PC infecté par faux antivirus
Salut
J'ai bien entendu fait tout ce qui était sur le topic désinfection/sécurisation... Mais ces merdes sont toujours là !
Bien que j'ai Firefox, le virus arrive quand-même à ouvrir un nouvel onglet (franchement je sais pas comment il fait) pour me dire que je suis "infecté"
J'ai deux icônes sur mon bureau "Windows update" et "Help and Support center" qui quand je les supprime elles réaparaissent instantanément !
Mon ordinateur plante au démarrage et autres (à cause d'antivir qui ouvre plein de fenêtre pour me dire qu'il est impossible de supprimer les virus).
pour votre aide
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 19:28:33
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:06,b7,77,40,8c,16,5f,5a,7f,d1,9e,5b,c8
,e0,3f,f7,c5,46,2a,88,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
]
"a0"=hex:20,01,00,00,ee,0d,90,86,57,4b,b3,61,8a,65
,dc,b0,ce,c0,88,95,00,..
"khjeh"=hex:38,a1,36,10,66,43,bf,33,b0,17,f3,64,cc
,14,03,6d,87,72,54,e2,c1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf40]
"khjeh"=hex:65,f9,2d,e9,02,d7,72,eb,04,ed,82,f7,b6
,b3,ff,60,26,27,2f,a1,77,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf41]
"khjeh"=hex:e0,8f,48,9b,f3,8c,f5,a0,8e,78,1e,b8,7f
,e8,e8,ac,ba,6f,c1,0d,78,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:06,b7,77,40,8c,16,5f,5a,7f,d1,9e,5b,c8
,e0,3f,f7,c5,46,2a,88,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
]
"a0"=hex:20,01,00,00,ee,0d,90,86,57,4b,b3,61,8a,65
,dc,b0,ce,c0,88,95,00,..
"khjeh"=hex:38,a1,36,10,66,43,bf,33,b0,17,f3,64,cc
,14,03,6d,87,72,54,e2,c1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf40]
"khjeh"=hex:65,f9,2d,e9,02,d7,72,eb,04,ed,82,f7,b6
,b3,ff,60,26,27,2f,a1,77,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf41]
"khjeh"=hex:e0,8f,48,9b,f3,8c,f5,a0,8e,78,1e,b8,7f
,e8,e8,ac,ba,6f,c1,0d,78,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:0d,83,68,83,31,dc,5f,fb,26,fb,5c,62,9e
,82,3c,bb,59,82,dd,b1,b2,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
]
"a0"=hex:20,01,00,00,ee,0d,90,86,57,4b,b3,61,8a,65
,dc,b0,ce,c0,88,95,00,..
"khjeh"=hex:38,a1,36,10,66,43,bf,33,b0,17,f3,64,cc
,14,03,6d,87,72,54,e2,c1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf40]
"khjeh"=hex:ed,d4,bb,c8,43,73,3e,b3,7e,e8,3e,ad,7f
,be,b2,98,02,be,07,f6,f3,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf41]
"khjeh"=hex:e0,8f,48,9b,f3,8c,f5,a0,8e,78,1e,b8,7f
,e8,e8,ac,ba,6f,c1,0d,78,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:06,b7,77,40,8c,16,5f,5a,7f,d1,9e,5b,c8
,e0,3f,f7,c5,46,2a,88,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
]
"a0"=hex:20,01,00,00,ee,0d,90,86,57,4b,b3,61,8a,65
,dc,b0,ce,c0,88,95,00,..
"khjeh"=hex:38,a1,36,10,66,43,bf,33,b0,17,f3,64,cc
,14,03,6d,87,72,54,e2,c1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf40]
"khjeh"=hex:65,f9,2d,e9,02,d7,72,eb,04,ed,82,f7,b6
,b3,ff,60,26,27,2f,a1,77,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf41]
"khjeh"=hex:e0,8f,48,9b,f3,8c,f5,a0,8e,78,1e,b8,7f
,e8,e8,ac,ba,6f,c1,0d,78,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:06,b7,77,40,8c,16,5f,5a,7f,d1,9e,5b,c8
,e0,3f,f7,c5,46,2a,88,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
]
"a0"=hex:20,01,00,00,ee,0d,90,86,57,4b,b3,61,8a,65
,dc,b0,ce,c0,88,95,00,..
