Christophe MOYNE

Keylogger n'étant pas accesible depuis le mode Ajout/suppression de programmes j'ai suivis ta méthode, c'est nickel j'ai pu virer le Rep d'installe du coup !! Les Missing dll au démarrage Windows ont disparut aussi ... merci ça commencait à saouler Faut que je clean d'autre choses sinon ? Tu veux que je poste un nouveau rapport ComboFix ?

Mon Log ComboFix ComboFix 08-02-12.1 - Chelnov-VIP 2008-02-12 17:48:34.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.2419 [GMT 1:00] Endroit: D:\Download\ComboFix.exe Command switches used :: D:\Download\CFScript.txt * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! FILE C:\WINDOWS\system32\j1291137.dll C:\WINDOWS\system32\ptkqlkvb.dll C:\WINDOWS\system32\ttvwa.bak1 C:\WINDOWS\system32\ttvwa.bak2 C:\WINDOWS\system32\ttvwa.ini2 C:\WINDOWS\system32\uydoxkeu.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ttvwa.bak1 C:\WINDOWS\system32\ttvwa.bak2 C:\WINDOWS\system32\ttvwa.ini2 . ((((((((((((((((((((((((((((( Fichiers créés 2008-01-12 to 2008-02-12 )))))))))))))))))))))))))))))))))))) . 2008-02-07 17:03 . 2008-02-07 17:03 <REP> d-------- C:\Program Files\MSXML 6.0 2008-02-06 14:57 . 2008-02-06 14:58 <REP> d-------- C:\Documents and Settings\Chelnov-VIP\Application Data\Autodesk 2008-02-06 14:53 . 2008-02-06 14:55 <REP> d-------- C:\Program Files\turbo squid tentacles 2008-02-06 14:51 . 2008-02-06 14:51 231 --a------ C:\WINDOWS\system32\3dsmax.ini 2008-02-06 14:51 . 2008-02-06 14:51 43 --a------ C:\WINDOWS\system32\InstallSettings.ini 2008-02-06 13:58 . 2008-02-06 13:58 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe 2008-02-06 13:58 . 2008-02-06 13:58 22,328 --a------ C:\Documents and Settings\Chelnov-VIP\Application Data\PnkBstrK.sys 2008-02-06 13:50 . 2008-02-06 13:50 <REP> d-------- C:\Program Files\Electronic Arts 2008-02-06 13:48 . 2008-02-06 13:48 <REP> d-------- C:\Program Files\WinISO 2008-01-16 17:50 . 2008-02-07 16:12 235 --a------ C:\WINDOWS\M4DShow.INI . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-12 13:21 --------- d-----w C:\Program Files\SUPERAntiSpyware 2008-02-06 13:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk 2008-02-06 13:51 --------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared 2008-02-06 13:51 --------- d-----w C:\Program Files\Autodesk 2008-02-06 13:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-06 12:58 66,872 ----a-w C:\WINDOWS\system32\pnkbstra.exe 2008-02-06 12:58 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-02-06 12:58 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-02-06 12:46 --------- d-----w C:\Program Files\DAEMON Tools Pro 2008-01-30 16:11 --------- d-----w C:\Program Files\DivX 2008-01-30 09:28 --------- d-----w C:\Documents and Settings\Chelnov-VIP\Application Data\AVG7 2008-01-03 09:41 --------- d-----w C:\Program Files\KeyLogger 2007-12-27 10:43 --------- d-----w C:\Program Files\Java 2007-12-17 07:00 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7 2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2005-10-13 01:24 7086080] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 12:00 15360] "Steam"="D:\Gamez\CounterStrike\\Steam.exe" [2007-11-30 10:40 1266936] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 13:06 1318912] "ISUSPM"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2006-09-10 21:56 218032] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-06-22 13:45 133576] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-01 02:54 7561216] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 17:20 282624 C:\WINDOWS\stsystra.exe] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 07:15 151552] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 03:12 94208] "ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2006-09-10 21:56 218032] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2006-09-10 21:56 86960] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20 122940] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 10:46 579072] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 19:05 1117184] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-25 13:54 229952] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [ ] "SIKL"="C:\Program Files\KeyLogger\mssys.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 12:00 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-25 09:51 219136] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-09-25 15:55:08 113664] EPSON Status Monitor 3 Environment Check(3).lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE [2006-10-09 14:01:12 131584] Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696] TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [2006-09-26 09:41:00 114688] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll R2 mi-raysat_3dsMax2008_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit;"C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe" [2007-09-24 17:05] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-12 17:49:28 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-02-12 17:49:47 ComboFix-quarantined-files.txt 2008-02-12 16:49:39 ComboFix2.txt 2008-02-12 13:36:17 . 