Votre question

Help ! reditty, webcry..... et co !

Tags :
  • Sécurité
Dernière réponse : dans Sécurité et virus
6 Décembre 2007 21:08:30

Aloha tout le monde,

ça fait deja quelques jours que mon pc est infecté, et je crois que j'ai vraiment tout eu ! j'ai essayé de me débrouiller tout seul avant de venir surchargé un forum, mais là je n'en peut plus !
Pour résumer, je crois que j'ai eut (dans le désordre) : Win32 machin, Vundo, Live safety center.... il me semble avoir réussi a me débarrasser de la pluspart avec CCcleaner et asquared, mais depuis c'est des fenetres intempestives qui s'ouvrent sans cesse depuis google ou sans raison...
j'ai deja vu plein de posts sur ce sujet, mais d'aprés ce que j'ai compris... il faut faire un scan avec Hijackthis et poster le log file pour recevoir un guide de nettoyage personnalisé.... alors voici le mien, et svp : HELP !!!!
merci d'avance a n'importe qui pourra me guider !

Logfile of HijackThis v1.99.1
Scan saved at 20:56:34, on 06/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\1XConfig.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\WINDOWS\system32\regsvr32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Dell\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\palmOne\Hotsync.exe
C:\PROGRA~1\Dell\LOGICI~1\BTSTAC~1.EXE
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Trax\LOCALS~1\Temp\Rar$EX00.050\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.ca/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 1 localhost
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [pqrylure] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\pqrylure.dll"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: ~$ANNING.doc
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Dell\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scan...
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/layout/default01/a...
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c0090A79.dat
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Dell\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\dlapaxca.exe (file missing)
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe

Autres pages sur : help reditty webcry

7 Décembre 2007 00:05:10

Bonjour


Télécharge Combofix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double clique combofix.exe et suis les invites.
Lorsque le scan sera complété, un rapport apparaîtra.

Copie/colle ce rapport dans ta prochaine réponse avec un nouveau HijackThis.
9 Décembre 2007 11:00:31

Salut, merci beaucoup...
comme demandé. voici le rapport de combofix, suivit par celui de hijackthis...
merci d'avance pour la suite !
;-)

Julien

Combofix :
ComboFix 07-12-09.1 - Trax 2007-12-09 10:17:34.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.131 [GMT 1:00]Running from: C:\Documents and Settings\Trax\Local Settings\Temporary Internet Files\Content.IE5\836LMKYR\ComboFix[1].exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\pqrylure.dll
C:\Documents and Settings\Trax\Favoris\Online Security Guide.lnk
C:\Program Files\Lnmyhnvf
C:\Program Files\Lnmyhnvf\zqapgcoz.dll
C:\Program Files\SecCenter
C:\Program Files\SecCenter\scprot4.exe.bak
C:\Program Files\zmfapebg
C:\Program Files\zmfapebg\zodmvqto.dll
C:\WINDOWS\cookies.ini
C:\WINDOWS\mgrs.exe
C:\WINDOWS\SYSTEM32\aayxlhte.ini
C:\WINDOWS\system32\ddccbxw.dll
C:\WINDOWS\system32\ethlxyaa.dll
C:\WINDOWS\SYSTEM32\gphnxgcy.ini
C:\WINDOWS\system32\gwehgvkg.dll
C:\WINDOWS\system32\iktxtmun.dll
C:\WINDOWS\SYSTEM32\katthdyl.ini
C:\WINDOWS\system32\ljjggef.dll
C:\WINDOWS\system32\lnxcdrpk.dll
C:\WINDOWS\system32\lydhttak.dll
C:\WINDOWS\SYSTEM32\lyqbxdex.ini
C:\WINDOWS\SYSTEM32\npoqr.ini
C:\WINDOWS\SYSTEM32\npoqr.ini2
C:\WINDOWS\SYSTEM32\ponpo.ini2
C:\WINDOWS\system32\rqopn.dll
C:\WINDOWS\system32\trjpkoru.dll
C:\WINDOWS\SYSTEM32\urokpjrt.ini
C:\WINDOWS\system32\xedxbqyl.dll
C:\WINDOWS\SYSTEM32\xyycf.ini
C:\WINDOWS\SYSTEM32\xyycf.ini2
C:\WINDOWS\system32\ycgxnhpg.dll
C:\WINDOWS\system32\yleqbmfp.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-09 to 2007-12-09 ))))))))))))))))))))))))))))))))))))
.