"khjeh"=hex:38,a1,36,10,66,43,bf,33,b0,17,f3,64,cc
,14,03,6d,87,72,54,e2,c1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\
sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
\0Jf40]
"khjeh"=hex:65,f9,2d,e9,02,d7,72,eb,04,ed,82,f7,b6
,b3,ff,60,26,27,2f,a1,77,..
[HKEY_LOCAL_MACHINE\SYSTEM\[HKEY_LOCAL_MACHINE\SYS
TEM\
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:29:38, on 25/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\program files\steam\steam.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Section Privée\Mes documents\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Int
ernet Settings,ProxyServer = localhost:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BM8b87e092] Rundll32.exe "C:\WINDOWS\system32\idumnnlb.dll",s
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Micro Application Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {8EC69950-F299-40AC-A004-3BF5176F8F7B} (FlowScan Control) - http://www.checkspy.com/fr/FlowScan.cab
O16 - DPF: {E1AF091A-9F23-4059-89D7-C05EE073285D} (Canal+ Active MSWAY) - https://www.canalplay.com/cabs/msway44.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: bals - {7916f057-223f-4612-ac84-e882cbe043d4} - (no file)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5828 bytes
Salut,
Télécharge SmitfraudFix (S!Ri) :
http://siri.urz.free.fr/Fix/SmitfraudFix.php
- Dézippe-le sur le Bureau. Ensuite ouvre le dossier et lance Smitfraudix.(cmd)
- Choisis l'option 1.
- Patiente durant l'analyse, enregistre le rapport et poste son contenu sur le forum.
SmitFraudFix v2.296
Rapport fait à 20:49:36,15, 25/02/2008
Executé à partir de C:\Documents and Settings\Section Priv‚e\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252
Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{BDF675F0-36E1-4
7F2-89E5-0CBD66678121}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C330BA9C-A075-4
859-946A-B315631D8010}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{DAD9E79E-7DC0-4
0C5-808C-CAFB05C93D84}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BDF675F0-36E1-4
7F2-89E5-0CBD66678121}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C330BA9C-A075-4
859-946A-B315631D8010}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C330BA9C-A075-4
859-946A-B315631D8010}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{BDF675F0-36E1-4
7F2-89E5-0CBD66678121}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C330BA9C-A075-4
859-946A-B315631D8010}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
Re,
Télécharge combofix (par sUBs):
http://download.bleepingccomputer.com/sUBs/ComboFix.exe
Redémarre en mode sans échec.
http://forum.telecharger.01net.com/telecharger/virus_et_assimiles/failles_de_securite/redemarrer_en_mode_sans_echec_pourquoi_et_comment-387297/messages-1.html
Relance Smitfraudix, puis choisie l'option 2 et réponds oui a toutes les questions. Enfin, sauvegarde le rapport sur le bureau, car tu devras le poster dans ta prochaine réponse.
Double clique sur combofix.exe.
- Appuie sur Y (Yes) pour lancer le scan.
- Quand le scan sera terminé, redémarre en mode normal.
Poste le rapport de :
- Smitfraudifx
- Combofix (Ps: le rapport se trouve ici C:\Combofix.txt)
- Nouveau rapport HijackThis.