2008-02-07 16:04:00 --- E O F --- Le report Kespersky : ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Wednesday, February 13, 2008 10:13:55 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 12/02/2008 Kaspersky Anti-Virus database records: 559994 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - Folders: C:\ D:\ E:\ F:\ G:\ Scan Statistics: Total number of scanned objects: 178244 Number of viruses found: 3 Number of infected objects: 9 Number of suspicious objects: 0 Duration of the scan process: 02:18:54 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\cert8.db Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\GoogleToolbarData\googlesafebrowsing.db Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\history.dat Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\key3.db Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\parent.lock Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\search.sqlite Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Application Data\Mozilla\Firefox\Profiles\2pcubej2.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Chelnov-VIP\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Chelnov-VIP\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Chelnov-VIP\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\mgwyabhl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.kb skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP305\A0051168.dll Infected: not-a-virus:AdTool.Win32.WhenU.i skipped C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP305\A0051172.exe Infected: not-a-virus:AdTool.Win32.WhenU.i skipped C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP340\A0056799.exe Infected: not-a-virus:AdTool.Win32.WhenU.i skipped C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP340\A0056800.dll Infected: not-a-virus:AdTool.Win32.WhenU.i skipped C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP345\A0057217.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kb skipped C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP346\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\hsperfdata_SYSTEM\200 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP346\change.log Object is locked skipped F:\!!! Soft !!!\3D (Max Maya etc ...)\3Dsmax Plugs max4\cebas - maxvr qt 1.0\cebas - maxvr qt 1.0\maxvr.qt.exe Object is locked skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\System Volume Information\_restore{5C52A213-FA59-476B-B9C4-E18C6B498A15}\RP755\A0153888.exe/WISE0018.BIN/cd_clint.dll Infected: not-a-virus:AdWare.Win32.Cydoor skipped F:\System Volume Information\_restore{5C52A213-FA59-476B-B9C4-E18C6B498A15}\RP755\A0153888.exe/WISE0018.BIN Infected: not-a-virus:AdWare.Win32.Cydoor skipped F:\System Volume Information\_restore{5C52A213-FA59-476B-B9C4-E18C6B498A15}\RP755\A0153888.exe WiseSFX: infected - 2 skipped Scan process completed. Voili voila, à noter qu'à la fin du Scan Online je n'ai pas trouvé le moyen de Deleter ou Quaratiner les fichiers infectés, c'est peut être normal vu que ce n'est "Qu'un" scan Online. Sinon, oui oui c'est mois qui est collé Keylogger, faut que je le vire d'ailleur aussi, j'arrive pas à le virer de la base de registre

J'ai lancé la procédure, je poste mon Log ComboFix : ComboFix 08-02-12.1 - Chelnov-VIP 2008-02-12 14:26:11.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.2552 [GMT 1:00] Endroit: D:\Download\ComboFix.exe * Création d'un nouveau point de restauration AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\hpplralkc.dat c:\windows\system32\hpplralkc.exe c:\WINDOWS\system32\hpplralkc_nav.dat C:\WINDOWS\system32\hpplralkc_navps.dat C:\WINDOWS\system32\Imncb.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mgwyabhl.dll C:\WINDOWS\system32\nvs2.inf C:\WINDOWS\system32\Urncbc.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-12 to 2008-02-12 )))))))))))))))))))))))))))))))))))) . 2008-02-07 17:03 . 2008-02-07 17:03 <REP> d-------- C:\Program Files\MSXML 6.0 2008-02-06 14:57 . 2008-02-06 14:58 <REP> d-------- C:\Documents and Settings\Chelnov-VIP\Application Data\Autodesk 2008-02-06 14:53 . 2008-02-06 14:55 <REP> d-------- C:\Program Files\turbo squid tentacles 2008-02-06 14:51 . 2008-02-06 14:51 231 --a------ C:\WINDOWS\system32\3dsmax.ini 2008-02-06 14:51 . 2008-02-06 14:51 43 --a------ C:\WINDOWS\system32\InstallSettings.ini 2008-02-06 13:58 . 2008-02-06 13:58 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe 2008-02-06 13:58 . 2008-02-06 13:58 22,328 --a------ C:\Documents and Settings\Chelnov-VIP\Application Data\PnkBstrK.sys 2008-02-06 13:50 . 2008-02-06 13:50 <REP> d-------- C:\Program Files\Electronic Arts 2008-02-06 13:48 . 2008-02-06 13:48 <REP> d-------- C:\Program Files\WinISO 2008-01-16 17:50 . 2008-02-07 16:12 235 --a------ C:\WINDOWS\M4DShow.INI . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-12 13:21 --------- d-----w C:\Program Files\SUPERAntiSpyware 2008-02-06 13:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk 2008-02-06 13:51 --------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared 2008-02-06 13:51 --------- d-----w C:\Program Files\Autodesk 2008-02-06 13:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-06 12:58 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-02-06 12:46 --------- d-----w C:\Program Files\DAEMON Tools Pro 2008-01-30 16:11 --------- d-----w C:\Program Files\DivX 2008-01-30 09:28 --------- d-----w C:\Documents and Settings\Chelnov-VIP\Application Data\AVG7 2008-01-03 09:41 --------- d-----w C:\Program Files\KeyLogger 2007-12-27 10:43 --------- d-----w C:\Program Files\Java 2007-12-17 07:00 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7 2007-08-01 10:25 6,486 --sh--w C:\WINDOWS\system32\ttvwa.bak1 2007-08-22 08:35 6,526 --sh--w C:\WINDOWS\system32\ttvwa.bak2 2007-08-22 09:00 8,217 --sh--w C:\WINDOWS\system32\ttvwa.ini2 . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4EE5B76D-23A5-41A8-9BC5-2DFFA6B673F9}] C:\WINDOWS\system32\uydoxkeu.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2005-10-13 01:24 7086080] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 12:00 15360] "Steam"="D:\Gamez\CounterStrike\\Steam.exe" [2007-11-30 10:40 1266936] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 13:06 1318912] "ISUSPM"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2006-09-10 21:56 218032] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-06-22 13:45 133576] "WhenUSave"="C:\Program Files\Save\Save.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-01 02:54 7561216] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 17:20 282624 C:\WINDOWS\stsystra.exe] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 07:15 151552] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 03:12 94208] "ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2006-09-10 21:56 218032] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2006-09-10 21:56 86960] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20 122940] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 10:46 579072] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 19:05 1117184] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-25 13:54 229952] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "j1291137"="C:\WINDOWS\system32\j1291137.dll" [ ] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [ ] "SIKL"="C:\Program Files\KeyLogger\mssys.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 12:00 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-25 09:51 219136] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll R2 mi-raysat_3dsMax2008_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit;"C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe" [2007-09-24 17:05] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-12 14:32:48 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Alias\Maya7.0\docs\wrapper.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\Alias\Maya7.0\docs\jre\bin\java.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\WTablet\TabUserW.exe . ************************************************************************** . Temps d'accomplissement: 2008-02-12 14:36:17 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-12 13:36:15 . 2008-02-07 16:04:00 --- E O F ---

Bonjours à tous !! Je fait appelle à vos compétences pour l'analyse de mon rapport. Voici les symptomes: A\ Affichage systematique au demarrage de Windows des deux message suivants (une fenetre s'ouvre a chaque fois) "Erreur de Chargement C:\windows\system32\Ptkqlkvb.dll" Le module spécifié est introuvable ainsi que: "Erreur de Chargement C:\windows\system32\j1291137.dll" Le module spécifié est introuvable B\Ouverture intempestive de Popup que je browse ou pas !! Systeme XP Edition Familiale Version 2002 Service Pack 2 Dell Dimension DXP061 Intel® Core2 CPU 6400 @ 2.13Ghz 3,00 Go de RAM Voici mon Log Hjack Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:14:03, on 12/02/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Alias\Maya7.0\docs\wrapper.exe C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alias\Maya7.0\docs\jre\bin\java.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\WTablet\TabUserW.exe D:\Download\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060919 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/hws/sb/dell-row/fr/side.html?channel=fr R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr/hws/sb/dell-row/fr/side.html?channel=fr R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060919 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/hws/sb/dell-row/fr/side.html?channel=fr R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5060919 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {4EE5B76D-23A5-41A8-9BC5-2DFFA6B673F9} - C:\WINDOWS\system32\uydoxkeu.dll (file missing) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [j1291137] rundll32 C:\WINDOWS\system32\j1291137.dll sook O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINDOWS\system32\ptkqlkvb.dll",forkonce O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [sIKL] C:\Program Files\KeyLogger\mssys.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [steam] D:\Gamez\CounterStrike\\Steam.exe -silent O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -scheduler O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Maya 7.0 Documentation Server (maya70docserver) - Unknown owner - C:\Program Files\Alias\Maya7.0\docs\wrapper.exe O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe -- End of file - 10496 bytes Merci de votre aide Christophe Moyne