2007-12-09 10:01 . 2007-12-09 10:01 74,304 --a------ C:\WINDOWS\SYSTEM32\kpyqyrlb.exe
2007-12-07 23:42 . 2007-12-07 23:42 74,304 --a------ C:\WINDOWS\SYSTEM32\ducdopxo.exe
2007-12-06 20:40 . 2007-12-06 20:40 74,304 --a------ C:\WINDOWS\SYSTEM32\hgtaacii.exe
2007-12-05 21:11 . 2007-12-05 21:11 24,576 --a------ C:\WINDOWS\SYSTEM32\VundoFixSVC.exe
2007-12-05 20:10 . 2007-12-05 20:10 <REP> d-------- C:\VundoFix Backups
2007-12-01 10:19 . 2007-12-01 10:19 414 ---hs---- C:\WINDOWS\SYSTEM32\bfaodrns.ini
2007-12-01 09:13 . 2007-12-01 09:13 354 ---hs---- C:\WINDOWS\SYSTEM32\ransvrtd.ini
2007-11-23 17:48 . 2007-12-01 09:03 294 ---hs---- C:\WINDOWS\SYSTEM32\orbcnqji.ini
2007-11-18 16:16 . 2007-11-18 22:00 <REP> d-------- C:\Program Files\Windows Live Safety Center
2007-11-18 15:30 . 2007-11-18 15:30 <REP> d-------- C:\WINDOWS\SYSTEM32\qfovkrbl
2007-11-18 14:52 . 2007-11-18 14:52 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00004.tmp
2007-11-17 00:15 . 2007-11-17 00:15 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00003.tmp
2007-11-17 00:12 . 2007-11-17 00:12 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00002.tmp
2007-11-17 00:09 . 2007-11-17 00:09 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00001.tmp
2007-11-16 23:43 . 2007-12-05 19:49 <REP> d-------- C:\Program Files\LMSOFT Web Creator Pro 4
2007-11-16 21:18 . 2007-11-16 21:18 <REP> d-------- C:\Program Files\BroadJump
2007-11-16 21:04 . 2007-11-16 21:17 <REP> d-------- C:\Documents and Settings\Trax\Application Data\vmntoolbar
2007-11-16 21:03 . 2007-11-16 21:03 <REP> d-------- C:\Program Files\Visicom Media
2007-11-10 17:37 . 2007-11-16 19:42 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-11-10 17:27 . 2007-11-10 17:27 <REP> d-------- C:\Program Files\CCleaner
2007-11-10 10:39 . 2007-11-10 13:10 <REP> d-------- C:\Documents and Settings\Trax\.housecall6.6
2007-11-10 10:28 . 2007-11-20 18:36 910,928 ---hs---- C:\WINDOWS\SYSTEM32\bijsawvd.ini
2007-11-10 10:27 . 2004-08-05 13:00 33,792 --a------ C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
2007-11-10 10:27 . 2004-08-05 13:00 33,792 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\rundll32.exe
2007-11-10 10:25 . 2007-11-10 10:25 102,789 ---hs---- C:\WINDOWS\SYSTEM32\tsutv.bak2
2007-11-10 09:48 . 2007-11-10 09:48 <REP> d-------- C:\Documents and Settings\Trax\Application Data\McAfee
2007-11-10 09:45 . 2008-02-11 09:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2007-11-10 09:25 . 2008-02-10 18:50 143 --a------ C:\WINDOWS\SYSTEM32\mcrh.tmp
2007-11-10 09:22 . 2008-02-11 09:51 122,684 ---hs---- C:\WINDOWS\SYSTEM32\tsutv.ini
2007-11-10 09:06 . 2007-11-10 09:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-13 22:08 --------- d-----w C:\Documents and Settings\Trax\Application Data\SiteAdvisor
2008-02-12 07:12 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-02-11 10:50 --------- d-----w C:\Documents and Settings\Trax\Application Data\Xara
2008-02-11 10:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-11 10:47 --------- d-----w C:\Program Files\Xara
2008-02-11 09:31 --------- d-----w C:\Program Files\Java
2008-02-11 08:53 700,416 ----a-w C:\StubInstaller.exe
2008-02-11 08:46 --------- d-----w C:\Program Files\McAfee.com
2008-02-11 08:46 --------- d-----w C:\Program Files\McAfee
2008-02-11 08:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-02-11 08:38 --------- d-----w C:\Program Files\SiteAdvisor
2008-02-11 08:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-11 08:35 --------- d-----w C:\Program Files\Fichiers communs\McAfee
2007-12-07 22:36 --------- d-----w C:\Documents and Settings\Trax\Application Data\Skype
2007-12-05 18:50 --------- d-----w C:\Program Files\PpStream Fr
2007-12-05 18:50 --------- d-----w C:\Documents and Settings\Trax\Application Data\ppStream
2007-12-05 18:38 --------- d-----w C:\Program Files\FileZilla
2007-11-23 22:36 --------- d-----w C:\Program Files\bwin
2007-11-18 13:52 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00004.tmp
2007-11-16 23:15 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00003.tmp
2007-11-16 23:12 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00002.tmp
2007-11-16 23:09 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00001.tmp
2007-11-10 08:20 --------- d-----w C:\Program Files\TVAnts
2007-11-10 08:20 --------- d-----w C:\Program Files\SopCast
2007-11-08 21:23 --------- d-----w C:\Program Files\Bonjour
2007-11-08 21:20 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-11-08 21:06 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2007-11-04 23:25 --------- d-----w C:\Documents and Settings\Trax\Application Data\FileZilla
2007-10-31 21:42 --------- d-----w C:\Program Files\iTunes
2007-10-31 21:42 --------- d-----w C:\Program Files\iPod
2007-10-31 21:39 --------- d-----w C:\Program Files\QuickTime
2007-10-31 21:37 --------- d-----w C:\Program Files\Apple Software Update
2007-10-31 21:36 --------- d-----w C:\Program Files\Fichiers communs\Apple
2007-10-31 21:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2006-12-23 19:57 70,488 ----a-w C:\Documents and Settings\Trax\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45C7E599-123B-4556-9134-24C78EFBEBD7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74415b4e-24a7-4b0b-a0f9-cb9d9e13da74}]
C:\WINDOWS\system32\gwehgvkg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E23CA9A5-1027-4E5F-AEF8-8ED967933DE9}]
C:\WINDOWS\system32\rqopn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EC39F86A-6671-414E-8743-F9132342690B}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-05 17:35]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-28 08:20]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-08-21 19:04]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2004-05-16 21:18]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 18:32]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 12:43]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 02:05]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-12-16 19:26]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36]
"EPSON Stylus DX4800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.exe" [2005-02-02 05:00]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-05-12 13:30]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-08-31 20:24]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 22:57]
"pqrylure"="regsvr32 /u C:\Documents and Settings\All Users\Application Data\pqrylure.dll" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddccbxw]
ddccbxw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\system32\LgNotify.dll 2004-01-12 07:55 110592 C:\WINDOWS\SYSTEM32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