SmitFraudFix v2.296
Rapport fait à 21:48:52,60, 25/02/2008
Executé à partir de C:\Documents and Settings\Section Privée\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252
Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{BDF675F0-36E1-4
7F2-89E5-0CBD66678121}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C330BA9C-A075-4
859-946A-B315631D8010}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\..\{DAD9E79E-7DC0-4
0C5-808C-CAFB05C93D84}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BDF675F0-36E1-4
7F2-89E5-0CBD66678121}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C330BA9C-A075-4
859-946A-B315631D8010}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C330BA9C-A075-4
859-946A-B315631D8010}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{BDF675F0-36E1-4
7F2-89E5-0CBD66678121}: DhcpNameServer=212.27.53.252 212.27.54.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{C330BA9C-A075-4
859-946A-B315631D8010}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage du registre non souhaité.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin
ComboFix 08-02-25.3 - Section Privée 2008-02-25 21:26:23.1 - NTFSx86 NETWORK
Microsoft Windows XP Édition familiale
Endroit: ComboFix.exe
C:\WINDOWS\Downloaded Program Files\UGA6PV_0001_N122M1202NetInstaller.exe
C:\WINDOWS\pack.epk
C:\WINDOWS\ppqvmpqr
C:\WINDOWS\ppqvmpqr\1.png
C:\WINDOWS\ppqvmpqr\2.png
C:\WINDOWS\ppqvmpqr\3.png
C:\WINDOWS\ppqvmpqr\4.png
C:\WINDOWS\ppqvmpqr\5.png
C:\WINDOWS\ppqvmpqr\6.png
C:\WINDOWS\ppqvmpqr\bottom-rc.gif
C:\WINDOWS\ppqvmpqr\content.png
C:\WINDOWS\ppqvmpqr\download.gif
C:\WINDOWS\ppqvmpqr\frame-bottom-left.gif
C:\WINDOWS\ppqvmpqr\frame-h1bg.gif
C:\WINDOWS\ppqvmpqr\head.png
C:\WINDOWS\ppqvmpqr\indexuc.html
C:\WINDOWS\ppqvmpqr\indexud.html
C:\WINDOWS\ppqvmpqr\main.css
C:\WINDOWS\ppqvmpqr\net.png
C:\WINDOWS\ppqvmpqr\pc-mag.gif
C:\WINDOWS\ppqvmpqr\pc.gif
C:\WINDOWS\ppqvmpqr\poloska1.png
C:\WINDOWS\ppqvmpqr\poloska2.png
C:\WINDOWS\ppqvmpqr\poloska3.png
C:\WINDOWS\ppqvmpqr\promouc1.html
C:\WINDOWS\ppqvmpqr\promouc2.html
C:\WINDOWS\ppqvmpqr\promouc3.html
C:\WINDOWS\ppqvmpqr\promouc4.html
C:\WINDOWS\ppqvmpqr\promouc5.html
C:\WINDOWS\ppqvmpqr\promoud1.html
C:\WINDOWS\ppqvmpqr\promoud2.html
C:\WINDOWS\ppqvmpqr\promoud3.html
C:\WINDOWS\ppqvmpqr\promoud4.html
C:\WINDOWS\ppqvmpqr\promoud5.html
C:\WINDOWS\ppqvmpqr\reg.png
C:\WINDOWS\ppqvmpqr\repair.png
C:\WINDOWS\ppqvmpqr\scr-1.png
C:\WINDOWS\ppqvmpqr\scr-2.png
C:\WINDOWS\ppqvmpqr\styles.css
C:\WINDOWS\ppqvmpqr\top-rc.gif
C:\WINDOWS\ppqvmpqr\vline.gif
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\abeeg.ini
C:\WINDOWS\system32\abeeg.ini2
C:\WINDOWS\system32\bccdd.ini
C:\WINDOWS\system32\bccdd.ini2
C:\WINDOWS\system32\bgnajssk.ini
C:\WINDOWS\system32\casswdhv.dll
C:\WINDOWS\system32\ddccb.dll
C:\WINDOWS\system32\drvvurr.dll
C:\WINDOWS\system32\eeeiplvc.ini
C:\WINDOWS\system32\embxjpek.ini
