-w C:\Documents and Settings\Jean-Baptiste\SI.bin
2006-06-01 22:23 29 ----a-r C:\Program Files\start.bat
2006-05-27 05:27 106,496 ----a-w C:\Program Files\hl2.exe
2006-05-25 12:24 839,680 ----a-w C:\Program Files\steamclient.dll
2006-05-25 12:24 61,440 ----a-w C:\Program Files\steam_api.dll
2006-05-25 12:24 241,664 ----a-w C:\Program Files\tier0_s.dll
2006-05-25 12:24 229,376 ----a-w C:\Program Files\vstdlib_s.dll
2006-05-25 12:24 208,896 ----a-w C:\Program Files\tier0.dll
2006-05-25 12:24 118,784 ----a-w C:\Program Files\vstdlib.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg
)))))))))))))))))))))))))))))))))))))))))))))))))

.
.
REGEDIT4

• Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E7A6D0A-ECF4-4751-A9C2-46508E3BDD5B}]
C:\WINDOWS\system32\awtqo.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur
rentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-05 13:00 C:\WINDOWS\system32\rundll32.exe]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
[2007-12-04 14:00]
"BigDog305"="C:\WINDOWS\VM305_STI.exe" [2005-08-05 15:15]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cu
rrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]

R0
RITCPT;RITCPT;C:\WINDOWS\system32\drivers\RITCPT.s
ys [2004-09-21 16:39]
R2 FBAPI;FBAPI;C:\WINDOWS\system32\drivers\FBAPI.sys [2004-09-21 16:39]
R3 3xHybrid;Pinnacle PCTV 310i Stereo DVB-T;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-09-02 14:43]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2005-04-21 06:33]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
R3 ZSMC0305;VIMICRO USB PC Camera V;C:\WINDOWS\system32\Drivers\usbVM305.sys [2005-11-30 12:50]
S1 hidfltr;HID Filter Driver;C:\WINDOWS\system32\drivers\MWhid.sys [2004-11-03 12:20]
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 12:50]
S3
SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.s
ys []
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
S3 W8335XP;IEEE 802.11g Wireless Cardbus/PCI Adapter HW51;C:\WINDOWS\system32\DRIVERS\Mrv8000c.sys [2004-12-24 07:43]

.
Contenu du dossier ´Scheduled Tasks/Tƒches planifi‚es´
"2007-11-30 19:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\Documents
"2007-11-30 18:31:16 C:\WINDOWS\Tasks\At2.job"
- C:\Documents
"2007-11-30 19:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\Documents
"2007-12-08 19:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\Documents
"2007-12-08 16:32:47 C:\WINDOWS\Tasks\At5.job"
- C:\Documents
"2007-12-08 16:32:47 C:\WINDOWS\Tasks\At6.job"
- C:\Documents
"2007-12-08 17:55:21 C:\WINDOWS\Tasks\At7.job"
- C:\Documents
"2007-12-08 19:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\Documents
"2007-12-08 17:55:21 C:\WINDOWS\Tasks\At9.job"
- C:\Documents
"2007-12-17 18:07:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
.

• • ***********************************************
  • *********************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-12-17 20:49:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

• • ***********************************************
  • *********************

.
Completion time: 2007-12-17 20:50:29 - machine was rebooted
.
2007-12-12 22:04:17 --- E O F ---

rapport smitfraudix:

SmitFraudFix v2.271

Rapport fait à 21:05:27,26, 17/12/2007
Executé à partir de C:\Documents and Settings\Jean-Baptiste\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!! !Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler´s .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri´s WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3AB01957-AD90-4
E46-91C8-0B5F23FA3705}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A57F7557-3365-4
33C-BE27-5D0310A7A7AD}: DhcpNameServer=195.5.219.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{3AB01957-AD90-4
E46-91C8-0B5F23FA3705}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{A57F7557-3365-4
33C-BE27-5D0310A7A7AD}: DhcpNameServer=195.5.219.1

HKLM\SYSTEM\CS3\Services\Tcpip\..\{3AB01957-AD90-4
E46-91C8-0B5F23FA3705}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS3\Services\Tcpip\..\{A57F7557-3365-4
33C-BE27-5D0310A7A7AD}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!! !Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!! !Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler´s .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

VundoFix V6.7.0

Checking Java version...

Java version is 1.5.0.11

Scan started at 14:39:07 09/12/2007

Listing files found while scanning....