S3 av100s2k;av100s2k;C:\WINDOWS\system32\DRIVERS\av100s2k.sys
S3 av100u2k;av100u2k;C:\WINDOWS\system32\DRIVERS\av100u2k.sys
S3 NAL;Nal Service ;\??\C:\WINDOWS\system32\Drivers\iqvw32.sys
S3 PhilCam8116;QuickCam Pro 3000 Logitech (08B0);C:\WINDOWS\system32\DRIVERS\CamDrO21.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58c58370-acdf-11d9-b762-0011433c46b9}]
\Shell\AutoRun\command - E:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6071f370-682d-11db-baa2-0011433c46b9}]
\Shell\AutoRun\command - F:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3cd6bf2-1ddb-11dc-bb26-0011433c46b9}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL click_me.html

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-12-04 17:45:23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-11 08:34:59 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
"2008-02-11 08:34:57 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\DOCUME~1\Trax\LOCALS~1\Temp\jpsfgeqwUTER.dll
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-09 10:45:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-09 10:50:34 - machine was rebooted
.
--- E O F ---
************************************************************************************************************************************************************************************

Et Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:20, on 09/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\1XConfig.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Dell\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\palmOne\Hotsync.exe
C:\PROGRA~1\Dell\LOGICI~1\BTSTAC~1.EXE
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.ca/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: (no name) - {45C7E599-123B-4556-9134-24C78EFBEBD7} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EC39F86A-6671-414E-8743-F9132342690B} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: ~$ANNING.doc
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Dell\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scan...
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/layout/default01/a...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Dell\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe

--
End of file - 12013 bytes








9 Décembre 2007 19:50:25

Bonjour


Copie (Ctrl+C) le texte ci-dessous :

File::
C:\WINDOWS\SYSTEM32\kpyqyrlb.exe
C:\WINDOWS\SYSTEM32\ducdopxo.exe
C:\WINDOWS\SYSTEM32\hgtaacii.exe
C:\WINDOWS\SYSTEM32\bfaodrns.ini
C:\WINDOWS\SYSTEM32\ransvrtd.ini
C:\WINDOWS\SYSTEM32\orbcnqji.ini
C:\WINDOWS\SYSTEM32\qfovkrbl
C:\WINDOWS\SYSTEM32\bijsawvd.ini
C:\WINDOWS\SYSTEM32\tsutv.bak2
C:\WINDOWS\SYSTEM32\tsutv.ini
C:\StubInstaller.exe
C:\Documents and Settings\Trax\Application Data\~LM00004.tmp
C:\Documents and Settings\Trax\Application Data\~LM00003.tmp
C:\Documents and Settings\Trax\Application Data\~LM00002.tmp
C:\Documents and Settings\Trax\Application Data\~LM00001.tmp
C:\DOCUME~1\Trax\LOCALS~1\Temp\jpsfgeqwUTER.dll
C:\WINDOWS\SYSTEM32\ddccbxw.dll
C:\Documents and Settings\All Users\Application Data\pqrylure.dll
C:\WINDOWS\system32\gwehgvkg.dll
C:\WINDOWS\system32\rqopn.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45C7E599-123B-4556-9134-24C78EFBEBD7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74415b4e-24a7-4b0b-a0f9-cb9d9e13da74}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E23CA9A5-1027-4E5F-AEF8-8ED967933DE9}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EC39F86A-6671-414E-8743-F9132342690B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pqrylure"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddccbxw]


Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt



Comme l'image le montre, fait glisser CFScript.txt sur Combofix.exe
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
10 Décembre 2007 21:56:35

Et voila le contenu du nouveau scan de cmbofix :
ComboFix 07-12-09.1 - Trax 2007-12-10 21:46:04.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.127 [GMT 1:00]
Running from: C:\Documents and Settings\Trax\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Trax\Bureau\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-10 to 2007-12-10 ))))))))))))))))))))))))))))))))))))
.