C:\WINDOWS\system32\evaketfx.ini
C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\hiotjtya.ini
C:\WINDOWS\system32\hukktoux.ini
C:\WINDOWS\system32\idumnnlb.dll
C:\WINDOWS\system32\ijkkj.ini
C:\WINDOWS\system32\ijkkj.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mhgrcibe.ini
C:\WINDOWS\system32\negohupc.dll
C:\WINDOWS\system32\nlriugmw.dll
C:\WINDOWS\system32\nnoweggg.ini
C:\WINDOWS\system32\nodkkodi.dll
C:\WINDOWS\system32\oifbgrne.dll
C:\WINDOWS\system32\osigazkv.dll
C:\WINDOWS\system32\osigazkv.dllbox
C:\WINDOWS\system32\ovabxcis.ini
C:\WINDOWS\system32\ppyvmxpx.dll
C:\WINDOWS\system32\qkuauavq.ini
C:\WINDOWS\system32\qomjgef.dll
C:\WINDOWS\system32\qpqss.ini
C:\WINDOWS\system32\qpqss.ini2
C:\WINDOWS\system32\qrutv.ini
C:\WINDOWS\system32\qrutv.ini2
C:\WINDOWS\system32\qtvwa.ini
C:\WINDOWS\system32\qtvwa.ini2
C:\WINDOWS\system32\qvauaukq.dll
C:\WINDOWS\system32\skkfjhdx.dll
C:\WINDOWS\system32\sysdm.exe
C:\WINDOWS\system32\ulonofgj.dll
C:\WINDOWS\system32\wpnmydld.ini
C:\WINDOWS\system32\xbeeg.ini
C:\WINDOWS\system32\xbeeg.ini2
C:\WINDOWS\system32\xcxphfnm.dll
C:\WINDOWS\system32\xroymjrh.ini
C:\WINDOWS\system32\yyksvxyd.ini
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services
)))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\NPF
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-25 to 2008-02-25 ))))))))))))))))))))))))))))))))))))
.
2008-02-25 20:50 . 2008-02-25
21:22 1,138 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-25 20:49 . 2007-09-05
23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSI
D.exe
2008-02-25 20:49 . 2006-04-27
16:49 288,417 --a------ C:\WINDOWS\system32\SrchST
S.exe
2008-02-25 20:49 . 2008-02-22
18:44 86,016 --a------ C:\WINDOWS\system32\VACFix.
exe
2008-02-25 20:49 . 2008-02-08
10:37 82,432 --a------ C:\WINDOWS\system32\IEDFix.
exe
2008-02-25 20:49 . 2003-06-05
20:13 53,248 --a------ C:\WINDOWS\system32\Process
.exe
2008-02-25 20:49 . 2004-07-31
17:50 51,200 --a------ C:\WINDOWS\system32\dumphiv
e.exe
2008-02-25 20:49 . 2007-10-03
23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.
exe
2008-02-25 20:29 . 2008-02-25 20:55 68,398 --a------ C:\WINDOWS\BM8b87e092.xml
2008-02-25 20:29 . 2008-02-25 21:03 21 --a------ C:\WINDOWS\pskt.ini
2008-02-25 20:28 . 2008-02-25
20:28 289,792 --a------ C:\WINDOWS\system32\vturq.
VIR
2008-02-22 15:00 . 2008-02-22
15:00 327,168 --a------ C:\WINDOWS\system32\jkkji.
VIR
2008-02-21 15:41 . 2008-02-21 15:41 <REP> d-------- C:\WINDOWS\ERUNT
2008-02-21 15:22 . 2008-02-21 15:22 <REP> d--h----- C:\WINDOWS\PIF
2008-02-21 15:05 . 2008-02-21 15:05 <REP> d-------- C:\SDFix
2008-02-21 15:03 . 2008-02-21 15:03 <REP> d-------- C:\Kaspersky
2008-02-21 14:59 . 2008-02-25 19:29 <REP> d-------- C:\clean
2008-02-21 14:38 . 2008-02-21 14:38 29 --a------ C:\WINDOWS\system32\88b4c180
2008-02-21 14:36 . 2008-02-21
14:36 317,440 --a------ C:\WINDOWS\system32\ssqpq.