C:\windows\system32\gslmjija.dll
C:\windows\system32\jjjlm.ini
C:\windows\system32\jjjlm.ini2
C:\windows\system32\mljjj.dll
C:\windows\system32\ukmnshdn.exe

Beginning removal...

Attempting to delete C:\windows\system32\gslmjija.dll
C:\windows\system32\gslmjija.dll Has been deleted!

Attempting to delete C:\windows\system32\jjjlm.ini
C:\windows\system32\jjjlm.ini Has been deleted!

Attempting to delete C:\windows\system32\jjjlm.ini2
C:\windows\system32\jjjlm.ini2 Has been deleted!

Attempting to delete C:\windows\system32\mljjj.dll
C:\windows\system32\mljjj.dll Has been deleted!

Attempting to delete C:\windows\system32\ukmnshdn.exe
C:\windows\system32\ukmnshdn.exe Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.7.0

Checking Java version...

Java version is 1.5.0.11

Scan started at 19:22:56 17/12/2007

Listing files found while scanning....

C:\windows\system32\awtqo.dll
C:\windows\system32\oqtwa.ini
C:\windows\system32\oqtwa.ini2

Beginning removal...

Attempting to delete C:\windows\system32\awtqo.dll
C:\windows\system32\awtqo.dll Has been deleted!

Attempting to delete C:\windows\system32\oqtwa.ini
C:\windows\system32\oqtwa.ini Has been deleted!

Attempting to delete C:\windows\system32\oqtwa.ini2
C:\windows\system32\oqtwa.ini2 Has been deleted!

Performing Repairs to the registry.
Done!

et enfin voila le rapport hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:15:02, on 17/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program
Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.d
ll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: GigagetIEHelper - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WINDOWS\system32\gigagetbho_v10.dll
O2 - BHO: (no name) - {5E7A6D0A-ECF4-4751-A9C2-46508E3BDD5B} - C:\WINDOWS\system32\awtqo.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program
Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.d
ll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ´SERVICE LOCAL´)
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ´SERVICE RÉSEAU´)
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ´SYSTEM´)
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ´Default user´)
O8 - Extra context menu item: &Download All by Gigaget - C:\Program Files\Giganology\Gigaget\getallurl.htm
O8 - Extra context menu item: &Download by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d´arrière-plan - res://C:\Program Files\Windows Live
Toolbar\Components\fr-fr\msntabres.dll.mui/229?4c3
34f406c32419d83f383d4944ceabf
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live
Toolbar\Components\fr-fr\msntabres.dll.mui/230?4c3
34f406c32419d83f383d4944ceabf
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra ´Tools´ menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ´Tools´ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe

--
End of file - 6190 bytes

j´ai le sentiment que la situation s´est amélioré u peu mais pas mal de choses ont bougées:; je n´ai plus de fond d´écran (tout bleu), je tombe sur la page dacceuill msn lorsque j´ouvre internet (alors que c´était google avant)
que dois-je faire maintenant ?

évidement que les choses ont changé.

Maintenant, relance HJC et coche la ligne :

O2 - BHO: (no name) - {5E7A6D0A-ECF4-4751-A9C2-46508E3BDD5B} - C:\WINDOWS\system32\awtqo.dll (file missing)

puis,

Avast! est loin de ce que l´on a fait de mieux en matière de protection, voir ce lien pour plus d´informations :
http://forum.malekal.com/ftopic3123.php

Clairement, Antivir est beaucoup plus performant, c´est pourquoi, je te conseille TRES VIVEMENT de désinstaller Avast!
http://www.avast.com/fre/e/avast-uninstall-utility.html
et installer Antivir à la place :
http://www.clubic.com/telecharger-fiche10821-antivir-personal-edition-7.html
Tuto :
http://www.malekal.com/tutorial_antivir.php
- Après l´installation, mets le à jour - si ton firewall fait une alerte.. accepte la connexion.
- Assure toi qu´Antivir est bien à jour, vérifie la date d´update.

-- Redémarre en mode sans échec, pour cela, redémarre l´ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

- Ouvre Antivir par le menu Démarrer / Programmes
- Cliquez sur l´onglet Scanner.
- Sélectionne Manual Selection
- Sélectionne le disque C
- Lance le scan - Mets en quarantaine tous les éléments détectés.
- Une fois le scan terminé Enregistre le rapport.

Redémarre en mode normal.

Poste le rapport ici.

Bonne soirée