2007-12-09 10:57 . 2007-12-09 10:57 <REP> d-------- C:\Program Files\Trend Micro
2007-12-09 10:01 . 2007-12-09 10:01 74,304 --a------ C:\WINDOWS\SYSTEM32\kpyqyrlb.exe
2007-12-07 23:42 . 2007-12-07 23:42 74,304 --a------ C:\WINDOWS\SYSTEM32\ducdopxo.exe
2007-12-06 20:40 . 2007-12-06 20:40 74,304 --a------ C:\WINDOWS\SYSTEM32\hgtaacii.exe
2007-12-05 21:11 . 2007-12-05 21:11 24,576 --a------ C:\WINDOWS\SYSTEM32\VundoFixSVC.exe
2007-12-05 20:10 . 2007-12-05 20:10 <REP> d-------- C:\VundoFix Backups
2007-12-01 10:19 . 2007-12-01 10:19 414 ---hs---- C:\WINDOWS\SYSTEM32\bfaodrns.ini
2007-12-01 09:13 . 2007-12-01 09:13 354 ---hs---- C:\WINDOWS\SYSTEM32\ransvrtd.ini
2007-11-23 17:48 . 2007-12-01 09:03 294 ---hs---- C:\WINDOWS\SYSTEM32\orbcnqji.ini
2007-11-18 16:16 . 2007-11-18 22:00 <REP> d-------- C:\Program Files\Windows Live Safety Center
2007-11-18 15:30 . 2007-11-18 15:30 <REP> d-------- C:\WINDOWS\SYSTEM32\qfovkrbl
2007-11-18 14:52 . 2007-11-18 14:52 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00004.tmp
2007-11-17 00:15 . 2007-11-17 00:15 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00003.tmp
2007-11-17 00:12 . 2007-11-17 00:12 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00002.tmp
2007-11-17 00:09 . 2007-11-17 00:09 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00001.tmp
2007-11-16 23:43 . 2007-12-05 19:49 <REP> d-------- C:\Program Files\LMSOFT Web Creator Pro 4
2007-11-16 21:18 . 2007-11-16 21:18 <REP> d-------- C:\Program Files\BroadJump
2007-11-16 21:04 . 2007-11-16 21:17 <REP> d-------- C:\Documents and Settings\Trax\Application Data\vmntoolbar
2007-11-16 21:03 . 2007-11-16 21:03 <REP> d-------- C:\Program Files\Visicom Media
2007-11-10 17:37 . 2007-11-16 19:42 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-11-10 17:27 . 2007-11-10 17:27 <REP> d-------- C:\Program Files\CCleaner
2007-11-10 10:39 . 2007-11-10 13:10 <REP> d-------- C:\Documents and Settings\Trax\.housecall6.6
2007-11-10 10:28 . 2007-11-20 18:36 910,928 ---hs---- C:\WINDOWS\SYSTEM32\bijsawvd.ini
2007-11-10 10:27 . 2004-08-05 13:00 33,792 --a------ C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
2007-11-10 10:27 . 2004-08-05 13:00 33,792 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\rundll32.exe
2007-11-10 10:25 . 2007-11-10 10:25 102,789 ---hs---- C:\WINDOWS\SYSTEM32\tsutv.bak2
2007-11-10 09:48 . 2007-11-10 09:48 <REP> d-------- C:\Documents and Settings\Trax\Application Data\McAfee
2007-11-10 09:45 . 2008-02-11 09:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2007-11-10 09:25 . 2008-02-10 18:50 143 --a------ C:\WINDOWS\SYSTEM32\mcrh.tmp
2007-11-10 09:22 . 2008-02-11 09:51 122,684 ---hs---- C:\WINDOWS\SYSTEM32\tsutv.ini
2007-11-10 09:06 . 2007-11-10 09:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-13 22:08 --------- d-----w C:\Documents and Settings\Trax\Application Data\SiteAdvisor
2008-02-11 10:50 --------- d-----w C:\Documents and Settings\Trax\Application Data\Xara
2008-02-11 10:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-11 10:47 --------- d-----w C:\Program Files\Xara
2008-02-11 09:31 --------- d-----w C:\Program Files\Java
2008-02-11 08:53 700,416 ----a-w C:\StubInstaller.exe
2008-02-11 08:46 --------- d-----w C:\Program Files\McAfee.com
2008-02-11 08:46 --------- d-----w C:\Program Files\McAfee
2008-02-11 08:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-02-11 08:38 --------- d-----w C:\Program Files\SiteAdvisor
2008-02-11 08:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-11 08:35 --------- d-----w C:\Program Files\Fichiers communs\McAfee
2007-12-10 20:51 --------- d-----w C:\Documents and Settings\Trax\Application Data\Skype
2007-12-10 19:59 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-12-05 18:50 --------- d-----w C:\Program Files\PpStream Fr
2007-12-05 18:50 --------- d-----w C:\Documents and Settings\Trax\Application Data\ppStream
2007-12-05 18:38 --------- d-----w C:\Program Files\FileZilla
2007-11-23 22:36 --------- d-----w C:\Program Files\bwin
2007-11-18 13:52 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00004.tmp
2007-11-16 23:15 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00003.tmp
2007-11-16 23:12 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00002.tmp
2007-11-16 23:09 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00001.tmp
2007-11-10 08:20 --------- d-----w C:\Program Files\TVAnts
2007-11-10 08:20 --------- d-----w C:\Program Files\SopCast
2007-11-08 21:23 --------- d-----w C:\Program Files\Bonjour
2007-11-08 21:20 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-11-08 21:06 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2007-11-04 23:25 --------- d-----w C:\Documents and Settings\Trax\Application Data\FileZilla
2007-10-31 21:42 --------- d-----w C:\Program Files\iTunes
2007-10-31 21:42 --------- d-----w C:\Program Files\iPod
2007-10-31 21:39 --------- d-----w C:\Program Files\QuickTime
2007-10-31 21:37 --------- d-----w C:\Program Files\Apple Software Update
2007-10-31 21:36 --------- d-----w C:\Program Files\Fichiers communs\Apple
2007-10-31 21:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\SYSTEM32\shell32(2).dll
2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2006-12-23 19:57 70,488 ----a-w C:\Documents and Settings\Trax\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45C7E599-123B-4556-9134-24C78EFBEBD7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EC39F86A-6671-414E-8743-F9132342690B}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-05 17:35]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-28 08:20]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-08-21 19:04]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2004-05-16 21:18]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 18:32]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 12:43]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 02:05]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-12-16 19:26]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36]
"EPSON Stylus DX4800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.exe" [2005-02-02 05:00]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-05-12 13:30]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-08-31 20:24]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 22:57]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]