VIR
2008-02-21 03:05 . 2008-02-21
03:05 1,044,480 --a------ C:\WINDOWS\system32\libd
ivx.dll
2008-02-21 03:05 . 2008-02-21
03:05 200,704 --a------ C:\WINDOWS\system32\ssldiv
x.dll
2008-02-20 13:54 . 2008-02-20 13:54 <REP> d-------- C:\Brother
2008-02-20 13:54 . 2004-12-03
01:26 188,416 --------- C:\WINDOWS\system32\PDRVIN
ST.DLL
2008-02-20 13:54 . 2005-06-02
01:09 86,016 --------- C:\WINDOWS\system32\BrWebIn
s.dll
2008-02-20 13:54 . 2005-06-02
01:08 69,632 --------- C:\WINDOWS\system32\BRWEBUP
.EXE
2008-02-20 13:54 . 2001-11-15 01:00 6,224 --------- C:\WINDOWS\CVRPAGE.bmp
2008-02-20 13:11 . 2008-02-20 13:11 <REP> d-------- C:\Program Files\Avira
2008-02-18 18:29 . 2008-02-18 18:29 <REP> d-------- C:\Program Files\D-Tools
2008-02-18 18:29 . 2004-08-22
16:31 155,136 --a------ C:\WINDOWS\system32\driver
s\d347bus.sys
2008-02-18 18:29 . 2004-08-22
16:31 5,248 --a------ C:\WINDOWS\system32\drivers\
d347prt.sys
2008-02-18 18:20 . 2008-02-18 18:27 <REP> d-------- C:\Program Files\DAEMON Tools
2008-02-18 15:07 . 2008-02-18
15:07 <REP> d-------- C:\WINDOWS\system32\Futurema
rk
2008-02-18 13:32 . 2008-02-18 13:32 <REP> d-------- C:\WINDOWS\nview
2008-02-18 13:32 . 2008-02-18
13:35 163,353 --a------ C:\WINDOWS\system32\nvapps
.xml
2008-02-18 13:32 . 2007-12-05
01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.
nvu
2008-02-16 14:52 . 2008-02-17 17:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-16 14:52 . 2008-02-16 14:52 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-12 22:11 . 2008-02-12 22:11 <REP> d-------- C:\Program Files\Pando Networks
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 20:13 --------- d-----w C:\Program Files\Steam
2008-02-25 18:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-25 18:07 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-23 15:37 --------- d-----w C:\Program Files\DivX
2008-02-20 12:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-20 12:54 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-02-20 11:06 --------- d--h--w C:\Program Files\Zero G Registry
2008-02-20 10:59 --------- d-----w C:\Program Files\AviSynth 2.5
2008-02-20 10:57 --------- d-----w C:\Program Files\BitTorrent
2008-02-20 10:45 --------- d-----w C:\Program Files\River Past
2008-02-20 10:45 --------- d-----w C:\Program Files\Fichiers communs\River Past
2008-02-20 10:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\River Past G5
2008-02-20 10:41 --------- d-----w C:\Program Files\Maplom
2008-02-20 10:40 --------- d-----w C:\Program Files\FreeGo
2008-02-20 10:39 --------- d-----w C:\Program Files\EPSON
2008-02-20 10:34 --------- d-----w C:\Program Files\Apple Software Update
2008-02-20 10:33 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-20 10:30 --------- d-----w C:\Program Files\3gpConvert
2008-02-19 23:23 --------- d-----w C:\Program Files\QuickTime
2008-02-19 23:03 --------- d-----w C:\Program Files\BitTorrent_DNA
2008-02-19 22:15 --------- d-----w C:\Program Files\Electronic Arts
2008-02-18
17:16 716,272 ----a-w C:\WINDOWS\system32\drivers\
sptd.sys
2008-01-20 09:06 --------- d-----w C:\Program Files\Windows Live
2008-01-20 09:05 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-01-19 13:38 --------- d-----w C:\Program Files\iTunes
2008-01-18 14:47 --------- d-----w C:\Program Files\Google
2008-01-09 17:37 --------- d-----w C:\Program Files\VSO
2008-01-09 17:37 --------- d-----w C:\Program Files\Athan
2008-01-09 17:35 --------- d-----w C:\Program Files\FileZilla
2008-01-07 20:10 --------- d-----w C:\Program Files\Tweak-XP Pro 4
2008-01-06 18:14 --------- d-----w C:\Program Files\Shareaza
2008-01-06 17:49 --------- d-----w C:\Program Files\eMule
2008-01-06 11:24 --------- d-----w C:\Program Files\Cossacks 2 - Battle for Europe
2007-12-30 16:18 --------- d-----w C:\Program Files\MessengerPlus! 3
2007-12-29 18:31 --------- d-----w C:\Program Files\Samsung
2007-12-26 18:06 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2007-12-26 13:02 --------- d-----w C:\Program Files\Anno 1701
2007-12-26 10:08 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-12-25 20:54 --------- d-----w C:\Program Files\MSN Messenger
2007-12-25 20:53 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2007-12-25 20:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-25 15:52 --------- d-----w C:\Program Files\mdubgpuz
2007-12-25 15:12 --------- d-----w C:\Program Files\Ufgyjzpc
2007-12-25 14:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2007-12-25 14:41 --------- d-----w C:\Program Files\Alwil Software
2006-03-03 22:30 16,709 ----a-w C:\Documents and Settings\Dev-Cpp\Pendu.exe
2006-10-14
11:21 7,298,848 --sha-w C:\WINDOWS\system32\driver
s\fidbox.dat
2006-10-14
11:21 82,208 --sha-w C:\WINDOWS\system32\drivers\f
idbox2.dat
.
[code]<pre>
----a-w 622,592 2007-12-26 13:19:00 C:\Program Files\Brother\Brmfcmon\BrMfcWnd .exe
----a-w 49,152 2007-12-26 13:19:01 C:\Program Files\Brother\Brmfl06a\BrStDvPt .exe
----a-w 61,440 2007-12-26 13:19:04 C:\Program Files\Brother\ControlCenter3\brctrcen .exe
----a-w 155,648 2008-01-19 13:37:19 C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck .exe
----a-w 139,264 2008-01-19 12:47:21 C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor .exe
----a-w 155,648 2007-12-26 13:18:55 C:\Program Files\Fichiers communs\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate .exe
----a-w 257,088 2008-01-19 12:47:21 C:\Program Files\iTunes\iTunesHelper .exe
----a-w 196,608 2007-12-25 17:56:10 C:\Program Files\Logitech\Video\ManifestEngine .exe
----a-w 190,024 2007-12-30 14:20:24 C:\Program Files\MessengerPlus! 3\MsgPlus .exe
----a-w 131,072 2007-12-31 10:52:36 C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray .exe
----a-w 40,960 2007-12-26 13:18:55 C:\Program Files\ScanSoft\PaperPort\IndexSearch .exe
----a-w 57,393 2007-12-26 13:18:54 C:\Program Files\ScanSoft\PaperPort\pptd40nt .exe
----a-w 1,266,936 2008-01-19 07:59:33 C:\Program Files\Steam\steam .exe
----a-w 1,266,936 2008-01-19 12:47:41 C:\Program Files\Steam\SteamTmp .exe
----a-w 208,952 2007-12-25 22:00:28 C:\WINDOWS\ime\imjp8_1\IMJPMIG .EXE
----a-w 44,032 2007-12-25 22:00:31 C:\WINDOWS\ime\imkr6_1\IMEKRMIG .EXE
----a-w 15,360 2008-01-11 14:51:51 C:\WINDOWS\system32\ctfmon .exe
----a-w 59,392 2007-12-25 22:00:32 C:\WINDOWS\system32\IME\PINTLGNT\ImScInst .exe
----a-w 455,168 2007-12-25 22:00:36 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP .EXE
</pre>[/code]
((((((((((((((((((((((((((((((((( Point de chargement Reg
)))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
- Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FAD0EF86-610F-4641-8F52-A5E96C68DD4E}]
C:\WINDOWS\system32\vturq.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2008-01-19 14:42 1266936]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-27 11:10 5724184]
"Pando"="C:\Program Files\Pando Networks\Pando\Pando.exe" [2008-02-09 14:02 6051144]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur
rentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll"
[2007-12-05 01:41 81920]
"BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 15:48 622592]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-20 17:47 249896]
"88b4d30e"="C:\WINDOWS\system32\dyxvskyy.dll" [ ]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\binaries\m
sconfig.exe" [2004-08-05 13:00 160768]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cu
rrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cu
rrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-05 13:00 44544]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2005-09-27 11:13 45056 C:\WINDOWS\system32\avldr.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dobciwn]
C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\dobciwn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebywwx]
gebywwx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wintuh32]
wintuh32.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\contr
ol\lsa]
Notification Packages REG_MULTI_SZ :\WINDOW
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Pinnacle Scheduler.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Pinnacle Scheduler.lnk