C:\Documents and Settings\Trax\Menu D‚marrer\Programmes\D‚marrage\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-02-11 12:44:58]
~$ANNING.doc [2006-08-05 09:40:08]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - C:\Program Files\Dell\Logiciel Bluetooth\BTTray.exe [2004-04-08 23:23:40]
DataViz Inc Messenger.lnk - C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe [2007-05-25 17:46:43]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2004-12-24 00:43:06]
HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:16:08]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\system32\LgNotify.dll 2004-01-12 07:55 110592 C:\WINDOWS\SYSTEM32\LgNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

S3 av100s2k;av100s2k;C:\WINDOWS\system32\DRIVERS\av100s2k.sys
S3 av100u2k;av100u2k;C:\WINDOWS\system32\DRIVERS\av100u2k.sys
S3 NAL;Nal Service ;\??\C:\WINDOWS\system32\Drivers\iqvw32.sys
S3 PhilCam8116;QuickCam Pro 3000 Logitech (08B0);C:\WINDOWS\system32\DRIVERS\CamDrO21.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58c58370-acdf-11d9-b762-0011433c46b9}]
\Shell\AutoRun\command - E:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6071f370-682d-11db-baa2-0011433c46b9}]
\Shell\AutoRun\command - F:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3cd6bf2-1ddb-11dc-bb26-0011433c46b9}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL click_me.html

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-04 17:45:23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-11 08:34:59 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-11 08:34:57 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\DOCUME~1\Trax\LOCALS~1\Temp\jpsfgeqwUTER.dll
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-10 21:51:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-10 21:53:34
C:\ComboFix2.txt ... 2007-12-09 10:50
.
--- E O F ---


10 Décembre 2007 22:08:35

Re

Tu n'as rien donné à manger à Combofix, les fichiers sont encore là.

On voit au début du rapport de Combofix que le CFScript est vide.

Recommence la manip.
10 Décembre 2007 22:56:21

Sorry... est-ce qu'on est mieux :

ComboFix 07-12-09.1 - Trax 2007-12-10 22:46:54.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.132 [GMT 1:00]
Running from: C:\Documents and Settings\Trax\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Trax\Bureau\CFScript.txt
* Created a new restore point

FILE
C:\DOCUME~1\Trax\LOCALS~1\Temp\jpsfgeqwUTER.dll
C:\Documents and Settings\All Users\Application Data\pqrylure.dll
C:\Documents and Settings\Trax\Application Data\~LM00001.tmp
C:\Documents and Settings\Trax\Application Data\~LM00002.tmp
C:\Documents and Settings\Trax\Application Data\~LM00003.tmp
C:\Documents and Settings\Trax\Application Data\~LM00004.tmp
C:\StubInstaller.exe
C:\WINDOWS\SYSTEM32\bfaodrns.ini
C:\WINDOWS\SYSTEM32\bijsawvd.ini
C:\WINDOWS\SYSTEM32\ddccbxw.dll
C:\WINDOWS\SYSTEM32\ducdopxo.exe
C:\WINDOWS\system32\gwehgvkg.dll
C:\WINDOWS\SYSTEM32\hgtaacii.exe
C:\WINDOWS\SYSTEM32\kpyqyrlb.exe
C:\WINDOWS\SYSTEM32\orbcnqji.ini
C:\WINDOWS\SYSTEM32\qfovkrbl
C:\WINDOWS\SYSTEM32\ransvrtd.ini
C:\WINDOWS\system32\rqopn.dll
C:\WINDOWS\SYSTEM32\tsutv.bak2
C:\WINDOWS\SYSTEM32\tsutv.ini
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\StubInstaller.exe
C:\WINDOWS\SYSTEM32\bfaodrns.ini
C:\WINDOWS\SYSTEM32\bijsawvd.ini
C:\WINDOWS\SYSTEM32\ducdopxo.exe
C:\WINDOWS\SYSTEM32\hgtaacii.exe
C:\WINDOWS\SYSTEM32\kpyqyrlb.exe
C:\WINDOWS\SYSTEM32\orbcnqji.ini
C:\WINDOWS\SYSTEM32\ransvrtd.ini
C:\WINDOWS\SYSTEM32\tsutv.bak2
C:\WINDOWS\SYSTEM32\tsutv.ini

.
((((((((((((((((((((((((((((( Fichiers créés 2007-11-10 to 2007-12-10 ))))))))))))))))))))))))))))))))))))
.