backup=C:\WINDOWS\pss\Pinnacle Scheduler.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\88b4d30e]
C:\WINDOWS\system32\gggewonn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\alcohol_.exe]
--a------ 2006-11-02 09:22 1616256 C:\Program Files\Alcohol Soft\Alcohol 120\alcohol_.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APVXDWIN]
--a----t- 2006-12-20 11:02 364544 C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
-r------- 2006-03-28 15:48 622592 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanalPlayerHelper]
C:\Program Files\Lecteur CANALPLAY\CanalPlayerHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
C:\Program Files\Brother\ControlCenter3\brctrcen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
C:\WINDOWS\system32\drvvur.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-05 13:00 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C62 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC
2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostSurf Reminder]
C:\Program Files\GhostSurf 2005\Privacy Control Center.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
--a------ 2004-08-05 13:00 44032 C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-05 13:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\awvtq.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\LogitechSoftwareUpdate]
C:\Program Files\Logitech\Video\ManifestEngine.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
--a------ 2005-06-08 14:24 458752 C:\Program Files\Logitech\Video\ISStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
--a------ 2005-06-08 14:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
--a------ 2005-07-19 16:32 221184 C:\WINDOWS\system32\LVCOMSX.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mdubgpuz]
C:\Program Files\mdubgpuz\udgnylyr.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2004-08-05 13:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-12-05 01:41 8523776 C:\WINDOWS\system32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-12-05 01:41 81920 C:\WINDOWS\system32\NvMcTray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2007-04-12 10:33 16132608 C:\WINDOWS\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SCANINICIO]
--a------ 2006-02-01 17:13 22528 C:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
--a------ 2005-01-26 18:02 49152 C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-11-06 11:57 185896 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uzqryvqz]
regsvr32 /u C:\Documents and Settings\All Users\Application Data\uzqryvqz.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2006-02-10 16:27 1420560 C:\Program Files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TPSrv"=2 (0x2)
"PSIMSVC"=2 (0x2)
"PNMSRV"=2 (0x2)
"pmshellsrv"=2 (0x2)
"PAVSRV"=2 (0x2)
"PavPrSrv"=2 (0x2)
"PAVFNSVR"=2 (0x2)
"avast! Mail Scanner"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallp
olicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Steam\\SteamApps\\tomasoa\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\tomasoa\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
"C:\\Program Files\\Steam\\SteamApps\\tomasoa\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\Pando Networks\\Pando\\pando.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\rundll32.exe"=
"C:\\Program
Files\\Steam\\SteamApps\\tomasoa\\half-life\\hl.ex
e"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr
.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\SteamApps\\tomasoa\\condition zero\\hl.exe"=
"C:\\Program
Files\\Steam\\SteamApps\\tomasoa\\counter-strike\\
hl.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic
Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer
.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallp
olicy\standardprofile\GloballyOpenPorts\List]
"1200:UDP"= 1200:UDP:Steam
"6346:TCP"= 6346:TCP:TCP
"6346:UDP"= 6346:UDP:UDP
[HKLM\~\services\sharedaccess\parameters\firewallp
olicy\standardprofile\Logging]