2007-12-09 10:57 . 2007-12-09 10:57 <REP> d-------- C:\Program Files\Trend Micro
2007-12-05 21:11 . 2007-12-05 21:11 24,576 --a------ C:\WINDOWS\SYSTEM32\VundoFixSVC.exe
2007-12-05 20:10 . 2007-12-05 20:10 <REP> d-------- C:\VundoFix Backups
2007-11-18 16:16 . 2007-11-18 22:00 <REP> d-------- C:\Program Files\Windows Live Safety Center
2007-11-18 15:30 . 2007-11-18 15:30 <REP> d-------- C:\WINDOWS\SYSTEM32\qfovkrbl
2007-11-18 14:52 . 2007-11-18 14:52 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00004.tmp
2007-11-17 00:15 . 2007-11-17 00:15 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00003.tmp
2007-11-17 00:12 . 2007-11-17 00:12 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00002.tmp
2007-11-17 00:09 . 2007-11-17 00:09 <REP> d-------- C:\Documents and Settings\Trax\Application Data\~LM00001.tmp
2007-11-16 23:43 . 2007-12-05 19:49 <REP> d-------- C:\Program Files\LMSOFT Web Creator Pro 4
2007-11-16 21:18 . 2007-11-16 21:18 <REP> d-------- C:\Program Files\BroadJump
2007-11-16 21:04 . 2007-11-16 21:17 <REP> d-------- C:\Documents and Settings\Trax\Application Data\vmntoolbar
2007-11-16 21:03 . 2007-11-16 21:03 <REP> d-------- C:\Program Files\Visicom Media
2007-11-10 17:37 . 2007-11-16 19:42 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-11-10 17:27 . 2007-11-10 17:27 <REP> d-------- C:\Program Files\CCleaner
2007-11-10 10:39 . 2007-11-10 13:10 <REP> d-------- C:\Documents and Settings\Trax\.housecall6.6
2007-11-10 10:27 . 2004-08-05 13:00 33,792 --a------ C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
2007-11-10 10:27 . 2004-08-05 13:00 33,792 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\rundll32.exe
2007-11-10 09:48 . 2007-11-10 09:48 <REP> d-------- C:\Documents and Settings\Trax\Application Data\McAfee
2007-11-10 09:45 . 2008-02-11 09:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2007-11-10 09:25 . 2008-02-10 18:50 143 --a------ C:\WINDOWS\SYSTEM32\mcrh.tmp
2007-11-10 09:06 . 2007-11-10 09:06 <REP> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-13 22:08 --------- d-----w C:\Documents and Settings\Trax\Application Data\SiteAdvisor
2008-02-11 10:50 --------- d-----w C:\Documents and Settings\Trax\Application Data\Xara
2008-02-11 10:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-11 10:47 --------- d-----w C:\Program Files\Xara
2008-02-11 09:31 --------- d-----w C:\Program Files\Java
2008-02-11 08:46 --------- d-----w C:\Program Files\McAfee.com
2008-02-11 08:46 --------- d-----w C:\Program Files\McAfee
2008-02-11 08:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-02-11 08:38 --------- d-----w C:\Program Files\SiteAdvisor
2008-02-11 08:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-11 08:35 --------- d-----w C:\Program Files\Fichiers communs\McAfee
2007-12-10 21:51 --------- d-----w C:\Documents and Settings\Trax\Application Data\Skype
2007-12-10 19:59 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-12-05 18:50 --------- d-----w C:\Program Files\PpStream Fr
2007-12-05 18:50 --------- d-----w C:\Documents and Settings\Trax\Application Data\ppStream
2007-12-05 18:38 --------- d-----w C:\Program Files\FileZilla
2007-11-23 22:36 --------- d-----w C:\Program Files\bwin
2007-11-18 13:52 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00004.tmp
2007-11-16 23:15 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00003.tmp
2007-11-16 23:12 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00002.tmp
2007-11-16 23:09 --------- d-----w C:\Documents and Settings\Trax\Application Data\~LM00001.tmp
2007-11-10 08:20 --------- d-----w C:\Program Files\TVAnts
2007-11-10 08:20 --------- d-----w C:\Program Files\SopCast
2007-11-08 21:23 --------- d-----w C:\Program Files\Bonjour
2007-11-08 21:20 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-11-08 21:06 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2007-11-04 23:25 --------- d-----w C:\Documents and Settings\Trax\Application Data\FileZilla
2007-10-31 21:42 --------- d-----w C:\Program Files\iTunes
2007-10-31 21:42 --------- d-----w C:\Program Files\iPod
2007-10-31 21:39 --------- d-----w C:\Program Files\QuickTime
2007-10-31 21:37 --------- d-----w C:\Program Files\Apple Software Update
2007-10-31 21:36 --------- d-----w C:\Program Files\Fichiers communs\Apple
2007-10-31 21:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\SYSTEM32\shell32(2).dll
2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\shell32.dll
2006-12-23 19:57 70,488 ----a-w C:\Documents and Settings\Trax\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-05 17:35]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-28 08:20]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-08-21 19:04]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2004-05-16 21:18]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 18:32]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 12:43]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 02:05]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-12-16 19:26]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36]
"EPSON Stylus DX4800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.exe" [2005-02-02 05:00]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-05-12 13:30]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2007-08-31 20:24]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 22:57]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00]

C:\Documents and Settings\Trax\Menu D‚marrer\Programmes\D‚marrage\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-02-11 12:44:58]
~$ANNING.doc [2006-08-05 09:40:08]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - C:\Program Files\Dell\Logiciel Bluetooth\BTTray.exe [2004-04-08 23:23:40]
DataViz Inc Messenger.lnk - C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe [2007-05-25 17:46:43]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2004-12-24 00:43:06]
HotSync Manager.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:16:08]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\system32\LgNotify.dll 2004-01-12 07:55 110592 C:\WINDOWS\SYSTEM32\LgNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

S3 av100s2k;av100s2k;C:\WINDOWS\system32\DRIVERS\av100s2k.sys
S3 av100u2k;av100u2k;C:\WINDOWS\system32\DRIVERS\av100u2k.sys
S3 NAL;Nal Service ;\??\C:\WINDOWS\system32\Drivers\iqvw32.sys
S3 PhilCam8116;QuickCam Pro 3000 Logitech (08B0);C:\WINDOWS\system32\DRIVERS\CamDrO21.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58c58370-acdf-11d9-b762-0011433c46b9}]
\Shell\AutoRun\command - E:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6071f370-682d-11db-baa2-0011433c46b9}]
\Shell\AutoRun\command - F:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3cd6bf2-1ddb-11dc-bb26-0011433c46b9}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL click_me.html

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-12-04 17:45:23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-11 08:34:59 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-11 08:34:57 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-10 22:52:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-10 22:53:21
C:\ComboFix2.txt ... 2007-12-10 21:53
C:\ComboFix3.txt ... 2007-12-09 10:50
.
--- E O F ---
11 Décembre 2007 00:01:56

C'est beaucoup mieux.

Encore une correction.

Télécharge OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt....
Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve ci-dessous, et colle-la dans le cadre de gauche de OTMoveIt :p aste List of Files/Folders to be moved.

C:\WINDOWS\SYSTEM32\qfovkrbl

Clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre Results.
Clique sur Exit pour fermer.

Il te sera peut-être demander de redémarrer le PC pour achever la suppression. Si c'est le cas accepte par Yes.


Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
11 Décembre 2007 19:37:13

Et voila le resultat :
C:\WINDOWS\SYSTEM32\qfovkrbl moved successfully.

Created on 12/11/2007 19:36:36

ça semble tout bon, merci beaucoup pour ton aide, tu m'as rendu un grand service !!! Alors, vraiment... MERCI !
Tom's guide dans le monde
  • Allemagne
  • Italie
  • Irlande
  • Royaume Uni
  • Etats Unis
Suivre Tom's Guide
Inscrivez-vous à la Newsletter
  • ajouter à twitter
  • ajouter à facebook
  • ajouter un flux RSS