"LogSuccessfulConnections"= 0 (0x0)
"LogDroppedPackets"= 0 (0x0)
"LogFileSize"= 0 (0x0)
"LogFilePath"=
[HKEY_CURRENT_USER\software\microsoft\windows\curr
entversion\explorer\mountpoints2\{014549c6-9dd9-11
db-9c96-00115bace2c6}]
\Shell\AutoRun\command - I:\setup\rsrc\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curr
entversion\explorer\mountpoints2\{e079c547-c9b2-11
db-9ca4-00115bace2c6}]
\Shell\AutoRun\command - K:\LaunchU3.exe
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-23 15:00:08 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe-Scan -ScanType config -Privileges restricted
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:46:18, on 25/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\program files\steam\steam.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Section Privée\Mes documents\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Int
ernet Settings,ProxyServer = localhost:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {FAD0EF86-610F-4641-8F52-A5E96C68DD4E} - C:\WINDOWS\system32\vturq.dll (file missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [88b4d30e] rundll32.exe "C:\WINDOWS\system32\dyxvskyy.dll",b
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Micro Application Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Anti-Popup - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dobciwn - C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\dobciwn.dll (file missing)
O20 - Winlogon Notify: gebywwx - gebywwx.dll (file missing)
O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5663 bytes
- Télécharge VundoFix (by Atribune) sur ton bureau :
http://www.atribune.org/ccount/click.php?id=4
- Clique sur "VundoFix.exe" puis sur "Scan for Vundo"
- Lorsque le scan est terminé, clique sur "Remove Vundo". On te demandera si tu veux supprimer les fichiers, clique sur "Yes" (si le bureau disparaît c’est normal) puis on te demandera si tu veux redémarrer ton PC, clique alors sur OK.
Copie/colle le rapport ici (situé ici : "C:\vundofix.txt") ainsi qu´un nouveau log HijackThis.
Wwi77, à l'avenir stp ne m'interrompe pas dans mes désinfections.
@-Tommy_Vercetti, stp host moi le rapport de Combofix sur mediafire. JVC l'affiche mal et c'est un calvaire à analyser.
http://www.mediafire.com/
http://ftphost.free.fr/autres/ComboFix.txt
Re,
Comme l'a fait sous entendre wiwi, tu es infecté par Vundo. C'est une infection assez coriace.
Télécharge Vundofix (by Atribune) sur ton bureau.
http://www.atribune.org/ccount/click.php?id=4
- Clique sur "Vundofix.exe" puis sur Scan for Vundo.
- Lorsque le scan est terminer clique sur Remove Vundo.
- On te demandera si tu veux supprimer les fichiers clique sur "Yes" (si le bureau disparaît c’est normal).
- Puis on te demandera si tu veux redémarrer ton PC clique alors sur OK.
- Copie/Colle le rapport ici (situé ici : C:\vundofix.txt).
- Télécharge VirtumondeBegone :
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
Exécute le enregistre et poste le rapport.
Redémarre en mode sans échec. Repasse un coup de combofix et poste le rapport sur ton site comme tu l'as déjà fait 
Salut, Vundofix et Virtumonde ne détectent rien... c'est bon ? Le virus est parti ?
Oh là non ! Bon je te fais un script combofix. Bouge pas.
Re,
Par souci de rédaction, ma réponse se trouvera sur ce poste (JVC affiche mal les scripts :s). Réponds sur JVC bien sur.
http://www.xplodconcept.com/viewtopic.php?f=14&t=44&p=49#p49
http://ftphost.free.fr/autres/combofix.txt
A noter que maintenant, je sais pas pourquoi j'ai réussi à supprimer les deux fausses icones de Windows update mais que ya une icone IE qui est là à chaque démarrage d'une session...
Bah c'est parce que l'on avance 
La suite ici :
http://www.xplodconcept.com/viewtopic.php?f=14&t=44&p=49#p49
Je pense qu'on finira demain. Mais n'estime pas ton sujet comme étant résolu, car ce n'est pas encore le cas !!
- Aide à l'achat Mac
- Création de Jeux
- Linux
- Programmation
- Création de sites web
- Internet
- Steam Deck
- Macintosh
- Hardware